syzbot


KMSAN: uninit-value in __skb_clone

Status: auto-obsoleted due to no activity on 2025/10/01 21:36
Subsystems: bridge
[Documentation on labels]
First crash: 360d, last: 309d

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in arch_atomic_inc arch/x86/include/asm/atomic.h:53 [inline]
BUG: KMSAN: uninit-value in raw_atomic_inc include/linux/atomic/atomic-arch-fallback.h:992 [inline]
BUG: KMSAN: uninit-value in atomic_inc include/linux/atomic/atomic-instrumented.h:436 [inline]
BUG: KMSAN: uninit-value in __skb_clone+0x630/0x650 net/core/skbuff.c:1577
 arch_atomic_inc arch/x86/include/asm/atomic.h:53 [inline]
 raw_atomic_inc include/linux/atomic/atomic-arch-fallback.h:992 [inline]
 atomic_inc include/linux/atomic/atomic-instrumented.h:436 [inline]
 __skb_clone+0x630/0x650 net/core/skbuff.c:1577
 skb_clone+0x473/0x580 net/core/skbuff.c:2063
 __tcp_transmit_skb+0x397/0x4b10 net/ipv4/tcp_output.c:1325
 tcp_transmit_skb net/ipv4/tcp_output.c:1497 [inline]
 tcp_write_xmit+0x4460/0x8df0 net/ipv4/tcp_output.c:2839
 __tcp_push_pending_frames+0xc5/0x3c0 net/ipv4/tcp_output.c:3022
 tcp_push_pending_frames include/net/tcp.h:2179 [inline]
 tcp_data_snd_check net/ipv4/tcp_input.c:5771 [inline]
 tcp_rcv_established+0x1168/0x24a0 net/ipv4/tcp_input.c:6314
 tcp_v4_do_rcv+0x7b4/0x1160 net/ipv4/tcp_ipv4.c:1925
 sk_backlog_rcv+0x108/0x420 include/net/sock.h:1132
 __release_sock+0x1d3/0x330 net/core/sock.c:3163
 release_sock+0x6b/0x270 net/core/sock.c:3717
 sk_stream_wait_memory+0xa9e/0x1640 net/core/stream.c:145
 tcp_sendmsg_locked+0x23fe/0x72a0 net/ipv4/tcp.c:1324
 tcp_sendmsg+0x4b/0x90 net/ipv4/tcp.c:1366
 inet_sendmsg+0x134/0x2a0 net/ipv4/af_inet.c:851
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg+0x278/0x3d0 net/socket.c:727
 __sys_sendto+0x590/0x710 net/socket.c:2180
 __do_sys_sendto net/socket.c:2187 [inline]
 __se_sys_sendto net/socket.c:2183 [inline]
 __x64_sys_sendto+0x130/0x200 net/socket.c:2183
 x64_sys_call+0x3c0b/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:45
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4167 [inline]
 slab_alloc_node mm/slub.c:4210 [inline]
 kmem_cache_alloc_node_noprof+0x818/0xf00 mm/slub.c:4262
 __alloc_skb+0x1e0/0x7d0 net/core/skbuff.c:658
 alloc_skb_fclone include/linux/skbuff.h:1390 [inline]
 tcp_stream_alloc_skb+0x4c/0x5f0 net/ipv4/tcp.c:894
 tcp_sendmsg_locked+0x1a1f/0x72a0 net/ipv4/tcp.c:1176
 tcp_sendmsg+0x4b/0x90 net/ipv4/tcp.c:1366
 inet_sendmsg+0x134/0x2a0 net/ipv4/af_inet.c:851
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg+0x278/0x3d0 net/socket.c:727
 __sys_sendto+0x590/0x710 net/socket.c:2180
 __do_sys_sendto net/socket.c:2187 [inline]
 __se_sys_sendto net/socket.c:2183 [inline]
 __x64_sys_sendto+0x130/0x200 net/socket.c:2183
 x64_sys_call+0x3c0b/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:45
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 6610 Comm: syz.4.179 Tainted: [W]=WARN 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
=====================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/30 18:12 upstream 02ddfb981de8 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in __skb_clone
2025/06/04 20:02 net 12c331b29c73 fd5e6e61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce KASAN: use-after-free Write in __skb_clone
2025/06/21 03:21 net-next 4f4040ea5d3e d6cdfb8a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce KASAN: use-after-free Write in __skb_clone
* Struck through repros no longer work on HEAD.