KMSAN: uninit-value in __inet_lookup_established (2)

Status: auto-closed as invalid on 2022/02/18 00:51
Subsystems: net
[Documentation on labels]
First crash: 1727d, last: 1727d
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: slab-use-after-free Read in __inet_lookup_established (2) net 19 1 186d 186d 0/29 closed as invalid on 2026/04/01 01:54
upstream KASAN: slab-use-after-free Read in __inet_lookup_established net 19 1 303d 303d 0/29 closed as invalid on 2025/11/14 06:50

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __inet_lookup_established+0xbc4/0xe30
 __inet_lookup_established+0xbc4/0xe30
 tcp_v4_early_demux+0x67c/0xdb0 net/ipv4/tcp_ipv4.c:1778
 ip_rcv_finish_core+0x1a6f/0x21a0 net/ipv4/ip_input.c:340
 ip_list_rcv_finish net/ipv4/ip_input.c:583 [inline]
 ip_sublist_rcv+0x68b/0x1520 net/ipv4/ip_input.c:609
 ip_list_rcv+0x95f/0x9a0 net/ipv4/ip_input.c:644
 __netif_receive_skb_list_ptype net/core/dev.c:5486 [inline]
 __netif_receive_skb_list_core+0xe34/0x1240 net/core/dev.c:5534
 __netif_receive_skb_list+0x7fc/0x960 net/core/dev.c:5586
 netif_receive_skb_list_internal+0x863/0xde0 net/core/dev.c:5677
 gro_normal_list net/core/dev.c:5831 [inline]
 napi_complete_done+0x579/0xdd0 net/core/dev.c:6569
 virtqueue_napi_complete drivers/net/virtio_net.c:337 [inline]
 virtnet_poll+0x177a/0x22a0 drivers/net/virtio_net.c:1540
 __napi_poll+0x150/0xb20 net/core/dev.c:6993
 napi_poll net/core/dev.c:7060 [inline]
 net_rx_action+0x733/0x14c0 net/core/dev.c:7147
 __do_softirq+0x1c9/0x6ec kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu kernel/softirq.c:636 [inline]
 irq_exit_rcu+0xd9/0x1d0 kernel/softirq.c:648
 common_interrupt+0x8f/0xa0 arch/x86/kernel/irq.c:240
 asm_common_interrupt+0x1e/0x40
 kmsan_get_shadow_origin_ptr+0x92/0xd0 mm/kmsan/shadow.c:161
 get_shadow_origin_ptr mm/kmsan/instrumentation.c:31 [inline]
 __msan_metadata_ptr_for_load_8+0x20/0x30 mm/kmsan/instrumentation.c:68
 batadv_nc_worker+0x157/0x2590 net/batman-adv/network-coding.c:723
 process_one_work+0xdc7/0x1760 kernel/workqueue.c:2297
 worker_thread+0x1101/0x22b0 kernel/workqueue.c:2444
 kthread+0x66b/0x780 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30

Local variable regs created at:
 __bpf_prog_run32+0x84/0x180 kernel/bpf/core.c:1787
 bpf_dispatcher_nop_func include/linux/bpf.h:718 [inline]
 __bpf_prog_run include/linux/filter.h:624 [inline]
 bpf_prog_run include/linux/filter.h:631 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:1871 [inline]
 bpf_trace_run1+0xdc/0x2f0 kernel/trace/bpf_trace.c:1907
=====================================================
=====================================================
BUG: KMSAN: uninit-value in __inet_lookup_established+0x6aa/0xe30 net/ipv4/inet_hashtables.c:411
 __inet_lookup_established+0x6aa/0xe30 net/ipv4/inet_hashtables.c:411
 tcp_v4_early_demux+0x67c/0xdb0 net/ipv4/tcp_ipv4.c:1778
 ip_rcv_finish_core+0x1a6f/0x21a0 net/ipv4/ip_input.c:340
 ip_list_rcv_finish net/ipv4/ip_input.c:583 [inline]
 ip_sublist_rcv+0x68b/0x1520 net/ipv4/ip_input.c:609
 ip_list_rcv+0x95f/0x9a0 net/ipv4/ip_input.c:644
 __netif_receive_skb_list_ptype net/core/dev.c:5486 [inline]
 __netif_receive_skb_list_core+0xe34/0x1240 net/core/dev.c:5534
 __netif_receive_skb_list+0x7fc/0x960 net/core/dev.c:5586
 netif_receive_skb_list_internal+0x863/0xde0 net/core/dev.c:5677
 gro_normal_list net/core/dev.c:5831 [inline]
 napi_complete_done+0x579/0xdd0 net/core/dev.c:6569
 virtqueue_napi_complete drivers/net/virtio_net.c:337 [inline]
 virtnet_poll+0x177a/0x22a0 drivers/net/virtio_net.c:1540
 __napi_poll+0x150/0xb20 net/core/dev.c:6993
 napi_poll net/core/dev.c:7060 [inline]
 net_rx_action+0x733/0x14c0 net/core/dev.c:7147
 __do_softirq+0x1c9/0x6ec kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu kernel/softirq.c:636 [inline]
 irq_exit_rcu+0xd9/0x1d0 kernel/softirq.c:648
 common_interrupt+0x8f/0xa0 arch/x86/kernel/irq.c:240
 asm_common_interrupt+0x1e/0x40
 kmsan_get_shadow_origin_ptr+0x92/0xd0 mm/kmsan/shadow.c:161
 get_shadow_origin_ptr mm/kmsan/instrumentation.c:31 [inline]
 __msan_metadata_ptr_for_load_8+0x20/0x30 mm/kmsan/instrumentation.c:68
 batadv_nc_worker+0x157/0x2590 net/batman-adv/network-coding.c:723
 process_one_work+0xdc7/0x1760 kernel/workqueue.c:2297
 worker_thread+0x1101/0x22b0 kernel/workqueue.c:2444
 kthread+0x66b/0x780 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30

Local variable regs created at:
 __bpf_prog_run32+0x84/0x180 kernel/bpf/core.c:1787
 bpf_dispatcher_nop_func include/linux/bpf.h:718 [inline]
 __bpf_prog_run include/linux/filter.h:624 [inline]
 bpf_prog_run include/linux/filter.h:631 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:1871 [inline]
 bpf_trace_run1+0xdc/0x2f0 kernel/trace/bpf_trace.c:1907
=====================================================
=====================================================
BUG: KMSAN: uninit-value in __inet_lookup_established+0x718/0xe30 net/ipv4/inet_hashtables.c:413
 __inet_lookup_established+0x718/0xe30 net/ipv4/inet_hashtables.c:413
 tcp_v4_early_demux+0x67c/0xdb0 net/ipv4/tcp_ipv4.c:1778
 ip_rcv_finish_core+0x1a6f/0x21a0 net/ipv4/ip_input.c:340
 ip_list_rcv_finish net/ipv4/ip_input.c:583 [inline]
 ip_sublist_rcv+0x68b/0x1520 net/ipv4/ip_input.c:609
 ip_list_rcv+0x95f/0x9a0 net/ipv4/ip_input.c:644
 __netif_receive_skb_list_ptype net/core/dev.c:5486 [inline]
 __netif_receive_skb_list_core+0xe34/0x1240 net/core/dev.c:5534
 __netif_receive_skb_list+0x7fc/0x960 net/core/dev.c:5586
 netif_receive_skb_list_internal+0x863/0xde0 net/core/dev.c:5677
 gro_normal_list net/core/dev.c:5831 [inline]
 napi_complete_done+0x579/0xdd0 net/core/dev.c:6569
 virtqueue_napi_complete drivers/net/virtio_net.c:337 [inline]
 virtnet_poll+0x177a/0x22a0 drivers/net/virtio_net.c:1540
 __napi_poll+0x150/0xb20 net/core/dev.c:6993
 napi_poll net/core/dev.c:7060 [inline]
 net_rx_action+0x733/0x14c0 net/core/dev.c:7147
 __do_softirq+0x1c9/0x6ec kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu kernel/softirq.c:636 [inline]
 irq_exit_rcu+0xd9/0x1d0 kernel/softirq.c:648
 common_interrupt+0x8f/0xa0 arch/x86/kernel/irq.c:240
 asm_common_interrupt+0x1e/0x40
 kmsan_get_shadow_origin_ptr+0x92/0xd0 mm/kmsan/shadow.c:161
 get_shadow_origin_ptr mm/kmsan/instrumentation.c:31 [inline]
 __msan_metadata_ptr_for_load_8+0x20/0x30 mm/kmsan/instrumentation.c:68
 batadv_nc_worker+0x157/0x2590 net/batman-adv/network-coding.c:723
 process_one_work+0xdc7/0x1760 kernel/workqueue.c:2297
 worker_thread+0x1101/0x22b0 kernel/workqueue.c:2444
 kthread+0x66b/0x780 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30

Local variable regs created at:
 __bpf_prog_run32+0x84/0x180 kernel/bpf/core.c:1787
 bpf_dispatcher_nop_func include/linux/bpf.h:718 [inline]
 __bpf_prog_run include/linux/filter.h:624 [inline]
 bpf_prog_run include/linux/filter.h:631 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:1871 [inline]
 bpf_trace_run1+0xdc/0x2f0 kernel/trace/bpf_trace.c:1907
=====================================================
=====================================================
BUG: KMSAN: uninit-value in __inet_lookup_established+0xd23/0xe30 net/ipv4/inet_hashtables.c:417
 __inet_lookup_established+0xd23/0xe30 net/ipv4/inet_hashtables.c:417
 tcp_v4_early_demux+0x67c/0xdb0 net/ipv4/tcp_ipv4.c:1778
 ip_rcv_finish_core+0x1a6f/0x21a0 net/ipv4/ip_input.c:340
 ip_list_rcv_finish net/ipv4/ip_input.c:583 [inline]
 ip_sublist_rcv+0x68b/0x1520 net/ipv4/ip_input.c:609
 ip_list_rcv+0x95f/0x9a0 net/ipv4/ip_input.c:644
 __netif_receive_skb_list_ptype net/core/dev.c:5486 [inline]
 __netif_receive_skb_list_core+0xe34/0x1240 net/core/dev.c:5534
 __netif_receive_skb_list+0x7fc/0x960 net/core/dev.c:5586
 netif_receive_skb_list_internal+0x863/0xde0 net/core/dev.c:5677
 gro_normal_list net/core/dev.c:5831 [inline]
 napi_complete_done+0x579/0xdd0 net/core/dev.c:6569
 virtqueue_napi_complete drivers/net/virtio_net.c:337 [inline]
 virtnet_poll+0x177a/0x22a0 drivers/net/virtio_net.c:1540
 __napi_poll+0x150/0xb20 net/core/dev.c:6993
 napi_poll net/core/dev.c:7060 [inline]
 net_rx_action+0x733/0x14c0 net/core/dev.c:7147
 __do_softirq+0x1c9/0x6ec kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu kernel/softirq.c:636 [inline]
 irq_exit_rcu+0xd9/0x1d0 kernel/softirq.c:648
 common_interrupt+0x8f/0xa0 arch/x86/kernel/irq.c:240
 asm_common_interrupt+0x1e/0x40
 kmsan_get_shadow_origin_ptr+0x92/0xd0 mm/kmsan/shadow.c:161
 get_shadow_origin_ptr mm/kmsan/instrumentation.c:31 [inline]
 __msan_metadata_ptr_for_load_8+0x20/0x30 mm/kmsan/instrumentation.c:68
 batadv_nc_worker+0x157/0x2590 net/batman-adv/network-coding.c:723
 process_one_work+0xdc7/0x1760 kernel/workqueue.c:2297
 worker_thread+0x1101/0x22b0 kernel/workqueue.c:2444
 kthread+0x66b/0x780 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30

Local variable regs created at:
 __bpf_prog_run32+0x84/0x180 kernel/bpf/core.c:1787
 bpf_dispatcher_nop_func include/linux/bpf.h:718 [inline]
 __bpf_prog_run include/linux/filter.h:624 [inline]
 bpf_prog_run include/linux/filter.h:631 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:1871 [inline]
 bpf_trace_run1+0xdc/0x2f0 kernel/trace/bpf_trace.c:1907
=====================================================
usb 4-1: async_complete: urb error -104
usb 4-1: async_complete: urb error -104
usb 4-1: async_complete: urb error -104

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/11/20 00:48 https://github.com/google/kmsan.git master 412af9cd936d 3a9d0024 .config console log report info ci-upstream-kmsan-gce-386 KMSAN: uninit-value in __inet_lookup_established
* Struck through repros no longer work on HEAD.