KMSAN: uninit-value in vxlan_find_mac_rcu

Status: closed as invalid on 2026/07/03 13:15
Subsystems: net
Labels: prio:normal
[Documentation on labels]
First crash: 195d, last: 90d
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
b8f55994 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ KMSAN: uninit-value in vxlan_find_mac_rcu 2026/05/24 11:45 2026/05/24 11:45 2026/05/24 12:46 c69befb3

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in __rht_ptr_rcu include/linux/rhashtable.h:394 [inline]
BUG: KMSAN: uninit-value in __rhashtable_lookup include/linux/rhashtable.h:637 [inline]
BUG: KMSAN: uninit-value in rhashtable_lookup include/linux/rhashtable.h:677 [inline]
BUG: KMSAN: uninit-value in vxlan_find_mac_rcu+0x5da/0x7f0 drivers/net/vxlan/vxlan_core.c:392
 __rht_ptr_rcu include/linux/rhashtable.h:394 [inline]
 __rhashtable_lookup include/linux/rhashtable.h:637 [inline]
 rhashtable_lookup include/linux/rhashtable.h:677 [inline]
 vxlan_find_mac_rcu+0x5da/0x7f0 drivers/net/vxlan/vxlan_core.c:392
 vxlan_find_mac_tx drivers/net/vxlan/vxlan_core.c:401 [inline]
 vxlan_xmit+0x17c5/0x3e70 drivers/net/vxlan/vxlan_core.c:2792
 __netdev_start_xmit include/linux/netdevice.h:5325 [inline]
 netdev_start_xmit include/linux/netdevice.h:5334 [inline]
 xmit_one net/core/dev.c:3888 [inline]
 dev_hard_start_xmit+0x24e/0xad0 net/core/dev.c:3904
 __dev_queue_xmit+0x3412/0x5980 net/core/dev.c:4854
 dev_queue_xmit include/linux/netdevice.h:3385 [inline]
 __bpf_tx_skb net/core/filter.c:2152 [inline]
 __bpf_redirect_common net/core/filter.c:2196 [inline]
 __bpf_redirect+0x162e/0x1760 net/core/filter.c:2203
 ____bpf_clone_redirect net/core/filter.c:2493 [inline]
 bpf_clone_redirect+0x4a6/0x6c0 net/core/filter.c:2456
 ___bpf_prog_run+0x13e8/0xea90 kernel/bpf/core.c:2067
 __bpf_prog_run512+0xc5/0x100 kernel/bpf/core.c:2363
 bpf_dispatcher_nop_func include/linux/bpf.h:1402 [inline]
 __bpf_prog_run include/linux/filter.h:723 [inline]
 bpf_prog_run include/linux/filter.h:730 [inline]
 bpf_test_run+0x493/0xdf0 net/bpf/test_run.c:423
 bpf_prog_test_run_skb+0x22a5/0x3050 net/bpf/test_run.c:1159
 bpf_prog_test_run+0x5bb/0x9f0 kernel/bpf/syscall.c:4743
 __sys_bpf+0x925/0xee0 kernel/bpf/syscall.c:6267
 __do_sys_bpf kernel/bpf/syscall.c:6362 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6360 [inline]
 __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:6360
 x64_sys_call+0x13d0/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 vxlan_find_mac_rcu+0x6f/0x7f0 drivers/net/vxlan/vxlan_core.c:386
 vxlan_find_mac_tx drivers/net/vxlan/vxlan_core.c:401 [inline]
 vxlan_xmit+0x17c5/0x3e70 drivers/net/vxlan/vxlan_core.c:2792
 __netdev_start_xmit include/linux/netdevice.h:5325 [inline]
 netdev_start_xmit include/linux/netdevice.h:5334 [inline]
 xmit_one net/core/dev.c:3888 [inline]
 dev_hard_start_xmit+0x24e/0xad0 net/core/dev.c:3904
 __dev_queue_xmit+0x3412/0x5980 net/core/dev.c:4854
 dev_queue_xmit include/linux/netdevice.h:3385 [inline]
 __bpf_tx_skb net/core/filter.c:2152 [inline]
 __bpf_redirect_common net/core/filter.c:2196 [inline]
 __bpf_redirect+0x162e/0x1760 net/core/filter.c:2203
 ____bpf_clone_redirect net/core/filter.c:2493 [inline]
 bpf_clone_redirect+0x4a6/0x6c0 net/core/filter.c:2456
 ___bpf_prog_run+0x13e8/0xea90 kernel/bpf/core.c:2067
 __bpf_prog_run512+0xc5/0x100 kernel/bpf/core.c:2363
 bpf_dispatcher_nop_func include/linux/bpf.h:1402 [inline]
 __bpf_prog_run include/linux/filter.h:723 [inline]
 bpf_prog_run include/linux/filter.h:730 [inline]
 bpf_test_run+0x493/0xdf0 net/bpf/test_run.c:423
 bpf_prog_test_run_skb+0x22a5/0x3050 net/bpf/test_run.c:1159
 bpf_prog_test_run+0x5bb/0x9f0 kernel/bpf/syscall.c:4743
 __sys_bpf+0x925/0xee0 kernel/bpf/syscall.c:6267
 __do_sys_bpf kernel/bpf/syscall.c:6362 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6360 [inline]
 __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:6360
 x64_sys_call+0x13d0/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4545 [inline]
 slab_alloc_node mm/slub.c:4866 [inline]
 kmem_cache_alloc_node_noprof+0x3cd/0x12d0 mm/slub.c:4918
 kmalloc_reserve net/core/skbuff.c:613 [inline]
 pskb_expand_head+0x2ef/0x1e00 net/core/skbuff.c:2312
 skb_ensure_writable+0x44e/0x510 net/core/skbuff.c:6362
 __bpf_try_make_writable net/core/filter.c:1681 [inline]
 bpf_try_make_writable net/core/filter.c:1687 [inline]
 bpf_try_make_head_writable net/core/filter.c:1695 [inline]
 ____bpf_clone_redirect net/core/filter.c:2487 [inline]
 bpf_clone_redirect+0x301/0x6c0 net/core/filter.c:2456
 ___bpf_prog_run+0x13e8/0xea90 kernel/bpf/core.c:2067
 __bpf_prog_run512+0xc5/0x100 kernel/bpf/core.c:2363
 bpf_dispatcher_nop_func include/linux/bpf.h:1402 [inline]
 __bpf_prog_run include/linux/filter.h:723 [inline]
 bpf_prog_run include/linux/filter.h:730 [inline]
 bpf_test_run+0x493/0xdf0 net/bpf/test_run.c:423
 bpf_prog_test_run_skb+0x22a5/0x3050 net/bpf/test_run.c:1159
 bpf_prog_test_run+0x5bb/0x9f0 kernel/bpf/syscall.c:4743
 __sys_bpf+0x925/0xee0 kernel/bpf/syscall.c:6267
 __do_sys_bpf kernel/bpf/syscall.c:6362 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6360 [inline]
 __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:6360
 x64_sys_call+0x13d0/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x134/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 14802 Comm: syz.3.1727 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
=====================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/13 14:14 upstream 028ef9c96e96 9530ccf9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in vxlan_find_mac_rcu
2026/05/21 09:51 upstream df685633c3db 41b8c833 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in vxlan_find_mac_rcu
2026/05/21 09:45 upstream df685633c3db 41b8c833 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in vxlan_find_mac_rcu
2026/02/06 18:01 upstream b7ff7151e653 97745f52 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in vxlan_find_mac_rcu
2026/02/06 05:00 upstream 8fdb05de0e2d f03c4191 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in vxlan_find_mac_rcu
* Struck through repros no longer work on HEAD.