2023-12-07 13:28:14

by lee bruce

Subject: KMSAN: uninit-value in ip_tunnel_xmit

Hello,

When fuzzing the latest upstream linux 6.7-rc4, the following crash
was triggered.
HEAD commit: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8

If you fix this issue, please add the following tag to the commit:
Reported-by: xingwei Lee <[email protected]>

console_log: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-console_log
report: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-report
kernel commit: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=ce27066613dacbb6
repro.c: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-repro-c
repro.txt: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-repro-txt

In the lasted kernel: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8 the
[ 199.471467][ T8590] =====================================================
[ 199.475015][ T8590] BUG: KMSAN: uninit-value in ip_tunnel_xmit+0x857/0x3e80
[ 199.478180][ T8590] ip_tunnel_xmit+0x857/0x3e80
[ 199.480541][ T8590] ipgre_xmit+0xd1c/0xe20
[ 199.482393][ T8590] dev_hard_start_xmit+0x247/0xa10
[ 199.484530][ T8590] __dev_queue_xmit+0x33b8/0x5130
[ 199.486433][ T8590] __bpf_redirect+0xdd7/0x1600
[ 199.488258][ T8590] bpf_clone_redirect+0x328/0x470
[ 199.490250][ T8590] ___bpf_prog_run+0x2180/0xdb80
[ 199.491997][ T8590] __bpf_prog_run512+0xb5/0xe0
[ 199.493691][ T8590] bpf_test_run+0x482/0xb00
[ 199.495215][ T8590] bpf_prog_test_run_skb+0x14e5/0x1f20
[ 199.497026][ T8590] bpf_prog_test_run+0x6af/0xac0
[ 199.498701][ T8590] __sys_bpf+0x649/0xd60
[ 199.500029][ T8590] __x64_sys_bpf+0xa0/0xe0
[ 199.501411][ T8590] do_syscall_64+0x44/0x110
[ 199.502757][ T8590] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 199.504463][ T8590]
[ 199.505159][ T8590] Uninit was created at:
[ 199.506344][ T8590] slab_post_alloc_hook+0x129/0xa70
[ 199.507690][ T8590] kmem_cache_alloc_node+0x5e9/0xb10
[ 199.509191][ T8590] kmalloc_reserve+0x13d/0x4a0
[ 199.510411][ T8590] pskb_expand_head+0x226/0x1a00
[ 199.511657][ T8590] skb_ensure_writable+0x3d3/0x460
[ 199.512905][ T8590] bpf_clone_redirect+0x17f/0x470
[ 199.514135][ T8590] ___bpf_prog_run+0x2180/0xdb80
[ 199.515325][ T8590] __bpf_prog_run512+0xb5/0xe0
[ 199.516479][ T8590] bpf_test_run+0x482/0xb00
[ 199.517580][ T8590] bpf_prog_test_run_skb+0x14e5/0x1f20
[ 199.518901][ T8590] bpf_prog_test_run+0x6af/0xac0
[ 199.520015][ T8590] __sys_bpf+0x649/0xd60
[ 199.520996][ T8590] __x64_sys_bpf+0xa0/0xe0
[ 199.521949][ T8590] do_syscall_64+0x44/0x110
[ 199.522926][ T8590] entry_SYSCALL_64_after_hwframe+0x63/0x6b

and I notice the problem is reported at 2018/2020 and seems fixed twice.

https://syzkaller.appspot.com/bug?id=f62d236e2fceaeb104f4e8f77d2324ef9da4b41b
https://syzkaller.appspot.com/bug?extid=4a2c52677a8a1aa283cb



If you fix this issue, please add the following tag to the commit:
Reported-by: Yikebaer Aizezi <[email protected]>

2023-12-07 14:23:39

by Eric Dumazet

Subject: Re: KMSAN: uninit-value in ip_tunnel_xmit

On Thu, Dec 7, 2023 at 2:27 PM xingwei lee <[email protected]> wrote:
>
> Hello,
>
> When fuzzing the latest upstream linux 6.7-rc4, the following crash
> was triggered.
> HEAD commit: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8
>
> If you fix this issue, please add the following tag to the commit:
> Reported-by: xingwei Lee <[email protected]>
>
> console_log: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-console_log
> report: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-report
> kernel commit: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8
> kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=ce27066613dacbb6
> repro.c: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-repro-c
> repro.txt: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-repro-txt
>
> In the lasted kernel: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8 the
> [ 199.471467][ T8590] =====================================================
> [ 199.475015][ T8590] BUG: KMSAN: uninit-value in ip_tunnel_xmit+0x857/0x3e80
> [ 199.478180][ T8590] ip_tunnel_xmit+0x857/0x3e80
> [ 199.480541][ T8590] ipgre_xmit+0xd1c/0xe20
> [ 199.482393][ T8590] dev_hard_start_xmit+0x247/0xa10
> [ 199.484530][ T8590] __dev_queue_xmit+0x33b8/0x5130
> [ 199.486433][ T8590] __bpf_redirect+0xdd7/0x1600
> [ 199.488258][ T8590] bpf_clone_redirect+0x328/0x470
> [ 199.490250][ T8590] ___bpf_prog_run+0x2180/0xdb80
> [ 199.491997][ T8590] __bpf_prog_run512+0xb5/0xe0
> [ 199.493691][ T8590] bpf_test_run+0x482/0xb00
> [ 199.495215][ T8590] bpf_prog_test_run_skb+0x14e5/0x1f20
> [ 199.497026][ T8590] bpf_prog_test_run+0x6af/0xac0
> [ 199.498701][ T8590] __sys_bpf+0x649/0xd60
> [ 199.500029][ T8590] __x64_sys_bpf+0xa0/0xe0
> [ 199.501411][ T8590] do_syscall_64+0x44/0x110
> [ 199.502757][ T8590] entry_SYSCALL_64_after_hwframe+0x63/0x6b
> [ 199.504463][ T8590]
> [ 199.505159][ T8590] Uninit was created at:
> [ 199.506344][ T8590] slab_post_alloc_hook+0x129/0xa70
> [ 199.507690][ T8590] kmem_cache_alloc_node+0x5e9/0xb10
> [ 199.509191][ T8590] kmalloc_reserve+0x13d/0x4a0
> [ 199.510411][ T8590] pskb_expand_head+0x226/0x1a00
> [ 199.511657][ T8590] skb_ensure_writable+0x3d3/0x460
> [ 199.512905][ T8590] bpf_clone_redirect+0x17f/0x470
> [ 199.514135][ T8590] ___bpf_prog_run+0x2180/0xdb80
> [ 199.515325][ T8590] __bpf_prog_run512+0xb5/0xe0
> [ 199.516479][ T8590] bpf_test_run+0x482/0xb00
> [ 199.517580][ T8590] bpf_prog_test_run_skb+0x14e5/0x1f20
> [ 199.518901][ T8590] bpf_prog_test_run+0x6af/0xac0
> [ 199.520015][ T8590] __sys_bpf+0x649/0xd60
> [ 199.520996][ T8590] __x64_sys_bpf+0xa0/0xe0
> [ 199.521949][ T8590] do_syscall_64+0x44/0x110
> [ 199.522926][ T8590] entry_SYSCALL_64_after_hwframe+0x63/0x6b
>
> and I notice the problem is reported at 2018/2020 and seems fixed twice.
>
> https://syzkaller.appspot.com/bug?id=f62d236e2fceaeb104f4e8f77d2324ef9da4b41b
> https://syzkaller.appspot.com/bug?extid=4a2c52677a8a1aa283cb
>
>
>
> If you fix this issue, please add the following tag to the commit:
> Reported-by: Yikebaer Aizezi <[email protected]>

I think a fix was merged into the net tree yesterday, please double check.

80d875cfc9d3711a029f234ef7d680db79e8fa4b ipv4: ip_gre: Avoid
skb_pull() failure in ipgre_xmit()

2023-12-07 14:28:03

by Alexander Potapenko

Subject: Re: KMSAN: uninit-value in ip_tunnel_xmit

On Thu, Dec 7, 2023 at 2:28 PM xingwei lee <[email protected]> wrote:
>
> Hello,
>
> When fuzzing the latest upstream linux 6.7-rc4, the following crash
> was triggered.
> HEAD commit: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8
>
> If you fix this issue, please add the following tag to the commit:
> Reported-by: xingwei Lee <[email protected]>
>
> console_log: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-console_log
> report: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-report
> kernel commit: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8
> kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=ce27066613dacbb6
> repro.c: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-repro-c
> repro.txt: https://gist.github.com/xrivendell7/b41fbc928cd203823783fd90c98b6583#file-repro-txt
>
> In the lasted kernel: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8 the
> [ 199.471467][ T8590] =====================================================
> [ 199.475015][ T8590] BUG: KMSAN: uninit-value in ip_tunnel_xmit+0x857/0x3e80
> [ 199.478180][ T8590] ip_tunnel_xmit+0x857/0x3e80

In the future, please consider symbolizing your reports using
syz-symbolize before sending them upstream.