Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:6 as permitted sender) client-ip=2620:137:e000::3:6;
MIME-Version: 1.0
References: <CABOYnLxJzspevWrZLOt+6jkybyUEHfYz8MFZbTuRcyyjnExiKA@mail.gmail.com>
In-Reply-To: <CABOYnLxJzspevWrZLOt+6jkybyUEHfYz8MFZbTuRcyyjnExiKA@mail.gmail.com>
From:   Eric Dumazet <edumazet@google.com>
Date:   Thu, 7 Dec 2023 15:20:43 +0100
Message-ID: <CANn89iLNOyqDy6p1AZj5A=Vr52xhA_d3aDiNyTWOfczTcC8FFw@mail.gmail.com>
Subject: Re: KMSAN: uninit-value in ip_route_output_key_hash_rcu (4)
To:     xingwei lee <xrivendell7@gmail.com>
Cc:     syzbot+549e451574ba8bfd0fd6@syzkaller.appspotmail.com,
        davem@davemloft.net, glider@google.com, kuba@kernel.org,
        Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>,
        linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
        syzkaller-bugs@googlegroups.com, yoshfuji@linux-ipv6.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Thu, Dec 7, 2023 at 2:36=E2=80=AFPM xingwei lee <xrivendell7@gmail.com> =
wrote:
>
> Hello
>
> I reproduced this bug in the latest upstream linux with repro.c and repro=
.txt
>
> When fuzzing the latest upstream linux 6.7-rc4,  the following crash
> was triggered.
> HEAD commit: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8
>
> If you fix this issue, please add the following tag to the commit:
> Reported-by: xingwei Lee <xrivendell7@gmail.com>
>
> console_log: https://gist.github.com/xrivendell7/195eb3c1946ea466f9d8f597=
7b90c6ed#file-console_log
> report: https://gist.github.com/xrivendell7/195eb3c1946ea466f9d8f5977b90c=
6ed#file-report
> kernel commit: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8
> kernel config: https://syzkaller.appspot.com/text?tag=3DKernelConfig&x=3D=
ce27066613dacbb6
> repro.c: https://gist.github.com/xrivendell7/195eb3c1946ea466f9d8f5977b90=
c6ed#file-repro-c
> repro.txt: https://gist.github.com/xrivendell7/195eb3c1946ea466f9d8f5977b=
90c6ed#file-repro-txt
>
> In the lasted kernel: bee0e7762ad2c6025b9f5245c040fcc36ef2bde8 the
> crash likes below:
> [  209.523497][ T8593] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> [  209.530316][ T8593] BUG: KMSAN: uninit-value in
> ip_route_output_key_hash_rcu+0x1ee8/0x3810
> [  209.533357][ T8593]  ip_route_output_key_hash_rcu+0x1ee8/0x3810
> [  209.535524][ T8593]  ip_route_output_flow+0x14f/0x320
> [  209.537312][ T8593]  ip_tunnel_xmit+0x1450/0x3e80
> [  209.538995][ T8593]  ipgre_xmit+0xd1c/0xe20
> [  209.540511][ T8593]  dev_hard_start_xmit+0x247/0xa10
> [  209.542211][ T8593]  __dev_queue_xmit+0x33b8/0x5130
> [  209.543742][ T8593]  __bpf_redirect+0xdd7/0x1600
> [  209.545235][ T8593]  bpf_clone_redirect+0x328/0x470
> [  209.546807][ T8593]  ___bpf_prog_run+0x2180/0xdb80
> [  209.548288][ T8593]  __bpf_prog_run512+0xb5/0xe0
> [  209.549864][ T8593]  bpf_test_run+0x482/0xb00
> [  209.551178][ T8593]  bpf_prog_test_run_skb+0x14e5/0x1f20
> [  209.552612][ T8593]  bpf_prog_test_run+0x6af/0xac0
> [  209.553902][ T8593]  __sys_bpf+0x649/0xd60
> [  209.555000][ T8593]  __x64_sys_bpf+0xa0/0xe0
> [  209.556114][ T8593]  do_syscall_64+0x44/0x110
> [  209.557249][ T8593]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
> [  209.558676][ T8593]
> [  209.559232][ T8593] Uninit was stored to memory at:
> [  209.560528][ T8593]  ip_tunnel_xmit+0x1161/0x3e80
> [  209.561676][ T8593]  ipgre_xmit+0xd1c/0xe20
> [  209.562711][ T8593]  dev_hard_start_xmit+0x247/0xa10
> [  209.563864][ T8593]  __dev_queue_xmit+0x33b8/0x5130
> [  209.564963][ T8593]  __bpf_redirect+0xdd7/0x1600
> [  209.566044][ T8593]  bpf_clone_redirect+0x328/0x470
> [  209.567151][ T8593]  ___bpf_prog_run+0x2180/0xdb80
> [  209.568184][ T8593]  __bpf_prog_run512+0xb5/0xe0
> [  209.569187][ T8593]  bpf_test_run+0x482/0xb00
> [  209.570201][ T8593]  bpf_prog_test_run_skb+0x14e5/0x1f20
> [  209.571308][ T8593]  bpf_prog_test_run+0x6af/0xac0
> [  209.572284][ T8593]  __sys_bpf+0x649/0xd60
> [  209.573131][ T8593]  __x64_sys_bpf+0xa0/0xe0
> [  209.574010][ T8593]  do_syscall_64+0x44/0x110
> [  209.574902][ T8593]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
> [  209.576008][ T8593]
> [  209.576456][ T8593] Uninit was created at:
> [  209.577301][ T8593]  slab_post_alloc_hook+0x129/0xa70
> [  209.578284][ T8593]  kmem_cache_alloc_node+0x5e9/0xb10
> [  209.579233][ T8593]  kmalloc_reserve+0x13d/0x4a0
> [  209.580177][ T8593]  pskb_expand_head+0x226/0x1a00
> [  209.581096][ T8593]  skb_ensure_writable+0x3d3/0x460
> [  209.582015][ T8593]  bpf_clone_redirect+0x17f/0x470
> [  209.582963][ T8593]  ___bpf_prog_run+0x2180/0xdb80
> [  209.583859][ T8593]  __bpf_prog_run512+0xb5/0xe0
> [  209.584725][ T8593]  bpf_test_run+0x482/0xb00
> [  209.585556][ T8593]  bpf_prog_test_run_skb+0x14e5/0x1f20
> [  209.586527][ T8593]  bpf_prog_test_run+0x6af/0xac0
> [  209.587347][ T8593]  __sys_bpf+0x649/0xd60
> [  209.588058][ T8593]  __x64_sys_bpf+0xa0/0xe0
> [  209.588802][ T8593]  do_syscall_64+0x44/0x110
> [  209.589613][ T8593]  entry_SYSCALL_64_after_hwframe+0x63/0x6b

Please double check the latest net tree.