KMSAN: uninit-value in do_dccp_getsockopt

syzbot <[email protected]>
Newsgroups org.kernel.vger.dccp,org.kernel.vger.linux-kernel,org.kernel.vger.netdev
Message-ID <[email protected]>
Hello,

syzbot found the following crash on:

HEAD commit:    c95d0c95 kmsan: block: skip bio block merging logic for KM..
git tree:       https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x3677bbe00000
kernel config:  https://syzkaller.appspot.com/x/.config?xx11db4cc444a7f6
dashboard link: https://syzkaller.appspot.com/bug?extidÞ5579bd3a5d86b1e863
compiler:       clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: [email protected]

==========================BUG: KMSAN: uninit-value in ccid_hc_rx_getsockopt net/dccp/ccids/../ccid.h:246 [inline]
BUG: KMSAN: uninit-value in do_dccp_getsockopt+0x1851/0x1e10 net/dccp/proto.c:671
CPU: 1 PID: 28577 Comm: syz-executor.1 Not tainted 5.6.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 ccid_hc_rx_getsockopt net/dccp/ccids/../ccid.h:246 [inline]
 do_dccp_getsockopt+0x1851/0x1e10 net/dccp/proto.c:671
 dccp_getsockopt+0xfd/0x200 net/dccp/proto.c:694
 sock_common_getsockopt+0x13f/0x180 net/core/sock.c:3111
 __sys_getsockopt+0x533/0x7b0 net/socket.c:2177
 __do_sys_getsockopt net/socket.c:2192 [inline]
 __se_sys_getsockopt+0xe1/0x100 net/socket.c:2189
 __x64_sys_getsockopt+0x62/0x80 net/socket.c:2189
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45c849
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f60866cdc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00007f60866ce6d4 RCX: 000000000045c849
RDX: 00000000000000a9 RSI: 000000000000010d RDI: 0000000000000004
RBP: 000000000076bf00 R08: 00000000200000c0 R09: 0000000000000000
R10: 0000000020000140 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000174 R14: 00000000004c3f3e R15: 000000000076bf0c

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline]
 kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:127
 kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:82
 slab_alloc_node mm/slub.c:2801 [inline]
 slab_alloc mm/slub.c:2810 [inline]
 kmem_cache_alloc+0x711/0xd70 mm/slub.c:2815
 ccid_new+0x1da/0x680 net/dccp/ccid.c:148
 dccp_hdlr_ccid+0x9f/0x260 net/dccp/feat.c:39
 __dccp_feat_activate net/dccp/feat.c:339 [inline]
 dccp_feat_activate_values+0x5e9/0x1660 net/dccp/feat.c:1537
 dccp_rcv_request_sent_state_process net/dccp/input.c:468 [inline]
 dccp_rcv_state_process+0x1a6d/0x2320 net/dccp/input.c:676
 dccp_v4_do_rcv+0x221/0x330 net/dccp/ipv4.c:684
 sk_backlog_rcv include/net/sock.h:963 [inline]
 __release_sock+0x2a3/0x5c0 net/core/sock.c:2440
 release_sock+0x99/0x2a0 net/core/sock.c:2956
 inet_wait_for_connect net/ipv4/af_inet.c:588 [inline]
 __inet_stream_connect+0xb05/0x1340 net/ipv4/af_inet.c:680
 inet_stream_connect+0x101/0x180 net/ipv4/af_inet.c:719
 __sys_connect_file net/socket.c:1859 [inline]
 __sys_connect+0x6f7/0x770 net/socket.c:1876
 __do_sys_connect net/socket.c:1887 [inline]
 __se_sys_connect+0x8d/0xb0 net/socket.c:1884
 __x64_sys_connect+0x4a/0x70 net/socket.c:1884
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
==========================

---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.