Messages in this thread | | | From | Sven Eckelmann <> | Subject | Re: KMSAN: uninit-value in batadv_interface_tx (2) | Date | Fri, 31 Jan 2020 08:17:05 +0100 |
| |
On Thursday, 30 January 2020 21:27:12 CET syzbot wrote: [...] > dashboard link: https://syzkaller.appspot.com/bug?extid=24458cef7d37351dd0c3 [...] > Reported-by: syzbot+24458cef7d37351dd0c3@syzkaller.appspotmail.com [...] > ===================================================== > BUG: KMSAN: uninit-value in batadv_interface_tx+0x10cf/0x2450 net/batman-adv/soft-interface.c:264
This line is just comparing the eth_hdr(skb)->h_dest with the STP address (static const buffer).
Is there some situation when hsr would not initialize offset for eth_hdr() correctly or where h_dest is not initialized from a correctly initialized value? At least the comparisons with eth_hdr(skb)->h_source didn't cause this error.
Regarding my assupmtion: it seems like the hsr_xmit is only initializing the h_source in master mode. And there even more conditions (see hsr_addr_subst_dest) for initializing the h_dest in master mode.
Btw. the code in hsr which "stored this" was
if (skb_put_padto(skb, ETH_ZLEN + HSR_HLEN)) return;
[...] > batadv_interface_tx+0x10cf/0x2450 net/batman-adv/soft-interface.c:264 > __netdev_start_xmit include/linux/netdevice.h:4447 [inline] > netdev_start_xmit include/linux/netdevice.h:4461 [inline] > xmit_one net/core/dev.c:3420 [inline] > dev_hard_start_xmit+0x531/0xab0 net/core/dev.c:3436 > __dev_queue_xmit+0x37de/0x4220 net/core/dev.c:4013 > dev_queue_xmit+0x4b/0x60 net/core/dev.c:4046 > hsr_xmit net/hsr/hsr_forward.c:228 [inline] > hsr_forward_do net/hsr/hsr_forward.c:285 [inline] > hsr_forward_skb+0x2614/0x30d0 net/hsr/hsr_forward.c:361 > hsr_handle_frame+0x385/0x4b0 net/hsr/hsr_slave.c:43 > __netif_receive_skb_core+0x21de/0x5840 net/core/dev.c:5051 > __netif_receive_skb_one_core net/core/dev.c:5148 [inline] > __netif_receive_skb net/core/dev.c:5264 [inline] > process_backlog+0x936/0x1410 net/core/dev.c:6095 > napi_poll net/core/dev.c:6532 [inline] > net_rx_action+0x786/0x1ab0 net/core/dev.c:6600 > __do_softirq+0x311/0x83d kernel/softirq.c:293 > run_ksoftirqd+0x25/0x40 kernel/softirq.c:607 > smpboot_thread_fn+0x493/0x980 kernel/smpboot.c:165 > kthread+0x4b5/0x4f0 kernel/kthread.c:256 > ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:353 > > Uninit was stored to memory at: > kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] > kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:310 > kmsan_memcpy_memmove_metadata+0x272/0x2e0 mm/kmsan/kmsan.c:247 > kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:267 > __msan_memcpy+0x43/0x50 mm/kmsan/kmsan_instr.c:116 > pskb_expand_head+0x38b/0x1b00 net/core/skbuff.c:1637 > __skb_pad+0x47f/0x900 net/core/skbuff.c:1805 > __skb_put_padto include/linux/skbuff.h:3193 [inline] > skb_put_padto include/linux/skbuff.h:3212 [inline] > send_hsr_supervision_frame+0x122d/0x1500 net/hsr/hsr_device.c:310 > hsr_announce+0x1e2/0x370 net/hsr/hsr_device.c:341 > call_timer_fn+0x218/0x510 kernel/time/timer.c:1404 > expire_timers kernel/time/timer.c:1449 [inline] > __run_timers+0xcff/0x1210 kernel/time/timer.c:1773 > run_timer_softirq+0x2d/0x50 kernel/time/timer.c:1786 > __do_softirq+0x311/0x83d kernel/softirq.c:293
Kind regards, Sven[unhandled content-type:application/pgp-signature] | |