Hello,
syzbot found the following crash on:
HEAD commit: c10a026b kmsan: use __free_pages() in kmsan_iounmap_page_r..
git tree: kmsan
console output: https://syzkaller.appspot.com/x/log.txt?x=11c903a3200000
kernel config: https://syzkaller.appspot.com/x/.config?x=a5675814e8eae69e
dashboard link: https://syzkaller.appspot.com/bug?extid=4918ee47ac82d51de00d
compiler: clang version 8.0.0 (trunk 350509)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13b4634d200000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=150657ef200000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+4918ee47ac82d51de00d@xxxxxxxxxxxxxxxxxxxxxxxxx
IPVS: ftp: loaded support on port[0] = 21
==================================================================
BUG: KMSAN: uninit-value in hci_conn_complete_evt
net/bluetooth/hci_event.c:2440 [inline]
BUG: KMSAN: uninit-value in hci_event_packet+0x126e8/0x35290
net/bluetooth/hci_event.c:5781
CPU: 1 PID: 10735 Comm: kworker/u5:1 Not tainted 5.0.0+ #16
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: hci0 hci_rx_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x173/0x1d0 lib/dump_stack.c:113
kmsan_report+0x131/0x2a0 mm/kmsan/kmsan.c:636
__msan_warning+0x7a/0xf0 mm/kmsan/kmsan_instr.c:310
hci_conn_complete_evt net/bluetooth/hci_event.c:2440 [inline]
hci_event_packet+0x126e8/0x35290 net/bluetooth/hci_event.c:5781
hci_rx_work+0x478/0xcc0 net/bluetooth/hci_core.c:4412
process_one_work+0x1607/0x2010 kernel/workqueue.c:2173
worker_thread+0x111c/0x2460 kernel/workqueue.c:2319
kthread+0x4a1/0x4e0 kernel/kthread.c:247
ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:205 [inline]
kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:159
kmsan_kmalloc+0xa6/0x130 mm/kmsan/kmsan_hooks.c:173
kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:182
slab_post_alloc_hook mm/slab.h:445 [inline]
slab_alloc_node mm/slub.c:2773 [inline]
__kmalloc_node_track_caller+0xe9e/0xff0 mm/slub.c:4398
__kmalloc_reserve net/core/skbuff.c:140 [inline]
__alloc_skb+0x309/0xa20 net/core/skbuff.c:208
alloc_skb include/linux/skbuff.h:1012 [inline]
bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline]
bcsp_recv+0x1437/0x2050 drivers/bluetooth/hci_bcsp.c:685
hci_uart_tty_receive+0x35c/0x5d0 drivers/bluetooth/hci_ldisc.c:607
tty_ldisc_receive_buf+0x2ea/0x350 drivers/tty/tty_buffer.c:465
tty_port_default_receive_buf+0x14f/0x1e0 drivers/tty/tty_port.c:38
receive_buf drivers/tty/tty_buffer.c:481 [inline]
flush_to_ldisc+0x30c/0x7f0 drivers/tty/tty_buffer.c:533
process_one_work+0x1607/0x2010 kernel/workqueue.c:2173
worker_thread+0x111c/0x2460 kernel/workqueue.c:2319
kthread+0x4a1/0x4e0 kernel/kthread.c:247
ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355
==================================================================
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
