| Message ID | 20210405053306.3437-1-penguin-kernel@I-love.SAKURA.ne.jp (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Guessed tree name to be net-next |
| netdev/subject_prefix | warning | Target tree name not specified in the subject |
| netdev/cc_maintainers | warning | 1 maintainers not CCed: b.a.t.m.a.n@lists.open-mesh.org |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 0 this patch: 0 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 7 lines checked |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 0 this patch: 0 |
| netdev/header_inline | success | Link |
On Monday, 5 April 2021 07:33:06 CEST Tetsuo Handa wrote: [...] > --- > net/batman-adv/translation-table.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c > index f8761281aab0..eb82576557e6 100644 > --- a/net/batman-adv/translation-table.c > +++ b/net/batman-adv/translation-table.c > @@ -973,6 +973,7 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, > > tt_vlan->vid = htons(vlan->vid); > tt_vlan->crc = htonl(vlan->tt.crc); > + tt_vlan->reserved = 0; > > tt_vlan++; > } > Thanks but this patch is incomplete. Please also fix batadv_tt_prepare_tvlv_global_data (exactly the same way) Kind regards, Sven
On 2021/04/05 16:39, Sven Eckelmann wrote: > On Monday, 5 April 2021 07:33:06 CEST Tetsuo Handa wrote: > [...] >> --- >> net/batman-adv/translation-table.c | 1 + >> 1 file changed, 1 insertion(+) >> >> diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c >> index f8761281aab0..eb82576557e6 100644 >> --- a/net/batman-adv/translation-table.c >> +++ b/net/batman-adv/translation-table.c >> @@ -973,6 +973,7 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, >> >> tt_vlan->vid = htons(vlan->vid); >> tt_vlan->crc = htonl(vlan->tt.crc); >> + tt_vlan->reserved = 0; >> >> tt_vlan++; >> } >> > > Thanks but this patch is incomplete. Please also fix > batadv_tt_prepare_tvlv_global_data (exactly the same way) Indeed. Hmm, batadv_send_tt_request() is already using kzalloc(). Which approach ( "->reserved = 0" or "kzalloc()") do you prefer for batadv_tt_prepare_tvlv_global_data() and batadv_tt_prepare_tvlv_local_data() ? > > Kind regards, > Sven >
On Monday, 5 April 2021 12:02:02 CEST Tetsuo Handa wrote: [...] > > Thanks but this patch is incomplete. Please also fix > > batadv_tt_prepare_tvlv_global_data (exactly the same way) > > Indeed. Hmm, batadv_send_tt_request() is already using kzalloc(). > Which approach ( "->reserved = 0" or "kzalloc()") do you prefer for > batadv_tt_prepare_tvlv_global_data() and batadv_tt_prepare_tvlv_local_data() ? Lets stick with the approach you've used in your v1 version - "->reserved = 0" Kind regards, Sven
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index f8761281aab0..eb82576557e6 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -973,6 +973,7 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, tt_vlan->vid = htons(vlan->vid); tt_vlan->crc = htonl(vlan->tt.crc); + tt_vlan->reserved = 0; tt_vlan++; }
KMSAN found uninitialized value at batadv_tt_prepare_tvlv_local_data() [1], for commit ced72933a5e8ab52 ("batman-adv: use CRC32C instead of CRC16 in TT code") inserted 'reserved' field into "struct batadv_tvlv_tt_data" and commit 7ea7b4a142758dea ("batman-adv: make the TT CRC logic VLAN specific") moved that field to "struct batadv_tvlv_tt_vlan_data" but left that field uninitialized. Although this patch passed "#syz test:" check, there might be similar bugs remaining. It might be better to proactively use __GFP_ZERO than trying to find uninitialized fields in this module. [1] https://syzkaller.appspot.com/bug?id=07f3e6dba96f0eb3cabab986adcd8a58b9bdbe9d Reported-by: syzbot <syzbot+50ee810676e6a089487b@syzkaller.appspotmail.com> Tested-by: syzbot <syzbot+50ee810676e6a089487b@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Fixes: ced72933a5e8ab52 ("batman-adv: use CRC32C instead of CRC16 in TT code") Fixes: 7ea7b4a142758dea ("batman-adv: make the TT CRC logic VLAN specific") --- net/batman-adv/translation-table.c | 1 + 1 file changed, 1 insertion(+)