| Message ID | 20240112132657.647112-1-edumazet@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [net] nbd: always initialize struct msghdr completely | expand |
On Fri, Jan 12, 2024 at 01:26:57PM +0000, Eric Dumazet wrote: > syzbot complains that msg->msg_get_inq value can be uninitialized [1] > > struct msghdr got many new fields recently, we should always make > sure their values is zero by default. > > [1] > BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 > tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 > inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879 > sock_recvmsg_nosec net/socket.c:1044 [inline] > sock_recvmsg+0x12b/0x1e0 net/socket.c:1066 > __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538 > nbd_read_reply drivers/block/nbd.c:732 [inline] > recv_work+0x262/0x3100 drivers/block/nbd.c:863 > process_one_work kernel/workqueue.c:2627 [inline] > process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700 > worker_thread+0xf45/0x1490 kernel/workqueue.c:2781 > kthread+0x3ed/0x540 kernel/kthread.c:388 > ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 > ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 > > Local variable msg created at: > __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513 > nbd_read_reply drivers/block/nbd.c:732 [inline] > recv_work+0x262/0x3100 drivers/block/nbd.c:863 > > CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 > Workqueue: nbd5-recv recv_work > > Fixes: f94fd25cb0aa ("tcp: pass back data left in socket after receive") > Reported-by: syzbot <syzkaller@googlegroups.com> > Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Simon Horman <horms@kernel.org> ...
On Fri, 12 Jan 2024 13:26:57 +0000, Eric Dumazet wrote: > syzbot complains that msg->msg_get_inq value can be uninitialized [1] > > struct msghdr got many new fields recently, we should always make > sure their values is zero by default. > > [1] > BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 > tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 > inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879 > sock_recvmsg_nosec net/socket.c:1044 [inline] > sock_recvmsg+0x12b/0x1e0 net/socket.c:1066 > __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538 > nbd_read_reply drivers/block/nbd.c:732 [inline] > recv_work+0x262/0x3100 drivers/block/nbd.c:863 > process_one_work kernel/workqueue.c:2627 [inline] > process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700 > worker_thread+0xf45/0x1490 kernel/workqueue.c:2781 > kthread+0x3ed/0x540 kernel/kthread.c:388 > ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 > ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 > > [...] Applied, thanks! [1/1] nbd: always initialize struct msghdr completely commit: 78fbb92af27d0982634116c7a31065f24d092826 Best regards,
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 4e72ec4e25ac5a0f41bca299e7efaecf6503c451..33a8f37bb6a1f504060f783c6d727e4c76026a2e 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -508,7 +508,7 @@ static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send, struct iov_iter *iter, int msg_flags, int *sent) { int result; - struct msghdr msg; + struct msghdr msg = {} ; unsigned int noreclaim_flag; if (unlikely(!sock)) { @@ -524,10 +524,6 @@ static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send, do { sock->sk->sk_allocation = GFP_NOIO | __GFP_MEMALLOC; sock->sk->sk_use_task_frag = false; - msg.msg_name = NULL; - msg.msg_namelen = 0; - msg.msg_control = NULL; - msg.msg_controllen = 0; msg.msg_flags = msg_flags | MSG_NOSIGNAL; if (send)
syzbot complains that msg->msg_get_inq value can be uninitialized [1] struct msghdr got many new fields recently, we should always make sure their values is zero by default. [1] BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg+0x12b/0x1e0 net/socket.c:1066 __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538 nbd_read_reply drivers/block/nbd.c:732 [inline] recv_work+0x262/0x3100 drivers/block/nbd.c:863 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700 worker_thread+0xf45/0x1490 kernel/workqueue.c:2781 kthread+0x3ed/0x540 kernel/kthread.c:388 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 Local variable msg created at: __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513 nbd_read_reply drivers/block/nbd.c:732 [inline] recv_work+0x262/0x3100 drivers/block/nbd.c:863 CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: nbd5-recv recv_work Fixes: f94fd25cb0aa ("tcp: pass back data left in socket after receive") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: stable@vger.kernel.org Cc: Josef Bacik <josef@toxicpanda.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: linux-block@vger.kernel.org Cc: nbd@other.debian.org --- drivers/block/nbd.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)