| Message ID | tencent_6C22CC2079326CC82FB96CD89458E9F6EF0A@qq.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | io_uring: fix uninit-value in io_sendrecv_fail | expand |
On 3/16/24 6:42 AM, Edward Adam Davis wrote: > diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c > index cd9a137ad6ce..3db59fd6f676 100644 > --- a/io_uring/io_uring.c > +++ b/io_uring/io_uring.c > @@ -1066,6 +1066,7 @@ static void io_preinit_req(struct io_kiocb *req, struct io_ring_ctx *ctx) > /* not necessary, but safer to zero */ > memset(&req->cqe, 0, sizeof(req->cqe)); > memset(&req->big_cqe, 0, sizeof(req->big_cqe)); > + memset(&req->cmd, 0, sizeof(req->cmd)); > } > > static void io_flush_cached_locked_reqs(struct io_ring_ctx *ctx, This will just silence the syzbot report, as the memory is initialized upfront. But it's not the real fix, as ->done_io could still be recycled from a previous issue.
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index cd9a137ad6ce..3db59fd6f676 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -1066,6 +1066,7 @@ static void io_preinit_req(struct io_kiocb *req, struct io_ring_ctx *ctx) /* not necessary, but safer to zero */ memset(&req->cqe, 0, sizeof(req->cqe)); memset(&req->big_cqe, 0, sizeof(req->big_cqe)); + memset(&req->cmd, 0, sizeof(req->cmd)); } static void io_flush_cached_locked_reqs(struct io_ring_ctx *ctx,
[Syzbot reported] BUG: KMSAN: uninit-value in io_sendrecv_fail+0x91/0x1e0 io_uring/net.c:1334 io_sendrecv_fail+0x91/0x1e0 io_uring/net.c:1334 io_req_defer_failed+0x3bd/0x610 io_uring/io_uring.c:1050 io_queue_sqe_fallback+0x1e3/0x280 io_uring/io_uring.c:2126 io_submit_fail_init+0x4e1/0x790 io_uring/io_uring.c:2304 io_submit_sqes+0x19cd/0x2fb0 io_uring/io_uring.c:2480 __do_sys_io_uring_enter io_uring/io_uring.c:3656 [inline] __se_sys_io_uring_enter+0x409/0x43e0 io_uring/io_uring.c:3591 __x64_sys_io_uring_enter+0x11b/0x1a0 io_uring/io_uring.c:3591 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4592 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2190 [inline] allocate_slab mm/slub.c:2354 [inline] new_slab+0x2d7/0x1400 mm/slub.c:2407 ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540 __kmem_cache_alloc_bulk mm/slub.c:4574 [inline] kmem_cache_alloc_bulk+0x52a/0x1440 mm/slub.c:4648 __io_alloc_req_refill+0x248/0x780 io_uring/io_uring.c:1101 io_alloc_req io_uring/io_uring.h:405 [inline] io_submit_sqes+0xaa1/0x2fb0 io_uring/io_uring.c:2469 __do_sys_io_uring_enter io_uring/io_uring.c:3656 [inline] __se_sys_io_uring_enter+0x409/0x43e0 io_uring/io_uring.c:3591 __x64_sys_io_uring_enter+0x11b/0x1a0 io_uring/io_uring.c:3591 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b [Fix] When initializing the req object, increase its member cmd initialization. Reported-and-tested-by: syzbot+f8e9a371388aa62ecab4@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@qq.com> --- io_uring/io_uring.c | 1 + 1 file changed, 1 insertion(+)