mirror of
https://github.com/torvalds/linux.git
synced 2024-12-05 10:32:35 +00:00
eb80ca476e
syzbot/KMSAN reported an uninit-value in put_cmsg(), originating
from rds_cmsg_recv().
Simply clear the structure, since we have holes there, or since
rx_traces might be smaller than RDS_MSG_RX_DGRAM_TRACE_MAX.
BUG: KMSAN: uninit-value in copy_to_user include/linux/uaccess.h:184 [inline]
BUG: KMSAN: uninit-value in put_cmsg+0x600/0x870 net/core/scm.c:242
CPU: 0 PID: 4459 Comm: syz-executor582 Not tainted 4.16.0+ #87
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x185/0x1d0 lib/dump_stack.c:53
kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
kmsan_internal_check_memory+0x135/0x1e0 mm/kmsan/kmsan.c:1157
kmsan_copy_to_user+0x69/0x160 mm/kmsan/kmsan.c:1199
copy_to_user include/linux/uaccess.h:184 [inline]
put_cmsg+0x600/0x870 net/core/scm.c:242
rds_cmsg_recv net/rds/recv.c:570 [inline]
rds_recvmsg+0x2db5/0x3170 net/rds/recv.c:657
sock_recvmsg_nosec net/socket.c:803 [inline]
sock_recvmsg+0x1d0/0x230 net/socket.c:810
___sys_recvmsg+0x3fb/0x810 net/socket.c:2205
__sys_recvmsg net/socket.c:2250 [inline]
SYSC_recvmsg+0x298/0x3c0 net/socket.c:2262
SyS_recvmsg+0x54/0x80 net/socket.c:2257
do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
Fixes:
|
||
---|---|---|
.. | ||
af_rds.c | ||
bind.c | ||
cong.c | ||
connection.c | ||
ib_cm.c | ||
ib_fmr.c | ||
ib_frmr.c | ||
ib_mr.h | ||
ib_rdma.c | ||
ib_recv.c | ||
ib_ring.c | ||
ib_send.c | ||
ib_stats.c | ||
ib_sysctl.c | ||
ib.c | ||
ib.h | ||
info.c | ||
info.h | ||
Kconfig | ||
loop.c | ||
loop.h | ||
Makefile | ||
message.c | ||
page.c | ||
rdma_transport.c | ||
rdma_transport.h | ||
rdma.c | ||
rds_single_path.h | ||
rds.h | ||
recv.c | ||
send.c | ||
stats.c | ||
sysctl.c | ||
tcp_connect.c | ||
tcp_listen.c | ||
tcp_recv.c | ||
tcp_send.c | ||
tcp_stats.c | ||
tcp.c | ||
tcp.h | ||
threads.c | ||
transport.c |