• Ying Xue's avatar
    tipc: fix uninit-value in in tipc_conn_rcv_sub · a88289f4
    Ying Xue authored
    syzbot reported:
    
    BUG: KMSAN: uninit-value in tipc_conn_rcv_sub+0x184/0x950 net/tipc/topsrv.c:373
    CPU: 0 PID: 66 Comm: kworker/u4:4 Not tainted 4.17.0-rc3+ #88
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Workqueue: tipc_rcv tipc_conn_recv_work
    Call Trace:
     __dump_stack lib/dump_stack.c:77 [inline]
     dump_stack+0x185/0x1d0 lib/dump_stack.c:113
     kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
     __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683
     tipc_conn_rcv_sub+0x184/0x950 net/tipc/topsrv.c:373
     tipc_conn_rcv_from_sock net/tipc/topsrv.c:409 [inline]
     tipc_conn_recv_work+0x3cd/0x560 net/tipc/topsrv.c:424
     process_one_work+0x12c6/0x1f60 kernel/workqueue.c:2145
     worker_thread+0x113c/0x24f0 kernel/workqueue.c:2279
     kthread+0x539/0x720 kernel/kthread.c:239
     ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:412
    
    Local variable description: ----s.i@tipc_conn_recv_work
    Variable was created at:
     tipc_conn_recv_work+0x65/0x560 net/tipc/topsrv.c:419
     process_one_work+0x12c6/0x1f60 kernel/workqueue.c:2145
    
    In tipc_conn_rcv_from_sock(), it always supposes the length of message
    received from sock_recvmsg() is not smaller than the size of struct
    tipc_subscr. However, this assumption is false. Especially when the
    length of received message is shorter than struct tipc_subscr size,
    we will end up touching uninitialized fields in tipc_conn_rcv_sub().
    
    Reported-by: syzbot+8951a3065ee7fd6d6e23@syzkaller.appspotmail.com
    Reported-by: syzbot+75e6e042c5bbf691fc82@syzkaller.appspotmail.com
    Signed-off-by: default avatarYing Xue <ying.xue@windriver.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    a88289f4
topsrv.c 18 KB