• Eric Dumazet's avatar
    ipv4: fix uninit-value in ip_route_output_key_hash_rcu() · d0ea2b12
    Eric Dumazet authored
    syzbot complained that res.type could be used while not initialized.
    
    Using RTN_UNSPEC as initial value seems better than using garbage.
    
    BUG: KMSAN: uninit-value in __mkroute_output net/ipv4/route.c:2200 [inline]
    BUG: KMSAN: uninit-value in ip_route_output_key_hash_rcu+0x31f0/0x3940 net/ipv4/route.c:2493
    CPU: 1 PID: 12207 Comm: syz-executor0 Not tainted 4.16.0+ #81
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
     __dump_stack lib/dump_stack.c:17 [inline]
     dump_stack+0x185/0x1d0 lib/dump_stack.c:53
     kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
     __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676
     __mkroute_output net/ipv4/route.c:2200 [inline]
     ip_route_output_key_hash_rcu+0x31f0/0x3940 net/ipv4/route.c:2493
     ip_route_output_key_hash net/ipv4/route.c:2322 [inline]
     __ip_route_output_key include/net/route.h:126 [inline]
     ip_route_output_flow+0x1eb/0x3c0 net/ipv4/route.c:2577
     raw_sendmsg+0x1861/0x3ed0 net/ipv4/raw.c:653
     inet_sendmsg+0x48d/0x740 net/ipv4/af_inet.c:764
     sock_sendmsg_nosec net/socket.c:630 [inline]
     sock_sendmsg net/socket.c:640 [inline]
     SYSC_sendto+0x6c3/0x7e0 net/socket.c:1747
     SyS_sendto+0x8a/0xb0 net/socket.c:1715
     do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
     entry_SYSCALL_64_after_hwframe+0x3d/0xa2
    RIP: 0033:0x455259
    RSP: 002b:00007fdc0625dc68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
    RAX: ffffffffffffffda RBX: 00007fdc0625e6d4 RCX: 0000000000455259
    RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000013
    RBP: 000000000072bea0 R08: 0000000020000080 R09: 0000000000000010
    R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
    R13: 00000000000004f7 R14: 00000000006fa7c8 R15: 0000000000000000
    
    Local variable description: ----res.i.i@ip_route_output_flow
    Variable was created at:
     ip_route_output_flow+0x75/0x3c0 net/ipv4/route.c:2576
     raw_sendmsg+0x1861/0x3ed0 net/ipv4/raw.c:653
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    d0ea2b12
route.c 76.7 KB