Netdev Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH net-next] net: fix uninit-value in caif_seqpkt_sendmsg
@ 2021-07-15 12:22 Ziyang Xuan
2021-07-15 18:20 ` patchwork-bot+netdevbpf
0 siblings, 1 reply; 2+ messages in thread
From: Ziyang Xuan @ 2021-07-15 12:22 UTC (permalink / raw)
To: davem; +Cc: kuba, netdev, linux-kernel, stable, sjur.brandeland
When nr_segs equal to zero in iovec_from_user, the object
msg->msg_iter.iov is uninit stack memory in caif_seqpkt_sendmsg
which is defined in ___sys_sendmsg. So we cann't just judge
msg->msg_iter.iov->base directlly. We can use nr_segs to judge
msg in caif_seqpkt_sendmsg whether has data buffers.
=====================================================
BUG: KMSAN: uninit-value in caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x220 lib/dump_stack.c:118
kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
__msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg net/socket.c:672 [inline]
____sys_sendmsg+0x12b6/0x1350 net/socket.c:2343
___sys_sendmsg net/socket.c:2397 [inline]
__sys_sendmmsg+0x808/0xc90 net/socket.c:2480
__compat_sys_sendmmsg net/compat.c:656 [inline]
Reported-by: syzbot+09a5d591c1f98cf5efcb@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=1ace85e8fc9b0d5a45c08c2656c3e91762daa9b8
Fixes: bece7b2398d0 ("caif: Rewritten socket implementation")
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
---
net/caif/caif_socket.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 647554c..e12fd3c 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -539,7 +539,8 @@ static int caif_seqpkt_sendmsg(struct socket *sock, struct msghdr *msg,
goto err;
ret = -EINVAL;
- if (unlikely(msg->msg_iter.iov->iov_base == NULL))
+ if (unlikely(msg->msg_iter.nr_segs == 0) ||
+ unlikely(msg->msg_iter.iov->iov_base == NULL))
goto err;
noblock = msg->msg_flags & MSG_DONTWAIT;
--
2.9.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net-next] net: fix uninit-value in caif_seqpkt_sendmsg
2021-07-15 12:22 [PATCH net-next] net: fix uninit-value in caif_seqpkt_sendmsg Ziyang Xuan
@ 2021-07-15 18:20 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 2+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-07-15 18:20 UTC (permalink / raw)
To: Ziyang Xuan; +Cc: davem, kuba, netdev, linux-kernel, stable, sjur.brandeland
Hello:
This patch was applied to netdev/net.git (refs/heads/master):
On Thu, 15 Jul 2021 20:22:04 +0800 you wrote:
> When nr_segs equal to zero in iovec_from_user, the object
> msg->msg_iter.iov is uninit stack memory in caif_seqpkt_sendmsg
> which is defined in ___sys_sendmsg. So we cann't just judge
> msg->msg_iter.iov->base directlly. We can use nr_segs to judge
> msg in caif_seqpkt_sendmsg whether has data buffers.
>
> =====================================================
> BUG: KMSAN: uninit-value in caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0x1c9/0x220 lib/dump_stack.c:118
> kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118
> __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
> caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542
> sock_sendmsg_nosec net/socket.c:652 [inline]
> sock_sendmsg net/socket.c:672 [inline]
> ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2343
> ___sys_sendmsg net/socket.c:2397 [inline]
> __sys_sendmmsg+0x808/0xc90 net/socket.c:2480
> __compat_sys_sendmmsg net/compat.c:656 [inline]
>
> [...]
Here is the summary with links:
- [net-next] net: fix uninit-value in caif_seqpkt_sendmsg
https://git.kernel.org/netdev/net/c/991e634360f2
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-07-15 18:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-15 12:22 [PATCH net-next] net: fix uninit-value in caif_seqpkt_sendmsg Ziyang Xuan
2021-07-15 18:20 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).