linux-kernel - Re: [PATCH] net: initialize msg.msg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1488896800.9415.398.camel@edumazet-glaptop3.roam.corp.google.com>
Date:   Tue, 07 Mar 2017 06:26:40 -0800
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Alexander Potapenko <glider@...gle.com>
Cc:     dvyukov@...gle.com, kcc@...gle.com, edumazet@...gle.com,
        davem@...emloft.net, linux-kernel@...r.kernel.org,
        netdev@...r.kernel.org
Subject: Re: [PATCH] net: initialize msg.msg_flags in recvfrom

On Tue, 2017-03-07 at 14:58 +0100, Alexander Potapenko wrote:
> KMSAN (KernelMemorySanitizer, a new error detection tool) reports use
> of uninitialized memory in put_cmsg()):

I would prefer that you do not put the stack trace in the changelog,
same for the reproducer since this has little value in understanding the
impact.

It looks like a false positive, but you do not say.

recvmsg() does not care about msg.msg_flags, only KMSAN.

(The important part is that msg.msg_control and msg.msg_controllen are
0)

Fine to avoid the false positive, but better be explicit in the
changelog and says there is no visible effect for this bug.

If there is a visible effect, please state so instead of technical
details.

We try to reduce S/N in the changelogs ;)

Thanks a lot !