linux-kernel - Re: [syzbot] [v9fs?] KMSAN: uninit-value in p9_client

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240403133301.14177-1-n.zhandarovich@fintech.ru>
Date: Wed, 3 Apr 2024 06:33:01 -0700
From: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
To: <syzbot+ff14db38f56329ef68df@...kaller.appspotmail.com>
CC: Nikita Zhandarovich <n.zhandarovich@...tech.ru>,
	<syzkaller-bugs@...glegroups.com>, <linux-kernel@...r.kernel.org>
Subject: Re: [syzbot] [v9fs?] KMSAN: uninit-value in p9_client_rpc (2)

If p9_check_errors() fails in p9_client_rpc(), req->rc.tag won't be
initialized and trace_9p_client_res() will try to print it before
exiting with error, triggering KMSAN. Fix it by having id and tag
fields inited with zero values.

Please test.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

 net/9p/client.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/9p/client.c b/net/9p/client.c
index e265a0ca6bdd..a9d613af7455 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -235,6 +235,8 @@ static int p9_fcall_init(struct p9_client *c, struct p9_fcall *fc,
 	if (!fc->sdata)
 		return -ENOMEM;
 	fc->capacity = alloc_msize;
+	fc->id = 0;
+	fc->tag = 0;
 	return 0;
 }