linux-kernel - Re: [PATCH net] inet_diag: Initialize pad field in struct inet_diag_req

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iJaCc71gqmphNKqyFDrEFC3gALESsLpuNheMTzhzA2LpQ@mail.gmail.com>
Date: Wed, 3 Jul 2024 11:48:36 +0200
From: Eric Dumazet <edumazet@...gle.com>
To: Shigeru Yoshida <syoshida@...hat.com>
Cc: davem@...emloft.net, dsahern@...nel.org, kuba@...nel.org, 
	pabeni@...hat.com, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, 
	syzkaller <syzkaller@...glegroups.com>
Subject: Re: [PATCH net] inet_diag: Initialize pad field in struct inet_diag_req_v2

On Wed, Jul 3, 2024 at 11:17 AM Shigeru Yoshida <syoshida@...hat.com> wrote:
>
> KMSAN reported uninit-value access in raw_lookup() [1]. Diag for raw
> sockets uses the pad field in struct inet_diag_req_v2 for the
> underlying protocol. This field corresponds to the sdiag_raw_protocol
> field in struct inet_diag_req_raw.
>
> inet_diag_get_exact_compat() converts inet_diag_req to
> inet_diag_req_v2, but leaves the pad field uninitialized. So the issue
> occurs when raw_lookup() accesses the sdiag_raw_protocol field.
>
> Fix this by initializing the pad field in
> inet_diag_get_exact_compat(). Also, do the same fix in
> inet_diag_dump_compat() to avoid the similar issue in the future.
>
> Fixes: 432490f9d455 ("net: ip, diag -- Add diag interface for raw sockets")
> Reported-by: syzkaller <syzkaller@...glegroups.com>
> Signed-off-by: Shigeru Yoshida <syoshida@...hat.com>

Reviewed-by: Eric Dumazet <edumazet@...gle.com>

Thanks !