linux-kernel - [PATCH] net/rose: Fix uninitialized values in rose_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250912212216.66338-1-rodgepritesh@gmail.com>
Date: Sat, 13 Sep 2025 02:52:16 +0530
From: rodgepritesh@...il.com
To: netdev@...r.kernel.org
Cc: "David S . Miller" <davem@...emloft.net>,
	edumazet@...gle.com,
	kuba@...nel.org,
	pabeni@...hat.com,
	linux-hams@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	syzbot+7d660d9b8bd5efc7ee6e@...kaller.appspotmail.com,
	Pritesh Rodge <rodgepritesh@...il.com>
Subject: [PATCH] net/rose: Fix uninitialized values in rose_add_node

From: Pritesh Rodge <rodgepritesh@...il.com>

The rose_add_node() function uses kmalloc to allocate a new rose_node
but only initializes the first element of the 'neighbour' array. If
the node's count is later incremented, other parts of the kernel may
access the uninitialized pointers in the array.

This was discovered by KMSAN, which reported a crash in
__run_timer_base. When a timer tried to clean up a resource using
one of these garbage pointers.

Fix this by switching from kmalloc() to kzalloc() to ensure the
entire rose_node struct is initialized to zero upon allocation. This
sets all unused neighbour pointers to NULL.

[1] https://syzkaller.appspot.com/bug?extid=7d660d9b8bd5efc7ee6e

Reported-by: syzbot+7d660d9b8bd5efc7ee6e@...kaller.appspotmail.com
Signed-off-by: Pritesh Rodge <rodgepritesh@...il.com>
---
 net/rose/rose_route.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index a1e9b05ef6f5..6ca41cbe867a 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -148,7 +148,7 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route,
 		}

 		/* create new node */
-		rose_node = kmalloc(sizeof(*rose_node), GFP_ATOMIC);
+		rose_node = kzalloc(sizeof(*rose_node), GFP_ATOMIC);
 		if (rose_node == NULL) {
 			res = -ENOMEM;
 			goto out;
-- 
2.43.0