linux-kernel - Re: [PATCH] RDMA/core: Fix uninitialized gid in ib_nl_process_good_ip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAL4kbRMM=dt_PUUjJKwE5QJVLTJONGBSntg_b0vDbbgxpBoiDg@mail.gmail.com>
Date: Fri, 7 Nov 2025 23:43:30 +0530
From: Kriish Sharma <kriish.sharma2006@...il.com>
To: Jason Gunthorpe <jgg@...pe.ca>
Cc: Leon Romanovsky <leon@...nel.org>, Vlad Dumitrescu <vdumitrescu@...dia.com>, 
	Parav Pandit <parav@...dia.com>, Edward Srouji <edwards@...dia.com>, linux-rdma@...r.kernel.org, 
	linux-kernel@...r.kernel.org, 
	syzbot+938fcd548c303fe33c1a@...kaller.appspotmail.com
Subject: Re: [PATCH] RDMA/core: Fix uninitialized gid in ib_nl_process_good_ip_rsep()

Hi Jason,

Thanks for the insight. I’ll dig deeper into the handling inside
ib_nl_is_good_ip_resp() and follow up with an updated analysis or
patch.

Regards,
Kriish

On Fri, Nov 7, 2025 at 9:07 PM Jason Gunthorpe <jgg@...pe.ca> wrote:
>
> On Fri, Nov 07, 2025 at 04:10:02AM +0000, Kriish Sharma wrote:
> > KMSAN reported a use of uninitialized memory in hex_byte_pack()
> > via ip6_string() when printing %pI6 from ib_nl_handle_ip_res_resp().
> > If the LS_NLA_TYPE_DGID attribute is missing, 'gid' remains
> > uninitialized before being used in pr_info(), leading to a
> > KMSAN uninit-value report.
> >
> > Reported-by: syzbot+938fcd548c303fe33c1a@...kaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=938fcd548c303fe33c1a
> > Fixes: ae43f8286730 ("IB/core: Add IP to GID netlink offload")
> > Signed-off-by: Kriish Sharma <kriish.sharma2006@...il.com>
> > ---
> >  drivers/infiniband/core/addr.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
> > index 61596cda2b65..4c602fcae12f 100644
> > --- a/drivers/infiniband/core/addr.c
> > +++ b/drivers/infiniband/core/addr.c
> > @@ -99,7 +99,7 @@ static inline bool ib_nl_is_good_ip_resp(const struct nlmsghdr *nlh)
> >  static void ib_nl_process_good_ip_rsep(const struct nlmsghdr *nlh)
> >  {
> >       const struct nlattr *head, *curr;
> > -     union ib_gid gid;
> > +     union ib_gid gid = {};
> >       struct addr_req *req;
> >       int len, rem;
> >       int found = 0;
>
> This doesn't seem right.
>
> We have this as the only caller:
>
>         if (ib_nl_is_good_ip_resp(nlh))
>                 ib_nl_process_good_ip_rsep(nlh);
>
> And ib_nl_is_good_ip_resp() does:
>
>         ret = nla_parse_deprecated(tb, LS_NLA_TYPE_MAX - 1, nlmsg_data(nlh),
>                                    nlmsg_len(nlh), ib_nl_addr_policy,
>                                    NULL);
>
> static const struct nla_policy ib_nl_addr_policy[LS_NLA_TYPE_MAX] = {
>         [LS_NLA_TYPE_DGID] = {.type = NLA_BINARY,
>                 .len = sizeof(struct rdma_nla_ls_gid),
>                 .validation_type = NLA_VALIDATE_MIN,
>                 .min = sizeof(struct rdma_nla_ls_gid)},
> };
>
> So I expect the nla_parse_deprecated() to fail if this:
>
>         nla_for_each_attr(curr, head, len, rem) {
>                 if (curr->nla_type == LS_NLA_TYPE_DGID)
>                         memcpy(&gid, nla_data(curr), nla_len(curr));
>         }
>
> Doesn't find a DGID.
>
> So how can gid be uninitialized?
>
> The fix to whatever this is should be in ib_nl_is_good_ip_resp().
>
> Jason