linux-kernel - Re: [PATCH net-next v1] xfrm6: fix uninitialized saddr in xfrm6_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aXtTjH1bo31NM7L0@horms.kernel.org>
Date: Thu, 29 Jan 2026 12:33:16 +0000
From: Simon Horman <horms@...nel.org>
To: Jiayuan Chen <jiayuan.chen@...ux.dev>
Cc: netdev@...r.kernel.org, Jiayuan Chen <jiayuan.chen@...pee.com>,
	syzbot+e136d86d34b42399a8b1@...kaller.appspotmail.com,
	Steffen Klassert <steffen.klassert@...unet.com>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	"David S. Miller" <davem@...emloft.net>,
	David Ahern <dsahern@...nel.org>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Patrick McHardy <kaber@...sh.net>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH net-next v1] xfrm6: fix uninitialized saddr in
 xfrm6_get_saddr()

On Tue, Jan 27, 2026 at 07:38:44PM +0800, Jiayuan Chen wrote:
> From: Jiayuan Chen <jiayuan.chen@...pee.com>
> 
> xfrm6_get_saddr() does not check the return value of
> ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable
> source address (returns -EADDRNOTAVAIL), saddr->in6 is left
> uninitialized, but xfrm6_get_saddr() still returns 0 (success).
> 
> This causes the caller xfrm_tmpl_resolve_one() to use the uninitialized
> address in xfrm_state_find(), triggering KMSAN warning:
> 
> =====================================================
> BUG: KMSAN: uninit-value in xfrm_state_find+0x2424/0xa940
>  xfrm_state_find+0x2424/0xa940
>  xfrm_resolve_and_create_bundle+0x906/0x5a20
>  xfrm_lookup_with_ifid+0xcc0/0x3770
>  xfrm_lookup_route+0x63/0x2b0
>  ip_route_output_flow+0x1ce/0x270
>  udp_sendmsg+0x2ce1/0x3400
>  inet_sendmsg+0x1ef/0x2a0
>  __sock_sendmsg+0x278/0x3d0
>  __sys_sendto+0x593/0x720
>  __x64_sys_sendto+0x130/0x200
>  x64_sys_call+0x332b/0x3e70
>  do_syscall_64+0xd3/0xf80
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Local variable tmp.i.i created at:
>  xfrm_resolve_and_create_bundle+0x3e3/0x5a20
>  xfrm_lookup_with_ifid+0xcc0/0x3770
> =====================================================
> 
> Fix by checking the return value of ipv6_dev_get_saddr() and propagating
> the error.
> 
> Fixes: a1e59abf8249 ("[XFRM]: Fix wildcard as tunnel source")
> Reported-by: syzbot+e136d86d34b42399a8b1@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68bf1024.a70a0220.7a912.02c2.GAE@google.com/T/
> Signed-off-by: Jiayuan Chen <jiayuan.chen@...pee.com>
> Signed-off-by: Jiayuan Chen <jiayuan.chen@...ux.dev>

Reviewed-by: Simon Horman <horms@...nel.org>