netdev - Re: [PATCH v2] batman-adv: initialize "struct batadv_tvlv_tt_vlan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5561744.yYbohhxq0P@sven-l14>
Date:   Mon, 05 Apr 2021 13:09:36 +0200
From:   Sven Eckelmann <sven@...fation.org>
To:     Marek Lindner <mareklindner@...mailbox.ch>,
        Simon Wunderlich <sw@...onwunderlich.de>,
        Antonio Quartulli <a@...table.cc>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Cc:     netdev@...r.kernel.org,
        Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Subject: Re: [PATCH v2] batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field

On Monday, 5 April 2021 12:16:50 CEST Tetsuo Handa wrote:
> KMSAN found uninitialized value at batadv_tt_prepare_tvlv_local_data()
> [1], for commit ced72933a5e8ab52 ("batman-adv: use CRC32C instead of CRC16
> in TT code") inserted 'reserved' field into "struct batadv_tvlv_tt_data"
> and commit 7ea7b4a142758dea ("batman-adv: make the TT CRC logic VLAN
> specific") moved that field to "struct batadv_tvlv_tt_vlan_data" but left
> that field uninitialized.
> 
> [1] https://syzkaller.appspot.com/bug?id=07f3e6dba96f0eb3cabab986adcd8a58b9bdbe9d
> 
> Reported-by: syzbot <syzbot+50ee810676e6a089487b@...kaller.appspotmail.com>
> Tested-by: syzbot <syzbot+50ee810676e6a089487b@...kaller.appspotmail.com>
> Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
> Fixes: ced72933a5e8ab52 ("batman-adv: use CRC32C instead of CRC16 in TT code")
> Fixes: 7ea7b4a142758dea ("batman-adv: make the TT CRC logic VLAN specific")
> ---
>  net/batman-adv/translation-table.c | 2 ++
>  1 file changed, 2 insertions(+)

Thanks,

Acked-by: Sven Eckelmann <sven@...fation.org>

> diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
> index f8761281aab0..434b4f042909 100644
> --- a/net/batman-adv/translation-table.c
> +++ b/net/batman-adv/translation-table.c
> @@ -890,6 +890,7 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node,
>  	hlist_for_each_entry(vlan, &orig_node->vlan_list, list) {
>  		tt_vlan->vid = htons(vlan->vid);
>  		tt_vlan->crc = htonl(vlan->tt.crc);
> +		tt_vlan->reserved = 0;
>  
>  		tt_vlan++;
>  	}
> @@ -973,6 +974,7 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv,
>  
>  		tt_vlan->vid = htons(vlan->vid);
>  		tt_vlan->crc = htonl(vlan->tt.crc);
> +		tt_vlan->reserved = 0;
>  
>  		tt_vlan++;
>  	}
> 


Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)