kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers/block
History
Eric Dumazet b0028f3334 nbd: always initialize struct msghdr completely 
commit 78fbb92af2 upstream.

syzbot complains that msg->msg_get_inq value can be uninitialized [1]

struct msghdr got many new fields recently, we should always make
sure their values is zero by default.

[1]
 BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571
  tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571
  inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879
  sock_recvmsg_nosec net/socket.c:1044 [inline]
  sock_recvmsg+0x12b/0x1e0 net/socket.c:1066
  __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538
  nbd_read_reply drivers/block/nbd.c:732 [inline]
  recv_work+0x262/0x3100 drivers/block/nbd.c:863
  process_one_work kernel/workqueue.c:2627 [inline]
  process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700
  worker_thread+0xf45/0x1490 kernel/workqueue.c:2781
  kthread+0x3ed/0x540 kernel/kthread.c:388
  ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147
  ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242

Local variable msg created at:
  __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513
  nbd_read_reply drivers/block/nbd.c:732 [inline]
  recv_work+0x262/0x3100 drivers/block/nbd.c:863

CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: nbd5-recv recv_work

Fixes: f94fd25cb0 ("tcp: pass back data left in socket after receive")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: stable@vger.kernel.org
Cc: Josef Bacik <josef@toxicpanda.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: linux-block@vger.kernel.org
Cc: nbd@other.debian.org
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240112132657.647112-1-edumazet@google.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-01-31 16:20:56 -08:00
..
aoe aoe: replace strncpy with strscpy 2023-10-03 18:23:48 -06:00
drbd hardening updates for v6.7-rc1 2023-10-30 19:09:55 -10:00
mtip32xx block: replace fmode_t with a block-specific type for block open flags 2023-06-12 08:04:05 -06:00
null_blk null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS 2024-01-25 15:44:56 -08:00
rnbd rnbd-srv: Convert to use bdev_open_by_path() 2023-10-28 13:29:17 +02:00
xen-blkback xen/blkback: Convert to bdev_open_by_dev() 2023-10-28 13:29:17 +02:00
zram zram: Convert to use bdev_open_by_dev() 2023-10-28 13:29:17 +02:00
amiflop.c amiflop: don't call fsync_bdev in FDFMTBEG 2023-08-21 14:35:31 +02:00
ataflop.c block: move bdev_mark_dead out of disk_check_media_change 2023-10-28 13:29:23 +02:00
brd.c brd: use cond_resched instead of cond_resched_rcu 2023-06-14 11:13:07 -06:00
floppy.c block: move bdev_mark_dead out of disk_check_media_change 2023-10-28 13:29:23 +02:00
Kconfig block: ublk: switch to ioctl command encoding 2023-04-18 20:13:30 -06:00
loop.c loop: fix the the direct I/O support check when used on top of block devices 2024-01-25 15:45:30 -08:00
Makefile Revert "pktcdvd: remove driver." 2023-01-04 14:44:13 -07:00
n64cart.c block: remove blk_cleanup_disk 2022-06-28 06:33:15 -06:00
nbd.c nbd: always initialize struct msghdr completely 2024-01-31 16:20:56 -08:00
pktcdvd.c pktcdvd: Convert to bdev_open_by_dev() 2023-10-28 13:29:17 +02:00
ps3disk.c block: remove blk_cleanup_disk 2022-06-28 06:33:15 -06:00
ps3vram.c ps3vram: remove bio splitting 2023-01-29 15:18:35 -07:00
rbd.c rbd: take header_rwsem in rbd_dev_refresh() only when updating 2023-09-26 10:33:19 +02:00
rbd_types.h libceph, rbd: replace zero-length array with flexible-array 2020-06-01 13:22:53 +02:00
sunvdc.c block: replace fmode_t with a block-specific type for block open flags 2023-06-12 08:04:05 -06:00
swim.c swim: fix a missing FMODE_ -> BLK_OPEN_ conversion in floppy_open 2023-06-20 07:16:04 -06:00
swim3.c swim3: mark swim3_init() static 2023-08-10 08:32:59 -06:00
swim_asm.S treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ublk_drv.c block: ublk_drv: Remove unused function 2023-10-19 05:24:02 -06:00
virtio_blk.c virtio_blk: fix snprintf truncation compiler warning 2023-12-04 09:43:53 -05:00
xen-blkfront.c for-6.5/block-2023-06-23 2023-06-26 12:47:20 -07:00
z2ram.c block: replace fmode_t with a block-specific type for block open flags 2023-06-12 08:04:05 -06:00