Ying Xue 2753ca5d90 tipc: fix uninit-value in tipc_nl_compat_doit ... BUG: KMSAN: uninit-value in tipc_nl_compat_doit+0x404/0xa10 net/tipc/netlink_compat.c:335 CPU: 0 PID: 4514 Comm: syz-executor485 Not tainted 4.16.0+ #87 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x185/0x1d0 lib/dump_stack.c:53 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067 __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683 tipc_nl_compat_doit+0x404/0xa10 net/tipc/netlink_compat.c:335 tipc_nl_compat_recv+0x164b/0x2700 net/tipc/netlink_compat.c:1153 genl_family_rcv_msg net/netlink/genetlink.c:599 [inline] genl_rcv_msg+0x1686/0x1810 net/netlink/genetlink.c:624 netlink_rcv_skb+0x378/0x600 net/netlink/af_netlink.c:2447 genl_rcv+0x63/0x80 net/netlink/genetlink.c:635 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x166b/0x1740 net/netlink/af_netlink.c:1337 netlink_sendmsg+0x1048/0x1310 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg net/socket.c:640 [inline] ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046 __sys_sendmsg net/socket.c:2080 [inline] SYSC_sendmsg+0x2a3/0x3d0 net/socket.c:2091 SyS_sendmsg+0x54/0x80 net/socket.c:2087 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 RIP: 0033:0x43fda9 RSP: 002b:00007ffd0c184ba8 EFLAGS: 00000213 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fda9 RDX: 0000000000000000 RSI: 0000000020023000 RDI: 0000000000000003 RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 R10: 00000000004002c8 R11: 0000000000000213 R12: 00000000004016d0 R13: 0000000000401760 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline] kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188 kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314 kmsan_slab_alloc+0x11/0x20 mm/kmsan/kmsan.c:321 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc_node mm/slub.c:2737 [inline] __kmalloc_node_track_caller+0xaed/0x11c0 mm/slub.c:4369 __kmalloc_reserve net/core/skbuff.c:138 [inline] __alloc_skb+0x2cf/0x9f0 net/core/skbuff.c:206 alloc_skb include/linux/skbuff.h:984 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1183 [inline] netlink_sendmsg+0x9a6/0x1310 net/netlink/af_netlink.c:1875 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg net/socket.c:640 [inline] ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046 __sys_sendmsg net/socket.c:2080 [inline] SYSC_sendmsg+0x2a3/0x3d0 net/socket.c:2091 SyS_sendmsg+0x54/0x80 net/socket.c:2087 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 In tipc_nl_compat_recv(), when the len variable returned by nlmsg_attrlen() is 0, the message is still treated as a valid one, which is obviously unresonable. When len is zero, it means the message not only doesn't contain any valid TLV payload, but also TLV header is not included. Under this stituation, tlv_type field in TLV header is still accessed in tipc_nl_compat_dumpit() or tipc_nl_compat_doit(), but the field space is obviously illegal. Of course, it is not initialized. Reported-by: syzbot+bca0dc46634781f08b38@syzkaller.appspotmail.com Reported-by: syzbot+6bdb590321a7ae40c1a6@syzkaller.appspotmail.com Signed-off-by: Ying Xue <ying.xue@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-01-15 20:29:21 -08:00
..
addr.c	tipc: handle collisions of 32-bit node address hash values	2018-03-23 13:12:18 -04:00
addr.h	tipc: add 128-bit node identifier	2018-03-23 13:12:18 -04:00
bcast.c	tipc: correct spelling errors for struct tipc_bc_base's comment	2018-09-03 22:03:07 -07:00
bcast.h	tipc: make replicast a user selectable option	2017-01-20 12:10:17 -05:00
bearer.c	tipc: fix a double free in tipc_enable_bearer()	2018-12-27 16:16:17 -08:00
bearer.h	tipc: enable tracepoints in tipc	2018-12-19 11:49:24 -08:00
core.c	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00
core.h	tipc: replace name table service range array with rb tree	2018-03-31 22:19:52 -04:00
diag.c	tipc: switch to rhashtable iterator	2018-08-29 18:04:54 -07:00
discover.c	tipc: fix lockdep warning when reinitilaizing sockets	2018-11-17 22:01:31 -08:00
discover.h	tipc: some cleanups in the file discover.c	2018-03-23 13:12:17 -04:00
eth_media.c	tipc: make media address offset a common define	2015-02-27 18:18:48 -05:00
group.c	tipc: fix info leak from kernel tipc_event	2018-10-18 16:49:53 -07:00
group.h	tipc: extend sock diag for group communication	2018-06-30 21:05:42 +09:00
ib_media.c	tipc: rename media/msg related definitions	2015-02-27 18:18:48 -05:00
Kconfig	tipc: implement socket diagnostics for AF_TIPC	2018-03-22 14:43:35 -04:00
link.c	tipc: fix uninitialized value for broadcast retransmission	2018-12-19 11:53:10 -08:00
link.h	tipc: add trace_events for tipc link	2018-12-19 11:49:24 -08:00
Makefile	tipc: enable tracepoints in tipc	2018-12-19 11:49:24 -08:00
monitor.c	tipc: make some functions static	2018-07-21 16:23:22 -07:00
monitor.h	tipc: dump monitor attributes	2016-07-26 14:26:42 -07:00
msg.c	tipc: buffer overflow handling in listener socket	2018-09-29 11:24:22 -07:00
msg.h	tipc: improve broadcast retransmission algorithm	2018-11-11 09:57:46 -08:00
name_distr.c	tipc: eliminate message disordering during binding table update	2018-10-22 19:29:12 -07:00
name_distr.h	tipc: permit overlapping service ranges in name table	2018-03-31 22:19:52 -04:00
name_table.c	tipc: eliminate message disordering during binding table update	2018-10-22 19:29:12 -07:00
name_table.h	tipc: eliminate message disordering during binding table update	2018-10-22 19:29:12 -07:00
net.c	tipc: fix lockdep warning when reinitilaizing sockets	2018-11-17 22:01:31 -08:00
net.h	tipc: fix lockdep warning when reinitilaizing sockets	2018-11-17 22:01:31 -08:00
netlink_compat.c	tipc: fix uninit-value in tipc_nl_compat_doit	2019-01-15 20:29:21 -08:00
netlink.c	tipc: switch to rhashtable iterator	2018-08-29 18:04:54 -07:00
netlink.h	tipc: make cluster size threshold for monitoring configurable	2016-07-26 14:26:42 -07:00
node.c	tipc: add trace_events for tipc node	2018-12-19 11:49:24 -08:00
node.h	tipc: enable tracepoints in tipc	2018-12-19 11:49:24 -08:00
socket.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-12-20 11:53:36 -08:00
socket.h	tipc: add trace_events for tipc socket	2018-12-19 11:49:24 -08:00
subscr.c	tipc: fix unbalanced reference counter	2018-04-12 21:46:10 -04:00
subscr.h	tipc: replace name table service range array with rb tree	2018-03-31 22:19:52 -04:00
sysctl.c	tipc: add trace_events for tipc socket	2018-12-19 11:49:24 -08:00
topsrv.c	tipc: fix uninit-value in in tipc_conn_rcv_sub	2019-01-15 20:29:20 -08:00
topsrv.h	tipc: rename tipc_server to tipc_topsrv	2018-02-16 15:26:34 -05:00
trace.c	tipc: add trace_events for tipc socket	2018-12-19 11:49:24 -08:00
trace.h	tipc: add trace_events for tipc bearer	2018-12-19 11:49:25 -08:00
udp_media.c	tipc: compare remote and local protocols in tipc_udp_enable()	2018-12-14 13:28:03 -08:00
udp_media.h	tipc: implement configuration of UDP media MTU	2018-04-20 11:04:05 -04:00