From patchwork Tue Mar 7 13:58:10 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Potapenko X-Patchwork-Id: 736169 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3vcz3W2rnzz9sDb for ; Wed, 8 Mar 2017 01:06:31 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="ryx00McV"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755506AbdCGOGT (ORCPT ); Tue, 7 Mar 2017 09:06:19 -0500 Received: from mail-wr0-f178.google.com ([209.85.128.178]:36260 "EHLO mail-wr0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755436AbdCGOGC (ORCPT ); Tue, 7 Mar 2017 09:06:02 -0500 Received: by mail-wr0-f178.google.com with SMTP id u108so2011439wrb.3 for ; Tue, 07 Mar 2017 06:04:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=u7mmjiSDBO9TfFtPUN2MYcFTDfQ62bBUXTMPvtaHazA=; b=ryx00McVSpcn7Ox5FluvGfFEz1VWTl73z+LOQ6tfdVGrTOeUX352w2vjySeiQWVdow 8D7JI6tqZs3EjvijZP9M6mEo5MssinEU2v0t51nNMVKbKi01jdCTckyFhyBUtRegYdv1 geac8InouvjIMWTasK3MrTBHrANZtCuvXjKEdqfuLuk1UQAxJP50maJWg15yzEHl9tF1 Vfh4GuNluIoJ2ZL1pd30FFBDez/ZWQXD8TVYgoiAD1PNBQJ1TueDvOg+gKtHO+sBenJd YMA7+KXQ6DFxIXhyXh6OBMY+5eFaNO82uwaiSx3bcTYIElNYmr07bCpYwr5St4VFcI3/ zJSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=u7mmjiSDBO9TfFtPUN2MYcFTDfQ62bBUXTMPvtaHazA=; b=Z9ff2urUpmH8WUUpN6GrrbRG54Q8qe2y/vjeLwTmQJUT0ZqgW0QnuMyHLGixkEUIXX 7r79x0BBTfAjMfUH7BFlfkuCq3th9ua1Ne0/KcgSVPtAX4d/IjrapSotheiGfLEgmFdz uVIqzb1DD34JkUHdelBfpnphazLf3jFByfa4ucax0UDSMWlbED+JCqx5RyIvSNJ6Wuxb 33gqgjcK8qfWJsI1pKI0Uw4ISuk8pfeDaD7KTdYDQ4rPsBZUF7kTv9sRMJ0KM8zm5UKX XkClLRD/hHL/IxF9AjyFiO7MM7yXvsIv5y7Q1TT10QI/6zad1InP7GUsZAQprKtZOsdv euMw== X-Gm-Message-State: AMke39n6YN0vNh9mnLA77yG6nkmQgQMs2TmQs+Q9bxdTgXs8d093JpdgvApcVpXTtAcKMxbZ X-Received: by 10.223.172.101 with SMTP id v92mr407942wrc.49.1488895093946; Tue, 07 Mar 2017 05:58:13 -0800 (PST) Received: from glider0.muc.corp.google.com ([100.105.28.21]) by smtp.gmail.com with ESMTPSA id y49sm126565wry.18.2017.03.07.05.58.12 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 07 Mar 2017 05:58:12 -0800 (PST) From: Alexander Potapenko To: dvyukov@google.com, kcc@google.com, edumazet@google.com, davem@davemloft.net Cc: linux-kernel@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH] net: initialize msg.msg_flags in recvfrom Date: Tue, 7 Mar 2017 14:58:10 +0100 Message-Id: <20170307135810.90371-1-glider@google.com> X-Mailer: git-send-email 2.12.0.rc1.440.g5b76565f74-goog Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org KMSAN (KernelMemorySanitizer, a new error detection tool) reports use of uninitialized memory in put_cmsg()): ================================================================== BUG: KMSAN: use of unitialized memory inter: 0 CPU: 3 PID: 1086 Comm: syz-executor0 Not tainted 4.8.0-rc6+ #1920 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 0000000000000000 ffff88008374fa48 ffffffff82576c18 ffff88008374f988 ffffffff818c06d1 ffffffff85bab870 0000000000000092 ffffffff85bab550 0000000000000000 0000000000000092 00000000f9600a55 0000000000000002 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [] dump_stack+0x238/0x290 lib/dump_stack.c:51 [] kmsan_report+0x276/0x2e0 mm/kmsan/kmsan.c:1006 [] __msan_warning+0x6b/0xc0 mm/kmsan/kmsan_instr.c:425 [] put_cmsg+0x6f7/0x850 net/core/scm.c:223 [< inline >] netlink_cmsg_recv_pktinfo net/netlink/af_netlink.c:1700 [] netlink_recvmsg+0x8e4/0x1980 net/netlink/af_netlink.c:1856 [< inline >] sock_recvmsg_nosec net/socket.c:711 [< inline >] sock_recvmsg net/socket.c:718 [] SYSC_recvfrom+0x6e5/0xa00 net/socket.c:1695 [] SyS_recvfrom+0xb7/0xe0 net/socket.c:1668 [] entry_SYSCALL_64_fastpath+0x13/0x8f arch/x86/entry/entry_64.o:? chained origin: 00000000f8c00a55 [] save_stack_trace+0x27/0x50 arch/x86/kernel/stacktrace.c:67 [< inline >] kmsan_save_stack_with_flags mm/kmsan/kmsan.c:322 [< inline >] kmsan_save_stack mm/kmsan/kmsan.c:337 [] kmsan_internal_chain_origin+0x12b/0x1f0 mm/kmsan/kmsan.c:530 [] __kmsan_store_origin+0x9f/0x120 mm/kmsan/kmsan_instr.c:190 [] netlink_recvmsg+0x46d/0x1980 net/netlink/af_netlink.c:1839 [< inline >] sock_recvmsg_nosec net/socket.c:711 [< inline >] sock_recvmsg net/socket.c:718 [] SYSC_recvfrom+0x6e5/0xa00 net/socket.c:1695 [] SyS_recvfrom+0xb7/0xe0 net/socket.c:1668 [] entry_SYSCALL_64_fastpath+0x13/0x8f arch/x86/entry/entry_64.o:? chained origin: 00000000b9a00a53 [] save_stack_trace+0x27/0x50 arch/x86/kernel/stacktrace.c:67 [< inline >] kmsan_save_stack_with_flags mm/kmsan/kmsan.c:322 [< inline >] kmsan_save_stack mm/kmsan/kmsan.c:337 [] kmsan_internal_chain_origin+0x12b/0x1f0 mm/kmsan/kmsan.c:530 [] __msan_set_alloca_origin4+0xc3/0x130 mm/kmsan/kmsan_instr.c:380 [] SYSC_recvfrom+0x183/0xa00 net/socket.c:1671 [] SyS_recvfrom+0xb7/0xe0 net/socket.c:1668 [] entry_SYSCALL_64_fastpath+0x13/0x8f arch/x86/entry/entry_64.o:? origin description: ----msg@SYSC_recvfrom (origin=00000000b9400a53) ================================================================== The fields of |msg| in SYSC_recvfrom() are initialized except for |msg.msg_flags|, which is later updated in netlink_recvmsg(): 1839 msg->msg_flags |= MSG_TRUNC; and then used in a condition in put_cmsg(): 223 if (MSG_CMSG_COMPAT & msg->msg_flags) The following program has been used to reproduce the error under KMSAN: =================================================== #include #include #include #include #include void child() { int sock = socket(PF_NETLINK, SOCK_RAW, 16); uint32_t val = 0x1f; setsockopt(sock, 0x10e, 0x3, &val, 4); char obuf[31] = "\x1f\x00\x00\x00\x10\x00\x07\xff\xff\x08\x00\x00" "\x00\x00\x00\x00\x03\x00\x01\x0a\x56\x67\x69\x93" "\x3e\x00\x00\x01\x92\x9a\x02"; char ibuf[31]; write(sock, obuf, sizeof(obuf)); struct sockaddr_nl sockaddr = {AF_NETLINK, 0, 0, 0}; socklen_t addrlen = sizeof(sockaddr); recvfrom(sock, ibuf, 0, 0, &sockaddr, &addrlen); } int main() { int pid = fork(); if (!pid) { child(); return 0; } int status = 0; while (waitpid(pid, &status, __WALL) != pid) {} return 0; } =================================================== Signed-off-by: Alexander Potapenko --- net/socket.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/socket.c b/net/socket.c index 2c1e8677ff2d..e0757e648c0c 100644 --- a/net/socket.c +++ b/net/socket.c @@ -1731,6 +1731,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size, /* We assume all kernel code knows the size of sockaddr_storage */ msg.msg_namelen = 0; msg.msg_iocb = NULL; + msg.msg_flags = 0; if (sock->file->f_flags & O_NONBLOCK) flags |= MSG_DONTWAIT; err = sock_recvmsg(sock, &msg, flags);