All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
	Roopa Prabhu <roopa@nvidia.com>, David Ahern <dsahern@kernel.org>,
	Jakub Kicinski <kuba@kernel.org>
Subject: [PATCH 4.19 49/74] net, neigh: clear whole pneigh_entry at alloc time
Date: Mon, 13 Dec 2021 10:30:20 +0100	[thread overview]
Message-ID: <20211213092932.453389631@linuxfoundation.org> (raw)
In-Reply-To: <20211213092930.763200615@linuxfoundation.org>

From: Eric Dumazet <edumazet@google.com>

commit e195e9b5dee6459d8c8e6a314cc71a644a0537fd upstream.

Commit 2c611ad97a82 ("net, neigh: Extend neigh->flags to 32 bit
to allow for extensions") enables a new KMSAM warning [1]

I think the bug is actually older, because the following intruction
only occurred if ndm->ndm_flags had NTF_PROXY set.

	pn->flags = ndm->ndm_flags;

Let's clear all pneigh_entry fields at alloc time.

[1]
BUG: KMSAN: uninit-value in pneigh_fill_info+0x986/0xb30 net/core/neighbour.c:2593
 pneigh_fill_info+0x986/0xb30 net/core/neighbour.c:2593
 pneigh_dump_table net/core/neighbour.c:2715 [inline]
 neigh_dump_info+0x1e3f/0x2c60 net/core/neighbour.c:2832
 netlink_dump+0xaca/0x16a0 net/netlink/af_netlink.c:2265
 __netlink_dump_start+0xd1c/0xee0 net/netlink/af_netlink.c:2370
 netlink_dump_start include/linux/netlink.h:254 [inline]
 rtnetlink_rcv_msg+0x181b/0x18c0 net/core/rtnetlink.c:5534
 netlink_rcv_skb+0x447/0x800 net/netlink/af_netlink.c:2491
 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5589
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x1095/0x1360 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x16f3/0x1870 net/netlink/af_netlink.c:1916
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg net/socket.c:724 [inline]
 sock_write_iter+0x594/0x690 net/socket.c:1057
 call_write_iter include/linux/fs.h:2162 [inline]
 new_sync_write fs/read_write.c:503 [inline]
 vfs_write+0x1318/0x2030 fs/read_write.c:590
 ksys_write+0x28c/0x520 fs/read_write.c:643
 __do_sys_write fs/read_write.c:655 [inline]
 __se_sys_write fs/read_write.c:652 [inline]
 __x64_sys_write+0xdb/0x120 fs/read_write.c:652
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Uninit was created at:
 slab_post_alloc_hook mm/slab.h:524 [inline]
 slab_alloc_node mm/slub.c:3251 [inline]
 slab_alloc mm/slub.c:3259 [inline]
 __kmalloc+0xc3c/0x12d0 mm/slub.c:4437
 kmalloc include/linux/slab.h:595 [inline]
 pneigh_lookup+0x60f/0xd70 net/core/neighbour.c:766
 arp_req_set_public net/ipv4/arp.c:1016 [inline]
 arp_req_set+0x430/0x10a0 net/ipv4/arp.c:1032
 arp_ioctl+0x8d4/0xb60 net/ipv4/arp.c:1232
 inet_ioctl+0x4ef/0x820 net/ipv4/af_inet.c:947
 sock_do_ioctl net/socket.c:1118 [inline]
 sock_ioctl+0xa3f/0x13e0 net/socket.c:1235
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0x2df/0x4a0 fs/ioctl.c:860
 __x64_sys_ioctl+0xd8/0x110 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

CPU: 1 PID: 20001 Comm: syz-executor.0 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Fixes: 62dd93181aaa ("[IPV6] NDISC: Set per-entry is_router flag in Proxy NA.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Roopa Prabhu <roopa@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20211206165329.1049835-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/neighbour.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -635,7 +635,7 @@ struct pneigh_entry * pneigh_lookup(stru
 
 	ASSERT_RTNL();
 
-	n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
+	n = kzalloc(sizeof(*n) + key_len, GFP_KERNEL);
 	if (!n)
 		goto out;
 



  parent reply	other threads:[~2021-12-13  9:45 UTC|newest]

Thread overview: 88+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-12-13  9:29 [PATCH 4.19 00/74] 4.19.221-rc1 review Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 01/74] HID: google: add eel USB id Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 02/74] HID: add hid_is_usb() function to make it simpler for USB detection Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 03/74] HID: add USB_HID dependancy to hid-prodikeys Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 04/74] HID: add USB_HID dependancy to hid-chicony Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 05/74] HID: add USB_HID dependancy on some USB HID drivers Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 06/74] HID: wacom: fix problems when device is not a valid USB device Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 07/74] HID: check for valid USB device for many HID drivers Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 08/74] can: kvaser_usb: get CAN clock frequency from device Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 09/74] can: sja1000: fix use after free in ems_pcmcia_add_card() Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 10/74] net: core: netlink: add helper refcount dec and lock function Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 11/74] net: sched: rename qdisc_destroy() to qdisc_put() Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 12/74] net: sched: extend Qdisc with rcu Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 13/74] net: sched: add helper function to take reference to Qdisc Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 14/74] net: sched: use Qdisc rcu API instead of relying on rtnl lock Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 15/74] nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 16/74] bpf: Fix the off-by-two error in range markings Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 17/74] ice: ignore dropped packets during init Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 18/74] bonding: make tx_rebalance_counter an atomic Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 19/74] nfp: Fix memory leak in nfp_cpp_area_cache_add() Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 20/74] seg6: fix the iif in the IPv6 socket control block Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 21/74] udp: using datalen to cap max gso segments Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 22/74] IB/hfi1: Correct guard on eager buffer deallocation Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 23/74] mm: bdi: initialize bdi_min_ratio when bdi is unregistered Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 24/74] ALSA: ctl: Fix copy of updated id with element read/write Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 25/74] ALSA: pcm: oss: Fix negative period/buffer sizes Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 26/74] ALSA: pcm: oss: Limit the period size to 16MB Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 27/74] ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() Greg Kroah-Hartman
2021-12-13  9:29 ` [PATCH 4.19 28/74] tracefs: Have new files inherit the ownership of their parent Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 29/74] clk: qcom: regmap-mux: fix parent clock lookup Greg Kroah-Hartman
2021-12-15  9:16   ` Pavel Machek
2021-12-15 10:37     ` Dmitry Baryshkov
2021-12-15 17:54       ` Pavel Machek
2021-12-13  9:30 ` [PATCH 4.19 30/74] can: pch_can: pch_can_rx_normal: fix use after free Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 31/74] can: m_can: Disable and ignore ELO interrupt Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 32/74] x86/sme: Explicitly map new EFI memmap table as encrypted Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 33/74] libata: add horkage for ASMedia 1092 Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 34/74] wait: add wake_up_pollfree() Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 35/74] binder: use wake_up_pollfree() Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 36/74] signalfd: " Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 37/74] aio: keep poll requests on waitqueue until completed Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 38/74] aio: fix use-after-free due to missing POLLFREE handling Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 39/74] tracefs: Set all files to the same group ownership as the mount option Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 40/74] block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 41/74] qede: validate non LSO skb length Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 42/74] ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 43/74] i40e: Fix pre-set max number of queues for VF Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 44/74] mtd: rawnand: fsmc: Take instruction delay into account Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 45/74] tools build: Remove needless libpython-version feature check that breaks test-all fast path Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 46/74] net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 47/74] net: altera: set a couple error code in probe() Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 48/74] net: fec: only clear interrupt of handling queue in fec_enet_rx_queue() Greg Kroah-Hartman
2021-12-13  9:30 ` Greg Kroah-Hartman [this message]
2021-12-13  9:30 ` [PATCH 4.19 50/74] net/qla3xxx: fix an error code in ql_adapter_up() Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 51/74] USB: gadget: detect too-big endpoint 0 requests Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 52/74] USB: gadget: zero allocate endpoint 0 buffers Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 53/74] usb: core: config: fix validation of wMaxPacketValue entries Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 54/74] xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 55/74] usb: core: config: using bit mask instead of individual bits Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 56/74] xhci: avoid race between disable slot command and host runtime suspend Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 57/74] iio: trigger: Fix reference counting Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 58/74] iio: trigger: stm32-timer: fix MODULE_ALIAS Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 59/74] iio: stk3310: Dont return error code in interrupt handler Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 60/74] iio: mma8452: Fix trigger reference couting Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 61/74] iio: ltr501: Dont return error code in trigger handler Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 62/74] iio: kxsd9: " Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 63/74] iio: itg3200: Call iio_trigger_notify_done() on error Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 64/74] iio: dln2-adc: Fix lockdep complaint Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 65/74] iio: dln2: Check return value of devm_iio_trigger_register() Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 66/74] iio: at91-sama5d2: Fix incorrect sign extension Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 67/74] iio: adc: axp20x_adc: fix charging current reporting on AXP22x Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 68/74] iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 69/74] irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc() Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 70/74] irqchip/armada-370-xp: Fix support for Multi-MSI interrupts Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 71/74] irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 72/74] irqchip: nvic: Fix offset for Interrupt Priority Offsets Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 73/74] net_sched: fix a crash in tc_new_tfilter() Greg Kroah-Hartman
2021-12-13  9:30 ` [PATCH 4.19 74/74] net: sched: make function qdisc_free_cb() static Greg Kroah-Hartman
2021-12-13 10:33 ` [PATCH 4.19 00/74] 4.19.221-rc1 review Pavel Machek
2021-12-13 14:43 ` Jon Hunter
2021-12-13 16:27 ` Sudip Mukherjee
2021-12-13 18:58   ` Sudip Mukherjee
2021-12-13 19:05     ` Linus Torvalds
2021-12-13 22:23       ` Sudip Mukherjee
2021-12-13 19:55 ` Guenter Roeck
2021-12-13 20:30 ` Shuah Khan
2021-12-14  5:04 ` Naresh Kamboju
2021-12-14 12:40 ` Sudip Mukherjee

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211213092932.453389631@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=dsahern@kernel.org \
    --cc=edumazet@google.com \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=roopa@nvidia.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.