archive mirror
 help / color / mirror / Atom feed
* [Linux-kernel-mentees] [PATCH] net: fix uninit value error in __sys_sendmmsg
@ 2020-09-13  5:56 Anant Thazhemadam
  2020-09-13  6:13 ` Greg KH
  0 siblings, 1 reply; 5+ messages in thread
From: Anant Thazhemadam @ 2020-09-13  5:56 UTC (permalink / raw)
  Cc: Anant Thazhemadam, netdev, linux-kernel, Jakub Kicinski,
	syzbot+09a5d591c1f98cf5efcb, David S. Miller,

The crash report showed that there was a local variable;

----iovstack.i@__sys_sendmmsg created at:
 ___sys_sendmsg net/socket.c:2388 [inline]
 __sys_sendmmsg+0x6db/0xc90 net/socket.c:2480
 that was left uninitialized.

The contents of iovstack are of interest, since the respective pointer
is passed down as an argument to sendmsg_copy_msghdr as well.
Initializing this contents of this stack prevents this bug from happening.

Since the memory that was initialized is freed at the end of the function
call, memory leaks are not likely to be an issue.

syzbot seems to have triggered this error by passing an array of 0's as
a parameter while making the initial system call.

Signed-off-by: Anant Thazhemadam <>
 net/socket.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/socket.c b/net/socket.c
index 0c0144604f81..d74443dfd73b 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2396,6 +2396,7 @@ static int ___sys_sendmsg(struct socket *sock, struct user_msghdr __user *msg,
 	struct sockaddr_storage address;
 	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
+	memset(iov, 0, UIO_FASTIOV);
 	ssize_t err;
 	msg_sys->msg_name = &address;

Linux-kernel-mentees mailing list

^ permalink raw reply related	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2020-09-14  7:59 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-09-13  5:56 [Linux-kernel-mentees] [PATCH] net: fix uninit value error in __sys_sendmmsg Anant Thazhemadam
2020-09-13  6:13 ` Greg KH
2020-09-13  6:20   ` Anant Thazhemadam
2020-09-13 21:25     ` David Miller
2020-09-14  7:58   ` David Laight

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).