| From 8e6e76aec9dfc1d7313302c7cc170ee44d648178 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 15 Jul 2021 20:22:04 +0800 |
| Subject: net: fix uninit-value in caif_seqpkt_sendmsg |
| |
| From: Ziyang Xuan <william.xuanziyang@huawei.com> |
| |
| [ Upstream commit 991e634360f2622a683b48dfe44fe6d9cb765a09 ] |
| |
| When nr_segs equal to zero in iovec_from_user, the object |
| msg->msg_iter.iov is uninit stack memory in caif_seqpkt_sendmsg |
| which is defined in ___sys_sendmsg. So we cann't just judge |
| msg->msg_iter.iov->base directlly. We can use nr_segs to judge |
| msg in caif_seqpkt_sendmsg whether has data buffers. |
| |
| ===================================================== |
| BUG: KMSAN: uninit-value in caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542 |
| Call Trace: |
| __dump_stack lib/dump_stack.c:77 [inline] |
| dump_stack+0x1c9/0x220 lib/dump_stack.c:118 |
| kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118 |
| __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 |
| caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542 |
| sock_sendmsg_nosec net/socket.c:652 [inline] |
| sock_sendmsg net/socket.c:672 [inline] |
| ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2343 |
| ___sys_sendmsg net/socket.c:2397 [inline] |
| __sys_sendmmsg+0x808/0xc90 net/socket.c:2480 |
| __compat_sys_sendmmsg net/compat.c:656 [inline] |
| |
| Reported-by: syzbot+09a5d591c1f98cf5efcb@syzkaller.appspotmail.com |
| Link: https://syzkaller.appspot.com/bug?id=1ace85e8fc9b0d5a45c08c2656c3e91762daa9b8 |
| Fixes: bece7b2398d0 ("caif: Rewritten socket implementation") |
| Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/caif/caif_socket.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c |
| index 3ad0a1df6712..9d26c5e9da05 100644 |
| --- a/net/caif/caif_socket.c |
| +++ b/net/caif/caif_socket.c |
| @@ -539,7 +539,8 @@ static int caif_seqpkt_sendmsg(struct socket *sock, struct msghdr *msg, |
| goto err; |
| |
| ret = -EINVAL; |
| - if (unlikely(msg->msg_iter.iov->iov_base == NULL)) |
| + if (unlikely(msg->msg_iter.nr_segs == 0) || |
| + unlikely(msg->msg_iter.iov->iov_base == NULL)) |
| goto err; |
| noblock = msg->msg_flags & MSG_DONTWAIT; |
| |
| -- |
| 2.30.2 |
| |
