From: Jakub Kicinski <kuba@kernel.org>
To: Hoang Huu Le <hoang.h.le@dektech.com.au>
Cc: "jmaloy@redhat.com" <jmaloy@redhat.com>,
"maloy@donjonn.com" <maloy@donjonn.com>,
"ying.xue@windriver.com" <ying.xue@windriver.com>,
Tung Quang Nguyen <tung.q.nguyen@dektech.com.au>,
"pabeni@redhat.com" <pabeni@redhat.com>,
"edumazet@google.com" <edumazet@google.com>,
"tipc-discussion@lists.sourceforge.net"
<tipc-discussion@lists.sourceforge.net>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
"davem@davemloft.net" <davem@davemloft.net>,
"syzbot+a73d24a22eeeebe5f244@syzkaller.appspotmail.com"
<syzbot+a73d24a22eeeebe5f244@syzkaller.appspotmail.com>
Subject: Re: [net] tipc: fix uninit-value in tipc_nl_node_reset_link_stats
Date: Wed, 6 Jul 2022 17:57:42 -0700 [thread overview]
Message-ID: <20220706175742.4d40a173@kernel.org> (raw)
In-Reply-To: <DB9PR05MB7641A853BC76A3DBBF2187BFF1839@DB9PR05MB7641.eurprd05.prod.outlook.com>
On Thu, 7 Jul 2022 00:22:06 +0000 Hoang Huu Le wrote:
> > The bug you're fixing is that the string is not null-terminated,
> > so strcmp() can read past the end of the attribute.
> >
> No, I'm trying to fix below issues:
>
> BUG: KMSAN: uninit-value in strlen lib/string.c:495 [inline]
> BUG: KMSAN: uninit-value in strstr+0xb4/0x2e0 lib/string.c:840
> strlen lib/string.c:495 [inline]
> strstr+0xb4/0x2e0 lib/string.c:840
> tipc_nl_node_reset_link_stats+0x41e/0xba0 net/tipc/node.c:2582
>
> I assume the link name attribute is empty as root cause.
> So, just checking length is enough for fixing this issue.
I pointed you to the code that does NLA_STRING validation and that
already checks:
if (attrlen < 1)
what am I missing?
next prev parent reply other threads:[~2022-07-07 0:57 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-06 3:47 [net] tipc: fix uninit-value in tipc_nl_node_reset_link_stats Hoang Le
2022-07-06 20:33 ` Jakub Kicinski
2022-07-06 20:34 ` Jakub Kicinski
2022-07-07 0:22 ` Hoang Huu Le
2022-07-07 0:57 ` Jakub Kicinski [this message]
2022-07-07 6:36 ` Hoang Huu Le
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220706175742.4d40a173@kernel.org \
--to=kuba@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=hoang.h.le@dektech.com.au \
--cc=jmaloy@redhat.com \
--cc=maloy@donjonn.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzbot+a73d24a22eeeebe5f244@syzkaller.appspotmail.com \
--cc=tipc-discussion@lists.sourceforge.net \
--cc=tung.q.nguyen@dektech.com.au \
--cc=ying.xue@windriver.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.