Re: [PATCH net] net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from_user()

[Jens Axboe <axboe@kernel.dk>]

On 6/22/22 9:02 AM, Eric Dumazet wrote:
> syzbot reported uninit-value in tcp_recvmsg() [1]
> 
> Issue here is that msg->msg_get_inq should have been cleared,
> otherwise tcp_recvmsg() might read garbage and perform
> more work than needed, or have undefined behavior.
> 
> Given CONFIG_INIT_STACK_ALL_ZERO=y is probably going to be
> the default soon, I chose to change __sys_recvfrom() to clear
> all fields but msghdr.addr which might be not NULL.
> 
> For __copy_msghdr_from_user(), I added an explicit clear
> of kmsg->msg_get_inq.
> 
> [1]
> BUG: KMSAN: uninit-value in tcp_recvmsg+0x6cf/0xb60 net/ipv4/tcp.c:2557
> tcp_recvmsg+0x6cf/0xb60 net/ipv4/tcp.c:2557
> inet_recvmsg+0x13a/0x5a0 net/ipv4/af_inet.c:850
> sock_recvmsg_nosec net/socket.c:995 [inline]
> sock_recvmsg net/socket.c:1013 [inline]
> __sys_recvfrom+0x696/0x900 net/socket.c:2176
> __do_sys_recvfrom net/socket.c:2194 [inline]
> __se_sys_recvfrom net/socket.c:2190 [inline]
> __x64_sys_recvfrom+0x122/0x1c0 net/socket.c:2190
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x46/0xb0
> 
> Local variable msg created at:
> __sys_recvfrom+0x81/0x900 net/socket.c:2154
> __do_sys_recvfrom net/socket.c:2194 [inline]
> __se_sys_recvfrom net/socket.c:2190 [inline]
> __x64_sys_recvfrom+0x122/0x1c0 net/socket.c:2190
> 
> CPU: 0 PID: 3493 Comm: syz-executor170 Not tainted 5.19.0-rc3-syzkaller-30868-g4b28366af7d9 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Thanks Eric, looks good to me:

Reviewed-by: Jens Axboe <axboe@kernel.dk>

-- 
Jens Axboe