lkml.org 
[lkml]   [2018]   [May]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: KMSAN: uninit-value in strcmp
Date


> -----Original Message-----
> From: David Miller [mailto:davem@davemloft.net]
> Sent: Thursday, May 03, 2018 15:22
> To: syzbot+df0257c92ffd4fcc58cd@syzkaller.appspotmail.com
> Cc: Jon Maloy <jon.maloy@ericsson.com>; linux-kernel@vger.kernel.org;
> netdev@vger.kernel.org; syzkaller-bugs@googlegroups.com; tipc-
> discussion@lists.sourceforge.net; ying.xue@windriver.com
> Subject: Re: KMSAN: uninit-value in strcmp
>
> From: syzbot <syzbot+df0257c92ffd4fcc58cd@syzkaller.appspotmail.com>
> Date: Thu, 03 May 2018 11:44:02 -0700
>
> > Call Trace:
> > __dump_stack lib/dump_stack.c:17 [inline]
> > dump_stack+0x185/0x1d0 lib/dump_stack.c:53
> > kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
> > __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683
> > strcmp+0xf7/0x160 lib/string.c:329
> > tipc_nl_node_get_link+0x220/0x6f0 net/tipc/node.c:1881
> > genl_family_rcv_msg net/netlink/genetlink.c:599 [inline]
>
> Hmmm, TIPC_NL_LINK_GET uses tipc_nl_policy, which has a proper nesting
> entry for TIPC_NLA_LINK. I wonder how the code goes about validating
> TIPC_NLA_LINK_NAME in such a case? Does it?

I assume that a strncmp() instead of a strcmp() would avert this particular crash, but it doesn't sound like that is what you are after here?
To be honest, I will need to study this code a little myself to understand if there is more that has to be done.

///jon

>
> This may be the problem.

\
 
 \ /
  Last update: 2018-05-04 04:01    [W:0.043 / U:0.108 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site