Messages in this thread | | | Date | Tue, 21 Dec 2021 23:33:24 +0300 | Subject | Re: [syzbot] KMSAN: kernel-infoleak in move_addr_to_user (6) | From | Pavel Skripkin <> |
| |
On 12/20/21 19:33, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: b0a8b5053e8b kmsan: core: add dependency on DEBUG_KERNEL > git tree: https://github.com/google/kmsan.git master > console output: https://syzkaller.appspot.com/x/log.txt?x=14a45071b00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=46a956fc7a887c60 > dashboard link: https://syzkaller.appspot.com/bug?extid=cdbd40e0c3ca02cae3b7 > compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1343f443b00000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16efa493b00000 > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+cdbd40e0c3ca02cae3b7@syzkaller.appspotmail.com >
Looks like missing memset(0). tipc_nametbl_lookup_anycast() may return before initializing sk.ref
> * On exit: > * > * - If lookup is deferred to another node, leave 'sk->node' unchanged and > * return 'true'.
And then sk.ref is passed to msg_set_destport().
There is also one more place with similar possible uninit-value in tipc_msg_lookup_dest().
With regards, Pavel Skripkin
| |