Eric Dumazet 1960f2b534 nbd: always initialize struct msghdr completely ...

commit 78fbb92af2 upstream.

syzbot complains that msg->msg_get_inq value can be uninitialized [1]

struct msghdr got many new fields recently, we should always make
sure their values is zero by default.

[1]
 BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571
  tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571
  inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879
  sock_recvmsg_nosec net/socket.c:1044 [inline]
  sock_recvmsg+0x12b/0x1e0 net/socket.c:1066
  __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538
  nbd_read_reply drivers/block/nbd.c:732 [inline]
  recv_work+0x262/0x3100 drivers/block/nbd.c:863
  process_one_work kernel/workqueue.c:2627 [inline]
  process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700
  worker_thread+0xf45/0x1490 kernel/workqueue.c:2781
  kthread+0x3ed/0x540 kernel/kthread.c:388
  ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147
  ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242

Local variable msg created at:
  __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513
  nbd_read_reply drivers/block/nbd.c:732 [inline]
  recv_work+0x262/0x3100 drivers/block/nbd.c:863

CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: nbd5-recv recv_work

Fixes: f94fd25cb0 ("tcp: pass back data left in socket after receive")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: stable@vger.kernel.org
Cc: Josef Bacik <josef@toxicpanda.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: linux-block@vger.kernel.org
Cc: nbd@other.debian.org
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240112132657.647112-1-edumazet@google.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2024-01-31 16:18:52 -08:00

..

aoe

aoe: make aoe_class a static const structure

2023-06-21 07:45:19 -06:00

drbd

drbd: swap bvec_set_page len and offset

2023-09-06 07:33:03 -06:00

mtip32xx

block: replace fmode_t with a block-specific type for block open flags

2023-06-12 08:04:05 -06:00

null_blk

null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS

2024-01-25 15:35:29 -08:00

rnbd

drivers/rnbd: restore sysfs interface to rnbd-client

2023-08-18 15:00:39 -06:00

xen-blkback

block: replace fmode_t with a block-specific type for block open flags

2023-06-12 08:04:05 -06:00

zram

zram: take device and not only bvec offset into account

2023-08-05 16:13:15 -06:00

amiflop.c

amiflop: don't call fsync_bdev in FDFMTBEG

2023-08-21 14:35:31 +02:00

ataflop.c

block: replace fmode_t with a block-specific type for block open flags

2023-06-12 08:04:05 -06:00

brd.c

brd: use cond_resched instead of cond_resched_rcu

2023-06-14 11:13:07 -06:00

floppy.c

floppy: call disk_force_media_change when changing the format

2023-08-21 14:35:31 +02:00

Kconfig

block: ublk: switch to ioctl command encoding

2023-04-18 20:13:30 -06:00

loop.c

loop: fix the the direct I/O support check when used on top of block devices

2024-01-25 15:36:00 -08:00

Makefile

Revert "pktcdvd: remove driver."

2023-01-04 14:44:13 -07:00

n64cart.c

block: remove blk_cleanup_disk

2022-06-28 06:33:15 -06:00

nbd.c

nbd: always initialize struct msghdr completely

2024-01-31 16:18:52 -08:00

pktcdvd.c

block: replace fmode_t with a block-specific type for block open flags

2023-06-12 08:04:05 -06:00

ps3disk.c

block: remove blk_cleanup_disk

2022-06-28 06:33:15 -06:00

ps3vram.c

ps3vram: remove bio splitting

2023-01-29 15:18:35 -07:00

rbd_types.h

…

rbd.c

rbd: take header_rwsem in rbd_dev_refresh() only when updating

2023-09-26 10:33:19 +02:00

sunvdc.c

block: replace fmode_t with a block-specific type for block open flags

2023-06-12 08:04:05 -06:00

swim3.c

swim3: mark swim3_init() static

2023-08-10 08:32:59 -06:00

swim_asm.S

…

swim.c

swim: fix a missing FMODE_ -> BLK_OPEN_ conversion in floppy_open

2023-06-20 07:16:04 -06:00

ublk_drv.c

Merge tag 'for-6.6/block-2023-08-28' of git://git.kernel.dk/linux

2023-08-29 20:21:42 -07:00

virtio_blk.c

virtio_blk: fix snprintf truncation compiler warning

2024-01-20 11:51:46 +01:00

xen-blkfront.c

Merge tag 'for-6.5/block-2023-06-23' of git://git.kernel.dk/linux

2023-06-26 12:47:20 -07:00

z2ram.c

block: replace fmode_t with a block-specific type for block open flags

2023-06-12 08:04:05 -06:00