| Message ID | d06d0f7f-696c-83b4-b2d5-70b5f2730a37@I-love.SAKURA.ne.jp (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | d547c1b717fc5a1e062307e1efdf81590ba9f6c1 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net: clear msg_get_inq in __get_compat_msghdr() | expand |
On 9/14/22 3:51 AM, Tetsuo Handa wrote: > syzbot is still complaining uninit-value in tcp_recvmsg(), for > commit 1228b34c8d0ecf6d ("net: clear msg_get_inq in __sys_recvfrom() and > __copy_msghdr_from_user()") missed that __get_compat_msghdr() is called > instead of copy_msghdr_from_user() when MSG_CMSG_COMPAT is specified. Looks good to me: Reviewed-by: Jens Axboe <axboe@kernel.dk>
Hello: This patch was applied to netdev/net.git (master) by Jakub Kicinski <kuba@kernel.org>: On Wed, 14 Sep 2022 18:51:54 +0900 you wrote: > syzbot is still complaining uninit-value in tcp_recvmsg(), for > commit 1228b34c8d0ecf6d ("net: clear msg_get_inq in __sys_recvfrom() and > __copy_msghdr_from_user()") missed that __get_compat_msghdr() is called > instead of copy_msghdr_from_user() when MSG_CMSG_COMPAT is specified. > > Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> > Fixes: 1228b34c8d0ecf6d ("net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from_user()") > > [...] Here is the summary with links: - net: clear msg_get_inq in __get_compat_msghdr() https://git.kernel.org/netdev/net/c/d547c1b717fc You are awesome, thank you!
diff --git a/net/compat.c b/net/compat.c index fe9be3c56ef7..385f04a6be2f 100644 --- a/net/compat.c +++ b/net/compat.c @@ -52,6 +52,7 @@ int __get_compat_msghdr(struct msghdr *kmsg, kmsg->msg_namelen = sizeof(struct sockaddr_storage); kmsg->msg_control_is_user = true; + kmsg->msg_get_inq = 0; kmsg->msg_control_user = compat_ptr(msg->msg_control); kmsg->msg_controllen = msg->msg_controllen;
syzbot is still complaining uninit-value in tcp_recvmsg(), for commit 1228b34c8d0ecf6d ("net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from_user()") missed that __get_compat_msghdr() is called instead of copy_msghdr_from_user() when MSG_CMSG_COMPAT is specified. Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Fixes: 1228b34c8d0ecf6d ("net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from_user()") --- net/compat.c | 1 + 1 file changed, 1 insertion(+)