Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755024AbdC1Mkn (ORCPT ); Tue, 28 Mar 2017 08:40:43 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:60088 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754707AbdC1Mkf (ORCPT ); Tue, 28 Mar 2017 08:40:35 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Potapenko , Soheil Hassas Yeganeh , "David S. Miller" Subject: [PATCH 4.10 017/111] ipv6: make sure to initialize sockc.tsflags before first use Date: Tue, 28 Mar 2017 14:30:03 +0200 Message-Id: <20170328122916.397065368@linuxfoundation.org> X-Mailer: git-send-email 2.12.1 In-Reply-To: <20170328122915.640228468@linuxfoundation.org> References: <20170328122915.640228468@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1260 Lines: 43 4.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alexander Potapenko [ Upstream commit d515684d78148884d5fc425ba904c50f03844020 ] In the case udp_sk(sk)->pending is AF_INET6, udpv6_sendmsg() would jump to do_append_data, skipping the initialization of sockc.tsflags. Fix the problem by moving sockc.tsflags initialization earlier. The bug was detected with KMSAN. Fixes: c14ac9451c34 ("sock: enable timestamping using control messages") Signed-off-by: Alexander Potapenko Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv6/udp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -1022,6 +1022,7 @@ int udpv6_sendmsg(struct sock *sk, struc ipc6.hlimit = -1; ipc6.tclass = -1; ipc6.dontfrag = -1; + sockc.tsflags = sk->sk_tsflags; /* destination address check */ if (sin6) { @@ -1146,7 +1147,6 @@ do_udp_sendmsg: fl6.flowi6_mark = sk->sk_mark; fl6.flowi6_uid = sk->sk_uid; - sockc.tsflags = sk->sk_tsflags; if (msg->msg_controllen) { opt = &opt_space;