Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754759AbdGNRfF (ORCPT ); Fri, 14 Jul 2017 13:35:05 -0400 Received: from mail-vk0-f44.google.com ([209.85.213.44]:36496 "EHLO mail-vk0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753844AbdGNRfE (ORCPT ); Fri, 14 Jul 2017 13:35:04 -0400 MIME-Version: 1.0 In-Reply-To: References: <20170714165453.112098-1-glider@google.com> From: Alexander Potapenko Date: Fri, 14 Jul 2017 19:35:02 +0200 Message-ID: Subject: Re: [PATCH] ipv6: initialize treq->txhash in cookie_v6_check() To: Neal Cardwell Cc: Dmitry Vyukov , Kostya Serebryany , Eric Dumazet , David Miller , LKML , Netdev Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id v6EHZKt2026881 Content-Length: 1440 Lines: 41 On Fri, Jul 14, 2017 at 7:04 PM, Neal Cardwell wrote: > On Fri, Jul 14, 2017 at 12:54 PM, Alexander Potapenko wrote: >> KMSAN reported use of uninitialized memory in skb_set_hash_from_sk(), >> which originated from the TCP request socket created in >> cookie_v6_check(): > ... >> --- a/net/ipv6/syncookies.c >> +++ b/net/ipv6/syncookies.c >> @@ -216,6 +216,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) >> treq->rcv_isn = ntohl(th->seq) - 1; >> treq->snt_isn = cookie; >> treq->ts_off = 0; >> + treq->txhash = 0; >> >> /* >> * We need to lookup the dst_entry to get the correct window size. > > I would have thought that the same fix is needed in the corresponding > line in cookie_v4_check() in net/ipv4/syncookies.c? (I do not see > txhash being initialized for the IPv4 side.) If it's not needed for > some reason, then it would be worth a comment in the commit > description to explain why not. Most certainly it is needed. I haven't seen reports for that in the wild and couldn't forge a repro triggering the bug in IPv4, but I'll give it another shot. > thanks, > neal -- Alexander Potapenko Software Engineer Google Germany GmbH Erika-Mann-Straße, 33 80636 München Geschäftsführer: Matthew Scott Sucherman, Paul Terence Manicle Registergericht und -nummer: Hamburg, HRB 86891 Sitz der Gesellschaft: Hamburg