Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753400AbdI1Pm4 (ORCPT ); Thu, 28 Sep 2017 11:42:56 -0400 Received: from shards.monkeyblade.net ([184.105.139.130]:47004 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751464AbdI1Pmz (ORCPT ); Thu, 28 Sep 2017 11:42:55 -0400 Date: Thu, 28 Sep 2017 08:42:52 -0700 (PDT) Message-Id: <20170928.084252.253155943275207205.davem@davemloft.net> To: glider@google.com Cc: edumazet@google.com, dvyukov@google.com, syzkaller@googlegroups.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v3] tun: bail out from tun_get_user() if the skb is empty From: David Miller In-Reply-To: <20170928093237.121450-1-glider@google.com> References: <20170928093237.121450-1-glider@google.com> X-Mailer: Mew version 6.7 on Emacs 25.3 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Thu, 28 Sep 2017 08:42:54 -0700 (PDT) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 422 Lines: 12 From: Alexander Potapenko Date: Thu, 28 Sep 2017 11:32:37 +0200 > KMSAN (https://github.com/google/kmsan) reported accessing uninitialized > skb->data[0] in the case the skb is empty (i.e. skb->len is 0): ... > Make sure tun_get_user() doesn't touch skb->data[0] unless there is > actual data. ... > Signed-off-by: Alexander Potapenko Applied and queued up for -stable, thanks.