Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) client-ip=2620:137:e000::3:7;
From:   Kuniyuki Iwashima <kuniyu@amazon.com>
To:     <syzbot+b834a6b2decad004cfa1@syzkaller.appspotmail.com>
CC:     <davem@davemloft.net>, <edumazet@google.com>, <kuba@kernel.org>,
        <linux-kernel@vger.kernel.org>, <martineau@kernel.org>,
        <matthieu.baerts@tessares.net>, <matttbe@kernel.org>,
        <mptcp@lists.linux.dev>, <netdev@vger.kernel.org>,
        <pabeni@redhat.com>, <syzkaller-bugs@googlegroups.com>,
        <kuniyu@amazon.com>
Subject: Re: [syzbot] [mptcp?] KMSAN: uninit-value in mptcp_incoming_options
Date:   Wed, 22 Nov 2023 16:48:34 -0800
Message-ID: <20231123004834.58534-1-kuniyu@amazon.com>
In-Reply-To: <000000000000545a26060abf943b@google.com>
References: <000000000000545a26060abf943b@google.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk

From: syzbot <syzbot+b834a6b2decad004cfa1@syzkaller.appspotmail.com>
Date: Wed, 22 Nov 2023 07:43:23 -0800
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    c2d5304e6c64 Merge tag 'platform-drivers-x86-v6.7-2' of gi..
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=1536e3d4e80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=e32016b84cf917ca
> dashboard link: https://syzkaller.appspot.com/bug?extid=b834a6b2decad004cfa1
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11469724e80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13934aaf680000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/23ea827adf3b/disk-c2d5304e.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/0f964ac588f5/vmlinux-c2d5304e.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/b061be889285/bzImage-c2d5304e.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+b834a6b2decad004cfa1@syzkaller.appspotmail.com
> 
> =====================================================
> BUG: KMSAN: uninit-value in mptcp_incoming_options+0xc93/0x3a80 net/mptcp/options.c:1197

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git c2d5304e6c648ebcf653bace7e51e0e6742e46c8

diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index cd15ec73073e..01066aa7e67d 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -370,6 +370,7 @@ void mptcp_get_options(const struct sk_buff *skb,
 
 	/* initialize option status */
 	mp_opt->suboptions = 0;
+	mp_opt->use_ack = 0;
 
 	length = (th->doff * 4) - sizeof(struct tcphdr);
 	ptr = (const unsigned char *)(th + 1);