Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:1 as permitted sender) client-ip=2620:137:e000::3:1;
Message-ID: <193463799264cd58373df81b6e93cc4091c83ca5.camel@redhat.com>
Subject: Re: [syzbot] [mptcp?] KMSAN: uninit-value in mptcp_incoming_options
From:   Paolo Abeni <pabeni@redhat.com>
To:     Kuniyuki Iwashima <kuniyu@amazon.com>,
        syzbot+b834a6b2decad004cfa1@syzkaller.appspotmail.com
Cc:     davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
        linux-kernel@vger.kernel.org, martineau@kernel.org,
        matthieu.baerts@tessares.net, matttbe@kernel.org,
        mptcp@lists.linux.dev, netdev@vger.kernel.org,
        syzkaller-bugs@googlegroups.com
Date:   Thu, 23 Nov 2023 09:00:57 +0100
In-Reply-To: <20231123004834.58534-1-kuniyu@amazon.com>
References: <000000000000545a26060abf943b@google.com>
         <20231123004834.58534-1-kuniyu@amazon.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.46.4 (3.46.4-1.fc37) 
MIME-Version: 1.0
Precedence: bulk

Hi.

On Wed, 2023-11-22 at 16:48 -0800, Kuniyuki Iwashima wrote:
> From: syzbot <syzbot+b834a6b2decad004cfa1@syzkaller.appspotmail.com>
> Date: Wed, 22 Nov 2023 07:43:23 -0800
> > Hello,
> >=20
> > syzbot found the following issue on:
> >=20
> > HEAD commit:    c2d5304e6c64 Merge tag 'platform-drivers-x86-v6.7-2' of=
 gi..
> > git tree:       upstream
> > console+strace: https://syzkaller.appspot.com/x/log.txt?x=3D1536e3d4e80=
000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=3De32016b84cf=
917ca
> > dashboard link: https://syzkaller.appspot.com/bug?extid=3Db834a6b2decad=
004cfa1
> > compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for D=
ebian) 2.40
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=3D11469724e=
80000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=3D13934aaf680=
000
> >=20
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/23ea827adf3b/d=
isk-c2d5304e.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/0f964ac588f5/vmli=
nux-c2d5304e.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/b061be889285=
/bzImage-c2d5304e.xz
> >=20
> > IMPORTANT: if you fix the issue, please add the following tag to the co=
mmit:
> > Reported-by: syzbot+b834a6b2decad004cfa1@syzkaller.appspotmail.com
> >=20
> > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D
> > BUG: KMSAN: uninit-value in mptcp_incoming_options+0xc93/0x3a80 net/mpt=
cp/options.c:1197
>=20
> #syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gi=
t c2d5304e6c648ebcf653bace7e51e0e6742e46c8
>=20
> diff --git a/net/mptcp/options.c b/net/mptcp/options.c
> index cd15ec73073e..01066aa7e67d 100644
> --- a/net/mptcp/options.c
> +++ b/net/mptcp/options.c
> @@ -370,6 +370,7 @@ void mptcp_get_options(const struct sk_buff *skb,
> =20
>  	/* initialize option status */
>  	mp_opt->suboptions =3D 0;
> +	mp_opt->use_ack =3D 0;
> =20
>  	length =3D (th->doff * 4) - sizeof(struct tcphdr);
>  	ptr =3D (const unsigned char *)(th + 1);
>=20

Thanks for the patch! AFAICS it should work, but I think the variant
proposed by Edward:

https://lore.kernel.org/netdev/tencent_B0E02F1D6C009450E8D6EC06CC6C7B5E6C0A=
@qq.com/

should be better, adding the additional instruction only in the code
path needing it.=20

Thank!

Paolo