Received-SPF: pass (google.com: domain of linux-kernel+bounces-129851-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
To: <syzbot+ff14db38f56329ef68df@syzkaller.appspotmail.com>
CC: Nikita Zhandarovich <n.zhandarovich@fintech.ru>,
	<syzkaller-bugs@googlegroups.com>, <linux-kernel@vger.kernel.org>
Subject: Re: [syzbot] [v9fs?] KMSAN: uninit-value in p9_client_rpc (2)
Date: Wed, 3 Apr 2024 06:33:01 -0700
Message-ID: <20240403133301.14177-1-n.zhandarovich@fintech.ru>
In-Reply-To: <000000000000a77e580614ded85a@google.com>
References:
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain

If p9_check_errors() fails in p9_client_rpc(), req->rc.tag won't be
initialized and trace_9p_client_res() will try to print it before
exiting with error, triggering KMSAN. Fix it by having id and tag
fields inited with zero values.

Please test.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

 net/9p/client.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/9p/client.c b/net/9p/client.c
index e265a0ca6bdd..a9d613af7455 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -235,6 +235,8 @@ static int p9_fcall_init(struct p9_client *c, struct p9_fcall *fc,
 	if (!fc->sdata)
 		return -ENOMEM;
 	fc->capacity = alloc_msize;
+	fc->id = 0;
+	fc->tag = 0;
 	return 0;
 }