linux/drivers/block
Eric Dumazet 78fbb92af2 nbd: always initialize struct msghdr completely
syzbot complains that msg->msg_get_inq value can be uninitialized [1]

struct msghdr got many new fields recently, we should always make
sure their values is zero by default.

[1]
 BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571
  tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571
  inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879
  sock_recvmsg_nosec net/socket.c:1044 [inline]
  sock_recvmsg+0x12b/0x1e0 net/socket.c:1066
  __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538
  nbd_read_reply drivers/block/nbd.c:732 [inline]
  recv_work+0x262/0x3100 drivers/block/nbd.c:863
  process_one_work kernel/workqueue.c:2627 [inline]
  process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700
  worker_thread+0xf45/0x1490 kernel/workqueue.c:2781
  kthread+0x3ed/0x540 kernel/kthread.c:388
  ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147
  ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242

Local variable msg created at:
  __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513
  nbd_read_reply drivers/block/nbd.c:732 [inline]
  recv_work+0x262/0x3100 drivers/block/nbd.c:863

CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: nbd5-recv recv_work

Fixes: f94fd25cb0 ("tcp: pass back data left in socket after receive")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: stable@vger.kernel.org
Cc: Josef Bacik <josef@toxicpanda.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: linux-block@vger.kernel.org
Cc: nbd@other.debian.org
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240112132657.647112-1-edumazet@google.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2024-01-17 08:47:46 -07:00
..
aoe aoe: don't abuse BLK_DEF_MAX_SECTORS 2023-12-27 10:46:01 -07:00
drbd drbd: actlog: fix kernel-doc warnings and spelling 2023-12-22 07:18:35 -07:00
mtip32xx block: replace fmode_t with a block-specific type for block open flags 2023-06-12 08:04:05 -06:00
null_blk null_blk: Remove usage of the deprecated ida_simple_xx() API 2024-01-14 07:37:44 -07:00
rnbd block/rnbd-srv: Check for unlikely string overflow 2023-12-13 08:15:48 -07:00
xen-blkback drivers/block/xen-blkback/common.h: Fix spelling typo in comment 2024-01-04 16:10:29 -07:00
zram zram: use the default discard granularity 2023-12-29 08:44:12 -07:00
amiflop.c amiflop: don't call fsync_bdev in FDFMTBEG 2023-08-21 14:35:31 +02:00
ataflop.c block: move bdev_mark_dead out of disk_check_media_change 2023-10-28 13:29:23 +02:00
brd.c brd: use cond_resched instead of cond_resched_rcu 2023-06-14 11:13:07 -06:00
floppy.c block: move bdev_mark_dead out of disk_check_media_change 2023-10-28 13:29:23 +02:00
Kconfig block: ublk: switch to ioctl command encoding 2023-04-18 20:13:30 -06:00
loop.c loop: don't abuse BLK_DEF_MAX_SECTORS 2023-12-27 10:46:01 -07:00
Makefile Revert "pktcdvd: remove driver." 2023-01-04 14:44:13 -07:00
n64cart.c block: remove blk_cleanup_disk 2022-06-28 06:33:15 -06:00
nbd.c nbd: always initialize struct msghdr completely 2024-01-17 08:47:46 -07:00
pktcdvd.c pktcdvd: Convert to bdev_open_by_dev() 2023-10-28 13:29:17 +02:00
ps3disk.c block: remove blk_cleanup_disk 2022-06-28 06:33:15 -06:00
ps3vram.c ps3vram: remove bio splitting 2023-01-29 15:18:35 -07:00
rbd_types.h libceph, rbd: replace zero-length array with flexible-array 2020-06-01 13:22:53 +02:00
rbd.c rbd: take header_rwsem in rbd_dev_refresh() only when updating 2023-09-26 10:33:19 +02:00
sunvdc.c block: replace fmode_t with a block-specific type for block open flags 2023-06-12 08:04:05 -06:00
swim_asm.S
swim.c swim: fix a missing FMODE_ -> BLK_OPEN_ conversion in floppy_open 2023-06-20 07:16:04 -06:00
swim3.c swim3: mark swim3_init() static 2023-08-10 08:32:59 -06:00
ublk_drv.c block: simplify disk_set_zoned 2023-12-19 20:17:43 -07:00
virtio_blk.c virtio_blk: remove duplicate check if queue is broken in virtblk_done 2024-01-15 09:33:41 -07:00
xen-blkfront.c for-6.5/block-2023-06-23 2023-06-26 12:47:20 -07:00
z2ram.c block: replace fmode_t with a block-specific type for block open flags 2023-06-12 08:04:05 -06:00