Commit 7b821da5 authored by Tabrez Ahmed's avatar Tabrez Ahmed Committed by Paolo Abeni
Browse files

rds: tcp: fix uninit-value in __inet_bind 



KMSAN reported an uninit-value access in __inet_bind() when binding
an RDS TCP socket.

The uninitialized memory originates from rds_tcp_conn_alloc(),
which uses kmem_cache_alloc() to allocate the rds_tcp_connection structure.

Specifically, the field 't_client_port_group' is incremented in
rds_tcp_conn_path_connect() without being initialized first:

    if (++tc->t_client_port_group >= port_groups)

Since kmem_cache_alloc() does not zero the memory, this field contains
garbage, leading to the KMSAN report.

Fix this by using kmem_cache_zalloc() to ensure the structure is
zero-initialized upon allocation.

Reported-by: default avatar <syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=aae646f09192f72a68dc


Tested-by: default avatar <syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com>
Fixes: a20a6992 ("net/rds: Encode cp_index in TCP source port")

Signed-off-by: default avatarTabrez Ahmed <tabreztalks@gmail.com>
Reviewed-by: default avatarCharalampos Mitrodimas <charmitro@posteo.net>
Reviewed-by: default avatarAllison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20260217135350.33641-1-tabreztalks@gmail.com


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent 6bf45704

net/rds/tcp.c

+1 −1
Original line number Diff line number Diff line
@@ -373,7 +373,7 @@ static int rds_tcp_conn_alloc(struct rds_connection *conn, gfp_t gfp) 
	int ret = 0;



	for (i = 0; i < RDS_MPATH_WORKERS; i++) {

		tc = kmem_cache_alloc(rds_tcp_conn_slab, gfp);

		tc = kmem_cache_zalloc(rds_tcp_conn_slab, gfp);

		if (!tc) {

			ret = -ENOMEM;

			goto fail;