> -----Original Message----- > From: netdev-ow...@vger.kernel.org <netdev-ow...@vger.kernel.org> > On Behalf Of David Miller > Sent: Saturday, May 19, 2018 23:00 > To: ying....@windriver.com > Cc: netdev@vger.kernel.org; Jon Maloy <jon.ma...@ericsson.com>; > syzkaller-b...@googlegroups.com; tipc-discuss...@lists.sourceforge.net > Subject: Re: [PATCH net-next] tipc: eliminate complaint of KMSAN uninit- > value in tipc_conn_rcv_sub > > From: Ying Xue <ying....@windriver.com> > Date: Fri, 18 May 2018 19:50:55 +0800 > > > As variable s of struct tipc_subscr type is not initialized in > > tipc_conn_rcv_from_sock() before it is used in tipc_conn_rcv_sub(), > > KMSAN reported the following uninit-value type complaint: > > I agree with others that the short read is the bug. > > You need to decide what should happen if not a full tipc_subscr object is > obtained from the sock_recvmsg() call. > > Proceeding to pass it on to tipc_conn_rcv_sub() cannot possibly be correct. > > You're not getting what you are expecting from the peer, the memset() you > are adding doesn't change that. > > And once you get this badly sized read, what does that do to the stream of > subsequent recvmsg calls here?
This socket/connection of type SOCK_SEQPACKET, so if anything like this happens, it is an error, and the connection should be aborted. ///jon
