On Mon, Jan 7, 2019 at 2:38 PM David Miller <da...@davemloft.net> wrote:
>
> From: Ying Xue <ying....@windriver.com>
> Date: Mon, 7 Jan 2019 19:29:52 +0800
>
> > This is because lc->name string is not validated before it's used.
>
> It looks like we have several situations like this, not just this one.
>
> For example, tipc_nl_compat_bearer_{enable,disable}() with b->name.
>
> Next, tipc_nl_compat_media_set() and tipc_nl_compat_bearer_set().
>
> On input, tipc_nl_compat_link_stat_dump() blindly does a strcmp()
> on one of these strings.
>
> In fact, this entire file is full of errors of this sort.
>
> Can you please address all of them, perhaps using a helper of
> some kind to consolidate the logic?
>
> Thank you.There 9 uninits in tipc currently open on syzbot. If you extend the scope of this change, please update Reported-by tags accordingly. Thanks KMSAN: uninit-value in tipc_nl_compat_doit https://syzkaller.appspot.com/bug?id=d64b3c48a3e81dca017e61a50d15880bc677cbb5 KMSAN: uninit-value in tipc_nl_compat_dumpit https://syzkaller.appspot.com/bug?id=330d750e403fbaf78e3b631b389443c9153e3804 KMSAN: uninit-value in tipc_nl_compat_bearer_enable https://syzkaller.appspot.com/bug?id=a9dce514eeddaa78ca8e04676c19097939db1fc5 KMSAN: uninit-value in tipc_nl_compat_name_table_dump https://syzkaller.appspot.com/bug?id=c40c98888fb6ebdb3f66d99dfa2c1b8df9601a34 KMSAN: uninit-value in tipc_nl_compat_link_set (2) https://syzkaller.appspot.com/bug?id=ab4ee03213b801410f0194d6b5435e8e3c95af94 KMSAN: uninit-value in __tipc_nl_bearer_enable https://syzkaller.appspot.com/bug?id=bf95da1c68b889380395af19f1953e91b772d3ea KMSAN: uninit-value in tipc_nl_compat_link_reset_stats https://syzkaller.appspot.com/bug?id=a675bbf645ff6a5810e2af2f35752d93f80dd95b KMSAN: uninit-value in tipc_subscrb_rcv_cb https://syzkaller.appspot.com/bug?id=ec45249073777e4fc8fa9d8f1732f594bc2f4023 KMSAN: uninit-value in tipc_conn_rcv_sub https://syzkaller.appspot.com/bug?id=0df95bc3a80b97dfd33dc7f47ebfd7802d03dfc3
