• Hoang Le's avatar
    tipc: check attribute length for bearer name · 7f36f798
    Hoang Le authored
    syzbot reported uninit-value:
    =====================================================
    BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:644 [inline]
    BUG: KMSAN: uninit-value in string+0x4f9/0x6f0 lib/vsprintf.c:725
     string_nocheck lib/vsprintf.c:644 [inline]
     string+0x4f9/0x6f0 lib/vsprintf.c:725
     vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806
     vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158
     vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256
     vprintk_default+0x86/0xa0 kernel/printk/printk.c:2283
     vprintk+0x15f/0x180 kernel/printk/printk_safe.c:50
     _printk+0x18d/0x1cf kernel/printk/printk.c:2293
     tipc_enable_bearer net/tipc/bearer.c:371 [inline]
     __tipc_nl_bearer_enable+0x2022/0x22a0 net/tipc/bearer.c:1033
     tipc_nl_bearer_enable+0x6c/0xb0 net/tipc/bearer.c:1042
     genl_family_rcv_msg_doit net/netlink/genetlink.c:731 [inline]
    
    - Do sanity check the attribute length for TIPC_NLA_BEARER_NAME.
    - Do not use 'illegal name' in printing message.
    
    Reported-by: syzbot+e820fdc8ce362f2dea51@syzkaller.appspotmail.com
    Fixes: cb30a633 ("tipc: refactor function tipc_enable_bearer()")
    Acked-by: default avatarJon Maloy <jmaloy@redhat.com>
    Signed-off-by: default avatarHoang Le <hoang.h.le@dektech.com.au>
    Link: https://lore.kernel.org/r/20220602063053.5892-1-hoang.h.le@dektech.com.auSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    7f36f798
bearer.c 32.4 KB