]> git.ipfire.org Git - thirdparty/linux.git/commit
rseq: Fix using an uninitialized stack variable in rseq_exit_user_update()
authorQing Wang <wangqing7171@gmail.com>
Tue, 2 Jun 2026 03:08:54 +0000 (11:08 +0800)
committerPeter Zijlstra <peterz@infradead.org>
Tue, 2 Jun 2026 10:41:15 +0000 (12:41 +0200)
commit6d99479799c69c3cb588fcda19c81d8f61d64ecd
tree1a96d6270c687b1495425318af4f99cb75e2d3e6
parente43ffb69e0438cddd72aaa30898b4dc446f664f8
rseq: Fix using an uninitialized stack variable in rseq_exit_user_update()

There is an bug in which an uninitialized stack variable is used in
rseq_exit_user_update() as reported by syzbot:

BUG: KMSAN: kernel-infoleak in rseq_set_ids_get_csaddr include/linux/rseq_entry.h:502 [inline]

The local variable:

struct rseq_ids ids = {
.cpu_id  = task_cpu(t),
.mm_cid  = task_mm_cid(t),
.node_id = cpu_to_node(ids.cpu_id),
};

According to the C standard, the evaluation order of expressions in an
initializer list is indeterminately sequenced. The compiler (Clang, in
this KMSAN build) evaluates `cpu_to_node(ids.cpu_id)` *before*
`ids.cpu_id` is initialized with `task_cpu(t)`.

This is fixed by moving the assignment of ids.node_id outside the
structure initialization.

Fixes: 82f572449cfe ("rseq: Implement read only ABI enforcement for optimized RSEQ V2 mode")
Closes: https://syzkaller.appspot.com/bug?extid=185a631927096f9da2fc
Reported-by: syzbot+185a631927096f9da2fc@syzkaller.appspotmail.com
Signed-off-by: Qing Wang <wangqing7171@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Link: https://patch.msgid.link/20260602030854.574038-1-wangqing7171@gmail.com
include/linux/rseq_entry.h