]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
rds: tcp: fix uninit-value in __inet_bind
authorTabrez Ahmed <tabreztalks@gmail.com>
Tue, 17 Feb 2026 13:53:49 +0000 (19:23 +0530)
committerPaolo Abeni <pabeni@redhat.com>
Thu, 19 Feb 2026 15:05:56 +0000 (16:05 +0100)
commit7b821da55b3f88c1703ff2c2074d182295a84f6b
tree4664c17eced67162585a872449720d9cc834285b
parent6bf45704a92a128a8bfb2dd4d550c61b257c8f9a
rds: tcp: fix uninit-value in __inet_bind

KMSAN reported an uninit-value access in __inet_bind() when binding
an RDS TCP socket.

The uninitialized memory originates from rds_tcp_conn_alloc(),
which uses kmem_cache_alloc() to allocate the rds_tcp_connection structure.

Specifically, the field 't_client_port_group' is incremented in
rds_tcp_conn_path_connect() without being initialized first:

    if (++tc->t_client_port_group >= port_groups)

Since kmem_cache_alloc() does not zero the memory, this field contains
garbage, leading to the KMSAN report.

Fix this by using kmem_cache_zalloc() to ensure the structure is
zero-initialized upon allocation.

Reported-by: syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=aae646f09192f72a68dc
Tested-by: syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com
Fixes: a20a6992558f ("net/rds: Encode cp_index in TCP source port")
Signed-off-by: Tabrez Ahmed <tabreztalks@gmail.com>
Reviewed-by: Charalampos Mitrodimas <charmitro@posteo.net>
Reviewed-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20260217135350.33641-1-tabreztalks@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
net/rds/tcp.c