Lu Shuaibing 07f3596ce3 9p: Transport error uninitialized ... [ Upstream commit 0ce772fe79 ] The p9_tag_alloc() does not initialize the transport error t_err field. The struct p9_req_t *req is allocated and stored in a struct p9_client variable. The field t_err is never initialized before p9_conn_cancel() checks its value. KUMSAN(KernelUninitializedMemorySantizer, a new error detection tool) reports this bug. ================================================================== BUG: KUMSAN: use of uninitialized memory in p9_conn_cancel+0x2d9/0x3b0 Read of size 4 at addr ffff88805f9b600c by task kworker/1:2/1216 CPU: 1 PID: 1216 Comm: kworker/1:2 Not tainted 5.2.0-rc4+ #28 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 Workqueue: events p9_write_work Call Trace: dump_stack+0x75/0xae __kumsan_report+0x17c/0x3e6 kumsan_report+0xe/0x20 p9_conn_cancel+0x2d9/0x3b0 p9_write_work+0x183/0x4a0 process_one_work+0x4d1/0x8c0 worker_thread+0x6e/0x780 kthread+0x1ca/0x1f0 ret_from_fork+0x35/0x40 Allocated by task 1979: save_stack+0x19/0x80 __kumsan_kmalloc.constprop.3+0xbc/0x120 kmem_cache_alloc+0xa7/0x170 p9_client_prepare_req.part.9+0x3b/0x380 p9_client_rpc+0x15e/0x880 p9_client_create+0x3d0/0xac0 v9fs_session_init+0x192/0xc80 v9fs_mount+0x67/0x470 legacy_get_tree+0x70/0xd0 vfs_get_tree+0x4a/0x1c0 do_mount+0xba9/0xf90 ksys_mount+0xa8/0x120 __x64_sys_mount+0x62/0x70 do_syscall_64+0x6d/0x1e0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff88805f9b6008 which belongs to the cache p9_req_t of size 144 The buggy address is located 4 bytes inside of 144-byte region [ffff88805f9b6008, ffff88805f9b6098) The buggy address belongs to the page: page:ffffea00017e6d80 refcount:1 mapcount:0 mapping:ffff888068b63740 index:0xffff88805f9b7d90 compound_mapcount: 0 flags: 0x100000000010200(slab|head) raw: 0100000000010200 ffff888068b66450 ffff888068b66450 ffff888068b63740 raw: ffff88805f9b7d90 0000000000100001 00000001ffffffff 0000000000000000 page dumped because: kumsan: bad access detected ================================================================== Link: http://lkml.kernel.org/r/20190613070854.10434-1-shuaibinglu@126.com Signed-off-by: Lu Shuaibing <shuaibinglu@126.com> [dominique.martinet@cea.fr: grouped the added init with the others] Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-10-11 18:21:12 +02:00
..
client.c	9p: Transport error uninitialized	2019-10-11 18:21:12 +02:00
error.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
Kconfig	IB: Revert "remove redundant INFINIBAND kconfig dependencies"	2018-05-28 10:40:16 -06:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
mod.c	9p: Use a slab for allocating requests	2019-07-03 13:14:41 +02:00
protocol.c	9p: p9dirent_read: check network-provided name length	2019-07-03 13:14:42 +02:00
protocol.h	net/9p: Convert net/9p protocol dumps to tracepoints	2011-10-24 11:13:12 -05:00
trans_common.c	net/9p: include trans_common.h to fix missing prototype warning.	2019-07-03 13:14:43 +02:00
trans_common.h	net/9p: remove (now-)unused helpers	2015-04-11 22:28:29 -04:00
trans_fd.c	9p/trans_fd: put worker reqs on destroy	2019-07-03 13:14:43 +02:00
trans_rdma.c	9p/rdma: remove useless check in cm_event_handler	2019-07-03 13:14:42 +02:00
trans_virtio.c	9p/virtio: Add cleanup path in p9_virtio_init	2019-07-26 09:14:25 +02:00
trans_xen.c	9p/xen: Add cleanup path in p9_trans_xen_init	2019-07-26 09:14:25 +02:00
util.c	9p: fix whitespace issues	2018-08-13 09:34:58 +09:00