Re: KMSAN: uninit-value in strcmp

[Ying Xue]

On 05/04/2018 03:22 AM, David Miller wrote:
> From: syzbot <syzbot+df0257c92ffd4fcc58cd@xxxxxxxxxxxxxxxxxxxxxxxxx>
> Date: Thu, 03 May 2018 11:44:02 -0700
> 
>> Call Trace:
>>  __dump_stack lib/dump_stack.c:17 [inline]
>>  dump_stack+0x185/0x1d0 lib/dump_stack.c:53
>>  kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
>>  __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683
>>  strcmp+0xf7/0x160 lib/string.c:329
>>  tipc_nl_node_get_link+0x220/0x6f0 net/tipc/node.c:1881
>>  genl_family_rcv_msg net/netlink/genetlink.c:599 [inline]
> 
> Hmmm, TIPC_NL_LINK_GET uses tipc_nl_policy, which has a proper nesting
> entry for TIPC_NLA_LINK.  I wonder how the code goes about validating
> TIPC_NLA_LINK_NAME in such a case?  Does it?
> 
> This may be the problem.

David, you are right. This is absolutely a real bug. As you said, we
didn't validate TIPC_NLA_LINK_NAME attribute in tipc_nl_node_get_link()
at all.

I will submit a patch to fix the issue soon.

>