Re: [syzbot] [io-uring?] KMSAN: uninit-value in io_nop
From: Lizhi Xu
Date: Thu Nov 21 2024 - 20:14:51 EST
The fd of nop not inited when the flags of the nop comm is not IORING_NOP_FIXED_FILE in nop's prep.
#syz test
diff --git a/io_uring/nop.c b/io_uring/nop.c
index 6d470d4251ee..a10d0a0aef96 100644
--- a/io_uring/nop.c
+++ b/io_uring/nop.c
@@ -37,6 +37,9 @@ int io_nop_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
nop->result = 0;
if (nop->flags & IORING_NOP_FIXED_FILE)
nop->fd = READ_ONCE(sqe->fd);
+ else
+ nop->fd = 0;
+
if (nop->flags & IORING_NOP_FIXED_BUFFER)
nop->buffer = READ_ONCE(sqe->buf_index);
return 0;