Re: [PATCH net v2] rds: tcp: fix uninit-value in __inet_bind

[Allison Henderson]

On Tue, 2026-02-17 at 19:23 +0530, Tabrez Ahmed wrote:
> KMSAN reported an uninit-value access in __inet_bind() when binding
> an RDS TCP socket.
> 
> The uninitialized memory originates from rds_tcp_conn_alloc(),
> which uses kmem_cache_alloc() to allocate the rds_tcp_connection structure.
> 
> Specifically, the field 't_client_port_group' is incremented in
> rds_tcp_conn_path_connect() without being initialized first:
> 
>     if (++tc->t_client_port_group >= port_groups)
> 
> Since kmem_cache_alloc() does not zero the memory, this field contains
> garbage, leading to the KMSAN report.
> 
> Fix this by using kmem_cache_zalloc() to ensure the structure is
> zero-initialized upon allocation.
> 
> Reported-by: syzbot+aae646f09192f72a68dc@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://urldefense.com/v3/__https://syzkaller.appspot.com/bug?extid=aae646f09192f72a68dc__;!!ACWV5N9M2RV99hQ!KzzjhqabhC2dy_AOmRK4QHF3FILzGR2FxPlBFUOY6bjNqwGNvvtgnZXhnab3n-7b79hRhEkCBy86Zpzts1dzLrHgWg$ 
> Tested-by: syzbot+aae646f09192f72a68dc@xxxxxxxxxxxxxxxxxxxxxxxxx
> Fixes: a20a6992558f ("net/rds: Encode cp_index in TCP source port")
> 
> Signed-off-by: Tabrez Ahmed <tabreztalks@xxxxxxxxx>
This looks good to me.  Thanks Tabrez.

Reviewed-by: Allison Henderson <achender@xxxxxxxxxx>

> ---
> v2:
>  - Updated Fixes tag to point to commit a20a6992558f as requested by
>    Charalampos Mitrodimas and Allison Henderson.
>  - Explicitly mentioned 't_client_port_group' in the commit message.
>  - Fixed line wrapping to be under 75 characters. 
> 
>  net/rds/tcp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/rds/tcp.c b/net/rds/tcp.c
> index 45484a93d75f..04f310255692 100644
> --- a/net/rds/tcp.c
> +++ b/net/rds/tcp.c
> @@ -373,7 +373,7 @@ static int rds_tcp_conn_alloc(struct rds_connection *conn, gfp_t gfp)
>  	int ret = 0;
>  
>  	for (i = 0; i < RDS_MPATH_WORKERS; i++) {
> -		tc = kmem_cache_alloc(rds_tcp_conn_slab, gfp);
> +		tc = kmem_cache_zalloc(rds_tcp_conn_slab, gfp);
>  		if (!tc) {
>  			ret = -ENOMEM;
>  			goto fail;