Eric Dumazet e195e9b5de net, neigh: clear whole pneigh_entry at alloc time ... Commit 2c611ad97a ("net, neigh: Extend neigh->flags to 32 bit to allow for extensions") enables a new KMSAM warning [1] I think the bug is actually older, because the following intruction only occurred if ndm->ndm_flags had NTF_PROXY set. pn->flags = ndm->ndm_flags; Let's clear all pneigh_entry fields at alloc time. [1] BUG: KMSAN: uninit-value in pneigh_fill_info+0x986/0xb30 net/core/neighbour.c:2593 pneigh_fill_info+0x986/0xb30 net/core/neighbour.c:2593 pneigh_dump_table net/core/neighbour.c:2715 [inline] neigh_dump_info+0x1e3f/0x2c60 net/core/neighbour.c:2832 netlink_dump+0xaca/0x16a0 net/netlink/af_netlink.c:2265 __netlink_dump_start+0xd1c/0xee0 net/netlink/af_netlink.c:2370 netlink_dump_start include/linux/netlink.h:254 [inline] rtnetlink_rcv_msg+0x181b/0x18c0 net/core/rtnetlink.c:5534 netlink_rcv_skb+0x447/0x800 net/netlink/af_netlink.c:2491 rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5589 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x1095/0x1360 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x16f3/0x1870 net/netlink/af_netlink.c:1916 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg net/socket.c:724 [inline] sock_write_iter+0x594/0x690 net/socket.c:1057 call_write_iter include/linux/fs.h:2162 [inline] new_sync_write fs/read_write.c:503 [inline] vfs_write+0x1318/0x2030 fs/read_write.c:590 ksys_write+0x28c/0x520 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] slab_alloc mm/slub.c:3259 [inline] __kmalloc+0xc3c/0x12d0 mm/slub.c:4437 kmalloc include/linux/slab.h:595 [inline] pneigh_lookup+0x60f/0xd70 net/core/neighbour.c:766 arp_req_set_public net/ipv4/arp.c:1016 [inline] arp_req_set+0x430/0x10a0 net/ipv4/arp.c:1032 arp_ioctl+0x8d4/0xb60 net/ipv4/arp.c:1232 inet_ioctl+0x4ef/0x820 net/ipv4/af_inet.c:947 sock_do_ioctl net/socket.c:1118 [inline] sock_ioctl+0xa3f/0x13e0 net/socket.c:1235 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0x2df/0x4a0 fs/ioctl.c:860 __x64_sys_ioctl+0xd8/0x110 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae CPU: 1 PID: 20001 Comm: syz-executor.0 Not tainted 5.16.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: 62dd93181a ("[IPV6] NDISC: Set per-entry is_router flag in Proxy NA.") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Roopa Prabhu <roopa@nvidia.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://lore.kernel.org/r/20211206165329.1049835-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2021-12-08 17:41:44 -08:00
..
bpf_sk_storage.c	net: in_irq() cleanup	2021-08-13 14:09:19 -07:00
datagram.c	net: avoid double accounting for pure zerocopy skbs	2021-11-03 11:19:49 +00:00
datagram.h
dev.c	net: annotate data-races on txq->xmit_lock_owner	2021-12-01 19:14:26 -08:00
dev_addr_lists.c	net: dev_addr_list: handle first address in __hw_addr_add_ex	2021-09-30 13:29:09 +01:00
dev_ioctl.c	ethtool: push the rtnl_lock into dev_ethtool()	2021-11-01 13:26:07 +00:00
devlink.c	devlink: fix netns refcount leak in devlink_nl_cmd_reload()	2021-12-06 16:56:32 -08:00
drop_monitor.c	net: Remove redundant if statements	2021-08-05 13:27:50 +01:00
dst.c	net: Remove redundant if statements	2021-08-05 13:27:50 +01:00
dst_cache.c	wireguard: device: reset peer src endpoint when netns exits	2021-11-29 19:50:45 -08:00
failover.c
fib_notifier.c
fib_rules.c	ipv6: fix memory leak in fib6_rule_suppress	2021-11-29 14:43:35 +00:00
filter.c	bpf: Forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs	2021-11-15 20:35:58 -08:00
flow_dissector.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-11-01 20:05:14 -07:00
flow_offload.c	net: Fix offloading indirect devices dependency on qdisc order creation	2021-08-19 13:19:30 +01:00
gen_estimator.c	net: sched: Remove Qdisc::running sequence counter	2021-10-18 12:54:41 +01:00
gen_stats.c	net: stats: Read the statistics in ___gnet_stats_copy_basic() instead of adding.	2021-10-21 12:47:56 +01:00
gro_cells.c	gro_cells: reduce number of synchronize_net() calls	2020-11-25 11:28:12 -08:00
hwbm.c
link_watch.c	net: linkwatch: fix failure to restore device state across suspend/resume	2021-08-11 14:43:16 -07:00
lwt_bpf.c	lwt_bpf: Replace preempt_disable() with migrate_disable()	2020-12-07 11:53:40 -08:00
lwtunnel.c	netfilter: add netfilter hooks to SRv6 data plane	2021-08-30 01:51:36 +02:00
Makefile	of: net: move of_net under net/	2021-10-07 13:39:51 +01:00
neighbour.c	net, neigh: clear whole pneigh_entry at alloc time	2021-12-08 17:41:44 -08:00
net-procfs.c	Revert "net: procfs: add seq_puts() statement for dev_mcast"	2021-10-13 17:24:38 -07:00
net-sysfs.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-10-28 10:43:58 -07:00
net-sysfs.h	net-sysfs: add netdev_change_owner()	2020-02-26 20:07:25 -08:00
net-traces.c	tcp: add tracepoint for checksum errors	2021-05-14 15:26:03 -07:00
net_namespace.c	net: net_namespace: Fix undefined member in key_remove_domain()	2021-09-19 12:43:04 +01:00
netclassid_cgroup.c	bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode	2021-09-13 16:35:58 -07:00
netevent.c	net: core: Correct function name netevent_unregister_notifier() in the kerneldoc	2021-03-28 17:56:56 -07:00
netpoll.c	asm-generic/unaligned: Unify asm/unaligned.h around struct helper	2021-07-02 12:43:40 -07:00
netprio_cgroup.c	bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode	2021-09-13 16:35:58 -07:00
of_net.c	of: net: add a helper for loading netdev->dev_addr	2021-10-07 13:39:51 +01:00
page_pool.c	page_pool: Revert "page_pool: disable dma mapping support..."	2021-11-18 11:29:40 +00:00
pktgen.c	pktgen: remove unused variable	2021-09-03 11:48:28 +01:00
ptp_classifier.c	bpf: Refactor BPF_PROG_RUN into a function	2021-08-17 00:45:07 +02:00
request_sock.c
rtnetlink.c	net: rtnetlink: use __dev_addr_set()	2021-10-24 13:59:44 +01:00
scm.c	memcg: enable accounting for scm_fp_list objects	2021-07-20 06:00:38 -07:00
secure_seq.c	crypto: lib/sha1 - remove unnecessary includes of linux/cryptohash.h	2020-05-08 15:32:17 +10:00
selftests.c	net: core: constify mac addrs in selftests	2021-10-24 13:59:44 +01:00
skbuff.c	net: avoid double accounting for pure zerocopy skbs	2021-11-03 11:19:49 +00:00
skmsg.c	bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap	2021-11-20 00:56:24 +01:00
sock.c	sock: fix /proc/net/sockstat underflow in sk_clone_lock()	2021-11-15 14:27:39 +00:00
sock_destructor.h	skb_expand_head() adjust skb->truesize incorrectly	2021-10-22 12:35:51 -07:00
sock_diag.c	bpf, net: Rework cookie generator as per-cpu one	2020-09-30 11:50:35 -07:00
sock_map.c	bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap	2021-11-20 00:56:24 +01:00
sock_reuseport.c	tcp: Add stats for socket migration.	2021-06-23 12:56:08 -07:00
stream.c	net: stream: don't purge sk_error_queue in sk_stream_kill_queues()	2021-10-16 09:06:09 +01:00
sysctl_net_core.c	bpf: Prevent increasing bpf_jit_limit above max	2021-10-22 17:23:53 -07:00
timestamping.c
tso.c	net: tso: add UDP segmentation support	2020-06-18 20:46:23 -07:00
utils.c
xdp.c	xdp: Remove redundant warning	2021-10-27 18:13:57 -07:00