Re: [PATCH net v2] rds: tcp: fix uninit-value in __inet_bind
From: Allison Henderson <hidden>
Date: 2026-02-18 04:20:19
Also in:
linux-rdma, lkml
On Tue, 2026-02-17 at 19:23 +0530, Tabrez Ahmed wrote:
KMSAN reported an uninit-value access in __inet_bind() when binding
an RDS TCP socket.
The uninitialized memory originates from rds_tcp_conn_alloc(),
which uses kmem_cache_alloc() to allocate the rds_tcp_connection structure.
Specifically, the field 't_client_port_group' is incremented in
rds_tcp_conn_path_connect() without being initialized first:
if (++tc->t_client_port_group >= port_groups)
Since kmem_cache_alloc() does not zero the memory, this field contains
garbage, leading to the KMSAN report.
Fix this by using kmem_cache_zalloc() to ensure the structure is
zero-initialized upon allocation.
Reported-by: syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com
Closes: https://urldefense.com/v3/__https://syzkaller.appspot.com/bug?extid=aae646f09192f72a68dc__;!!ACWV5N9M2RV99hQ!KzzjhqabhC2dy_AOmRK4QHF3FILzGR2FxPlBFUOY6bjNqwGNvvtgnZXhnab3n-7b79hRhEkCBy86Zpzts1dzLrHgWg$
Tested-by: syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com
Fixes: a20a6992558f ("net/rds: Encode cp_index in TCP source port")
Signed-off-by: Tabrez Ahmed <redacted>This looks good to me. Thanks Tabrez. Reviewed-by: Allison Henderson <achender@kernel.org>
quoted hunk ↗ jump to hunk
--- v2: - Updated Fixes tag to point to commit a20a6992558f as requested by Charalampos Mitrodimas and Allison Henderson. - Explicitly mentioned 't_client_port_group' in the commit message. - Fixed line wrapping to be under 75 characters. net/rds/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/net/rds/tcp.c b/net/rds/tcp.c index 45484a93d75f..04f310255692 100644 --- a/net/rds/tcp.c +++ b/net/rds/tcp.c@@ -373,7 +373,7 @@ static int rds_tcp_conn_alloc(struct rds_connection *conn, gfp_t gfp) int ret = 0; for (i = 0; i < RDS_MPATH_WORKERS; i++) { - tc = kmem_cache_alloc(rds_tcp_conn_slab, gfp); + tc = kmem_cache_zalloc(rds_tcp_conn_slab, gfp); if (!tc) { ret = -ENOMEM; goto fail;