Re: [PATCHv2 net] tipc: check msg->req data len in tipc_nl_compat_bearer_disable

2019-06-24 Thread David Miller
From: Xin Long Date: Tue, 25 Jun 2019 00:28:19 +0800 > This patch is to fix an uninit-value issue, reported by syzbot: ... > TLV_GET_DATA_LEN() may return a negtive int value, which will be > used as size_t (becoming a big unsigned long) passed into memchr, > cause this issue. > > Similar to wh

[PATCHv2 net] tipc: check msg->req data len in tipc_nl_compat_bearer_disable

2019-06-24 Thread Xin Long
This patch is to fix an uninit-value issue, reported by syzbot: BUG: KMSAN: uninit-value in memchr+0xce/0x110 lib/string.c:981 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x191/0x1f0 lib/dump_stack.c:113 kmsan_report+0x130/0x2a0 mm/kmsan/kmsan.c:622 __msan_