Return-Path: Received: from mail-pl0-f66.google.com ([209.85.160.66]:46509 "EHLO mail-pl0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755624AbeCHPpV (ORCPT ); Thu, 8 Mar 2018 10:45:21 -0500 Subject: Re: [PATCH] vhost_net: initialize rx_ring in vhost_net_open() To: Alexander Potapenko , Eric Dumazet Cc: Dmitriy Vyukov , jasowang@redhat.com, mst@redhat.com, kvm@vger.kernel.org, Networking References: <20180308133717.149524-1-glider@google.com> <307d6f9e-e308-9d0b-aaac-f3afa65f1164@gmail.com> From: Eric Dumazet Message-ID: <6b2f732a-8565-e4ea-0a33-35c0db5453eb@gmail.com> Date: Thu, 8 Mar 2018 07:45:17 -0800 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: netdev-owner@vger.kernel.org List-ID: On 03/08/2018 07:20 AM, Alexander Potapenko wrote: > On Thu, Mar 8, 2018 at 4:15 PM, Eric Dumazet wrote: >> >> >> On 03/08/2018 05:37 AM, Alexander Potapenko wrote: >>> >>> KMSAN reported a use of uninit memory in vhost_net_buf_unproduce() >>> while trying to access n->vqs[VHOST_NET_VQ_TX].rx_ring: >>> >>> >>> ================================================================== >>> >>> Signed-off-by: Alexander Potapenko >> >> >> Please identify bug origin with a Fixes: tag > Fixes: 5990a30510ed1 ("tun/tap: use ptr_ring instead of skb_array") Please send a V2 with this added tag. patchwork does not recognize it yet. David Miller has also a lot on his plate, please everybody be gentle with both stable teams and maintainers. Thanks. > > The above patch introduced rx_ring, but the problem existed before. > >> This will tremendously help stable teams that are struggling with many >> backports these days. >> >> Thanks. >> >> >>> --- >>> drivers/vhost/net.c | 1 + >>> 1 file changed, 1 insertion(+) >>> >>> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c >>> index 610cba276d47..60f1080bffc7 100644 >>> --- a/drivers/vhost/net.c >>> +++ b/drivers/vhost/net.c >>> @@ -948,6 +948,7 @@ static int vhost_net_open(struct inode *inode, struct >>> file *f) >>> n->vqs[i].done_idx = 0; >>> n->vqs[i].vhost_hlen = 0; >>> n->vqs[i].sock_hlen = 0; >>> + n->vqs[i].rx_ring = NULL; >>> vhost_net_buf_init(&n->vqs[i].rxq); >>> } >>> vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX); >>> >> > > >