Patch "io_uring/net: always initialize kmsg->msg.msg_inq upfront" has been added to the 6.12-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    io_uring/net: always initialize kmsg->msg.msg_inq upfront

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     io_uring-net-always-initialize-kmsg-msg.msg_inq-upfr.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d6f148858b3a93e8df54ec2998f4691033965770
Author: Jens Axboe <axboe@xxxxxxxxx>
Date:   Thu Jan 2 16:32:51 2025 -0700

    io_uring/net: always initialize kmsg->msg.msg_inq upfront
    
    [ Upstream commit c6e60a0a68b7e6b3c7e33863a16e8e88ba9eee6f ]
    
    syzbot reports that ->msg_inq may get used uinitialized from the
    following path:
    
    BUG: KMSAN: uninit-value in io_recv_buf_select io_uring/net.c:1094 [inline]
    BUG: KMSAN: uninit-value in io_recv+0x930/0x1f90 io_uring/net.c:1158
     io_recv_buf_select io_uring/net.c:1094 [inline]
     io_recv+0x930/0x1f90 io_uring/net.c:1158
     io_issue_sqe+0x420/0x2130 io_uring/io_uring.c:1740
     io_queue_sqe io_uring/io_uring.c:1950 [inline]
     io_req_task_submit+0xfa/0x1d0 io_uring/io_uring.c:1374
     io_handle_tw_list+0x55f/0x5c0 io_uring/io_uring.c:1057
     tctx_task_work_run+0x109/0x3e0 io_uring/io_uring.c:1121
     tctx_task_work+0x6d/0xc0 io_uring/io_uring.c:1139
     task_work_run+0x268/0x310 kernel/task_work.c:239
     io_run_task_work+0x43a/0x4a0 io_uring/io_uring.h:343
     io_cqring_wait io_uring/io_uring.c:2527 [inline]
     __do_sys_io_uring_enter io_uring/io_uring.c:3439 [inline]
     __se_sys_io_uring_enter+0x204f/0x4ce0 io_uring/io_uring.c:3330
     __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3330
     x64_sys_call+0xce5/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:427
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    
    and it is correct, as it's never initialized upfront. Hence the first
    submission can end up using it uninitialized, if the recv wasn't
    successful and the networking stack didn't honor ->msg_get_inq being set
    and filling in the output value of ->msg_inq as requested.
    
    Set it to 0 upfront when it's allocated, just to silence this KMSAN
    warning. There's no side effect of using it uninitialized, it'll just
    potentially cause the next receive to use a recv value hint that's not
    accurate.
    
    Fixes: c6f32c7d9e09 ("io_uring/net: get rid of ->prep_async() for receive side")
    Reported-by: syzbot+068ff190354d2f74892f@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/io_uring/net.c b/io_uring/net.c
index 18507658a921..7f549be9abd1 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -748,6 +748,7 @@ static int io_recvmsg_prep_setup(struct io_kiocb *req)
 	if (req->opcode == IORING_OP_RECV) {
 		kmsg->msg.msg_name = NULL;
 		kmsg->msg.msg_namelen = 0;
+		kmsg->msg.msg_inq = 0;
 		kmsg->msg.msg_control = NULL;
 		kmsg->msg.msg_get_inq = 1;
 		kmsg->msg.msg_controllen = 0;