xfrm6: fix uninitialized saddr in xfrm6_get_saddr()

[PATCH net-next v1] xfrm6: fix uninitialized saddr in xfrm6_get_saddr()

Posted by Jiayuan Chen 1 week, 4 days ago

From: Jiayuan Chen <jiayuan.chen@shopee.com>

xfrm6_get_saddr() does not check the return value of
ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable
source address (returns -EADDRNOTAVAIL), saddr->in6 is left
uninitialized, but xfrm6_get_saddr() still returns 0 (success).

This causes the caller xfrm_tmpl_resolve_one() to use the uninitialized
address in xfrm_state_find(), triggering KMSAN warning:

=====================================================
BUG: KMSAN: uninit-value in xfrm_state_find+0x2424/0xa940
 xfrm_state_find+0x2424/0xa940
 xfrm_resolve_and_create_bundle+0x906/0x5a20
 xfrm_lookup_with_ifid+0xcc0/0x3770
 xfrm_lookup_route+0x63/0x2b0
 ip_route_output_flow+0x1ce/0x270
 udp_sendmsg+0x2ce1/0x3400
 inet_sendmsg+0x1ef/0x2a0
 __sock_sendmsg+0x278/0x3d0
 __sys_sendto+0x593/0x720
 __x64_sys_sendto+0x130/0x200
 x64_sys_call+0x332b/0x3e70
 do_syscall_64+0xd3/0xf80
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable tmp.i.i created at:
 xfrm_resolve_and_create_bundle+0x3e3/0x5a20
 xfrm_lookup_with_ifid+0xcc0/0x3770
=====================================================

Fix by checking the return value of ipv6_dev_get_saddr() and propagating
the error.

Fixes: a1e59abf8249 ("[XFRM]: Fix wildcard as tunnel source")
Reported-by: syzbot+e136d86d34b42399a8b1@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68bf1024.a70a0220.7a912.02c2.GAE@google.com/T/
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 net/ipv6/xfrm6_policy.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 1f19b6f14484..125ea9a5b8a0 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -57,6 +57,7 @@ static int xfrm6_get_saddr(xfrm_address_t *saddr,
 	struct dst_entry *dst;
 	struct net_device *dev;
 	struct inet6_dev *idev;
+	int err;
 
 	dst = xfrm6_dst_lookup(params);
 	if (IS_ERR(dst))
@@ -68,9 +69,11 @@ static int xfrm6_get_saddr(xfrm_address_t *saddr,
 		return -EHOSTUNREACH;
 	}
 	dev = idev->dev;
-	ipv6_dev_get_saddr(dev_net(dev), dev, &params->daddr->in6, 0,
-			   &saddr->in6);
+	err = ipv6_dev_get_saddr(dev_net(dev), dev, &params->daddr->in6, 0,
+				 &saddr->in6);
 	dst_release(dst);
+	if (err)
+		return -EHOSTUNREACH;
 	return 0;
 }
 
-- 
2.43.0

Re: [PATCH net-next v1] xfrm6: fix uninitialized saddr in xfrm6_get_saddr()

Posted by Steffen Klassert 2 days, 4 hours ago

On Tue, Jan 27, 2026 at 07:38:44PM +0800, Jiayuan Chen wrote:
> From: Jiayuan Chen <jiayuan.chen@shopee.com>
> 
> xfrm6_get_saddr() does not check the return value of
> ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable
> source address (returns -EADDRNOTAVAIL), saddr->in6 is left
> uninitialized, but xfrm6_get_saddr() still returns 0 (success).
> 
> This causes the caller xfrm_tmpl_resolve_one() to use the uninitialized
> address in xfrm_state_find(), triggering KMSAN warning:
> 
> =====================================================
> BUG: KMSAN: uninit-value in xfrm_state_find+0x2424/0xa940
>  xfrm_state_find+0x2424/0xa940
>  xfrm_resolve_and_create_bundle+0x906/0x5a20
>  xfrm_lookup_with_ifid+0xcc0/0x3770
>  xfrm_lookup_route+0x63/0x2b0
>  ip_route_output_flow+0x1ce/0x270
>  udp_sendmsg+0x2ce1/0x3400
>  inet_sendmsg+0x1ef/0x2a0
>  __sock_sendmsg+0x278/0x3d0
>  __sys_sendto+0x593/0x720
>  __x64_sys_sendto+0x130/0x200
>  x64_sys_call+0x332b/0x3e70
>  do_syscall_64+0xd3/0xf80
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Local variable tmp.i.i created at:
>  xfrm_resolve_and_create_bundle+0x3e3/0x5a20
>  xfrm_lookup_with_ifid+0xcc0/0x3770
> =====================================================
> 
> Fix by checking the return value of ipv6_dev_get_saddr() and propagating
> the error.
> 
> Fixes: a1e59abf8249 ("[XFRM]: Fix wildcard as tunnel source")
> Reported-by: syzbot+e136d86d34b42399a8b1@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68bf1024.a70a0220.7a912.02c2.GAE@google.com/T/
> Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>

Applied, thanks a lot!

Re: [PATCH net-next v1] xfrm6: fix uninitialized saddr in xfrm6_get_saddr()

Posted by Simon Horman 1 week, 2 days ago

On Tue, Jan 27, 2026 at 07:38:44PM +0800, Jiayuan Chen wrote:
> From: Jiayuan Chen <jiayuan.chen@shopee.com>
> 
> xfrm6_get_saddr() does not check the return value of
> ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable
> source address (returns -EADDRNOTAVAIL), saddr->in6 is left
> uninitialized, but xfrm6_get_saddr() still returns 0 (success).
> 
> This causes the caller xfrm_tmpl_resolve_one() to use the uninitialized
> address in xfrm_state_find(), triggering KMSAN warning:
> 
> =====================================================
> BUG: KMSAN: uninit-value in xfrm_state_find+0x2424/0xa940
>  xfrm_state_find+0x2424/0xa940
>  xfrm_resolve_and_create_bundle+0x906/0x5a20
>  xfrm_lookup_with_ifid+0xcc0/0x3770
>  xfrm_lookup_route+0x63/0x2b0
>  ip_route_output_flow+0x1ce/0x270
>  udp_sendmsg+0x2ce1/0x3400
>  inet_sendmsg+0x1ef/0x2a0
>  __sock_sendmsg+0x278/0x3d0
>  __sys_sendto+0x593/0x720
>  __x64_sys_sendto+0x130/0x200
>  x64_sys_call+0x332b/0x3e70
>  do_syscall_64+0xd3/0xf80
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Local variable tmp.i.i created at:
>  xfrm_resolve_and_create_bundle+0x3e3/0x5a20
>  xfrm_lookup_with_ifid+0xcc0/0x3770
> =====================================================
> 
> Fix by checking the return value of ipv6_dev_get_saddr() and propagating
> the error.
> 
> Fixes: a1e59abf8249 ("[XFRM]: Fix wildcard as tunnel source")
> Reported-by: syzbot+e136d86d34b42399a8b1@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68bf1024.a70a0220.7a912.02c2.GAE@google.com/T/
> Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>

Reviewed-by: Simon Horman <horms@kernel.org>