KMSAN reported an uninit-value access in __inet_bind() when binding an RDS TCP socket.
The uninitialized memory originates from rds_tcp_conn_alloc(), which uses kmem_cache_alloc() to allocate the rds_tcp_connection structure.

The structure is not zero-initialized, leaving random data in its fields.
When the networking stack later tries to bind the socket using these dirty values, KMSAN flags the uninitialized access.

Fix this by using kmem_cache_zalloc() instead of kmem_cache_alloc() to ensure the structure is zeroed out upon allocation.

Reported-by: syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=aae646f09192f72a68dc
Tested-by: syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com
Fixes: 70041088e3b9 ("RDS: Add TCP transport to RDS")

Signed-off-by: Tabrez Ahmed <tabreztalks@gmail.com>
---
This is my first patch. Any feedback is appreciated!

 net/rds/tcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index 45484a93d75f..04f310255692 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -373,7 +373,7 @@ static int rds_tcp_conn_alloc(struct rds_connection *conn, gfp_t gfp)
 	int ret = 0;
 
 	for (i = 0; i < RDS_MPATH_WORKERS; i++) {
-		tc = kmem_cache_alloc(rds_tcp_conn_slab, gfp);
+		tc = kmem_cache_zalloc(rds_tcp_conn_slab, gfp);
 		if (!tc) {
 			ret = -ENOMEM;
 			goto fail;
-- 
2.43.0

Tabrez Ahmed <tabreztalks@gmail.com> writes:

> KMSAN reported an uninit-value access in __inet_bind() when binding an RDS TCP socket.
> The uninitialized memory originates from rds_tcp_conn_alloc(), which uses kmem_cache_alloc() to allocate the rds_tcp_connection structure.
>
> The structure is not zero-initialized, leaving random data in its fields.
> When the networking stack later tries to bind the socket using these dirty values, KMSAN flags the uninitialized access.

Most fields in rds_tcp_connection are explicitly initialized after
allocation right? The only field actually read before being written is
t_client_port_group. Could the description be more specific about which
field is problematic?

>
> Fix this by using kmem_cache_zalloc() instead of kmem_cache_alloc() to ensure the structure is zeroed out upon allocation.
>
> Reported-by: syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=aae646f09192f72a68dc
> Tested-by: syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com
> Fixes: 70041088e3b9 ("RDS: Add TCP transport to RDS")

Not sure about this, the field trigger this bug, t_client_port_group,
did not exist in 70041088e3b9. It was introduced in

  a20a6992558f ("net/rds: Encode cp_index in TCP source port")

which added both the field and the code in rds_tcp_conn_path_connect()
that reads it uninitialized:

     if (++tc->t_client_port_group >= port_groups)

Should the Fixes that reference that instead? If I'm correct ofc.

Also, nit, commit message body should not exceed 75 characters.

>
> Signed-off-by: Tabrez Ahmed <tabreztalks@gmail.com>
> ---
> This is my first patch. Any feedback is appreciated!

Best of luck.

>
>  net/rds/tcp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/rds/tcp.c b/net/rds/tcp.c
> index 45484a93d75f..04f310255692 100644
> --- a/net/rds/tcp.c
> +++ b/net/rds/tcp.c
> @@ -373,7 +373,7 @@ static int rds_tcp_conn_alloc(struct rds_connection *conn, gfp_t gfp)
>  	int ret = 0;
>  
>  	for (i = 0; i < RDS_MPATH_WORKERS; i++) {
> -		tc = kmem_cache_alloc(rds_tcp_conn_slab, gfp);
> +		tc = kmem_cache_zalloc(rds_tcp_conn_slab, gfp);
>  		if (!tc) {
>  			ret = -ENOMEM;
>  			goto fail;

On Sun, 2026-02-15 at 17:41 +0000, Charalampos Mitrodimas wrote:
> Tabrez Ahmed <tabreztalks@gmail.com> writes:
> 
> > KMSAN reported an uninit-value access in __inet_bind() when binding an RDS TCP socket.
> > The uninitialized memory originates from rds_tcp_conn_alloc(), which uses kmem_cache_alloc() to allocate the rds_tcp_connection structure.
> > 
> > The structure is not zero-initialized, leaving random data in its fields.
> > When the networking stack later tries to bind the socket using these dirty values, KMSAN flags the uninitialized access.
> 
> Most fields in rds_tcp_connection are explicitly initialized after
> allocation right? The only field actually read before being written is
> t_client_port_group. Could the description be more specific about which
> field is problematic?
> 
> > 
> > Fix this by using kmem_cache_zalloc() instead of kmem_cache_alloc() to ensure the structure is zeroed out upon allocation.
> > 
> > Reported-by: syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com
> > Closes: https://urldefense.com/v3/__https://syzkaller.appspot.com/bug?extid=aae646f09192f72a68dc__;!!ACWV5N9M2RV99hQ!KoKKYUMFU_9oAjpHdsa5rdaZD49xN5sWBnJWB0ltbYSLuAcndfD5Gg7kVLco-RW3ex_MUxZrtd_yK2L7V9jRbD9j$ 
> > Tested-by: syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com
> > Fixes: 70041088e3b9 ("RDS: Add TCP transport to RDS")
> 
> Not sure about this, the field trigger this bug, t_client_port_group,
> did not exist in 70041088e3b9. It was introduced in
> 
>   a20a6992558f ("net/rds: Encode cp_index in TCP source port")
> 
> which added both the field and the code in rds_tcp_conn_path_connect()
> that reads it uninitialized:
> 
>      if (++tc->t_client_port_group >= port_groups)
> 
> Should the Fixes that reference that instead? If I'm correct ofc.
> 
> Also, nit, commit message body should not exceed 75 characters.

Hi Tabrez,

Thanks for catching this.  Charalampos is correct in that t_client_port_group member was recently added in Commit
a20a6992558f ("net/rds: Encode cp_index in TCP source port"). So that would be the appropriate tag.  The uninitialized
reference in rds_tcp_conn_path_connect is consistent with the syzkaller backtrace.  So a quick mention of it in the
commit message would be appropriate.  Thank you!

Allison

> 
> > 
> > Signed-off-by: Tabrez Ahmed <tabreztalks@gmail.com>
> > ---
> > This is my first patch. Any feedback is appreciated!
> 
> Best of luck.
> 
> > 
> >  net/rds/tcp.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/net/rds/tcp.c b/net/rds/tcp.c
> > index 45484a93d75f..04f310255692 100644
> > --- a/net/rds/tcp.c
> > +++ b/net/rds/tcp.c
> > @@ -373,7 +373,7 @@ static int rds_tcp_conn_alloc(struct rds_connection *conn, gfp_t gfp)
> >  	int ret = 0;
> >  
> >  	for (i = 0; i < RDS_MPATH_WORKERS; i++) {
> > -		tc = kmem_cache_alloc(rds_tcp_conn_slab, gfp);
> > +		tc = kmem_cache_zalloc(rds_tcp_conn_slab, gfp);
> >  		if (!tc) {
> >  			ret = -ENOMEM;
> >  			goto fail;