From: Pritesh Rodge The rose_add_node() function uses kmalloc to allocate a new rose_node but only initializes the first element of the 'neighbour' array. If the node's count is later incremented, other parts of the kernel may access the uninitialized pointers in the array. This was discovered by KMSAN, which reported a crash in __run_timer_base. When a timer tried to clean up a resource using one of these garbage pointers. Fix this by switching from kmalloc() to kzalloc() to ensure the entire rose_node struct is initialized to zero upon allocation. This sets all unused neighbour pointers to NULL. [1] https://syzkaller.appspot.com/bug?extid=7d660d9b8bd5efc7ee6e Reported-by: syzbot+7d660d9b8bd5efc7ee6e@syzkaller.appspotmail.com Signed-off-by: Pritesh Rodge --- net/rose/rose_route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c index a1e9b05ef6f5..6ca41cbe867a 100644 --- a/net/rose/rose_route.c +++ b/net/rose/rose_route.c @@ -148,7 +148,7 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route, } /* create new node */ - rose_node = kmalloc(sizeof(*rose_node), GFP_ATOMIC); + rose_node = kzalloc(sizeof(*rose_node), GFP_ATOMIC); if (rose_node == NULL) { res = -ENOMEM; goto out; -- 2.43.0