CVE-2021-47297

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: fix uninit-value in caif_seqpkt_sendmsg<br /> <br /> When nr_segs equal to zero in iovec_from_user, the object<br /> msg-&gt;msg_iter.iov is uninit stack memory in caif_seqpkt_sendmsg<br /> which is defined in ___sys_sendmsg. So we cann&amp;#39;t just judge<br /> msg-&gt;msg_iter.iov-&gt;base directlly. We can use nr_segs to judge<br /> msg in caif_seqpkt_sendmsg whether has data buffers.<br /> <br /> =====================================================<br /> BUG: KMSAN: uninit-value in caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542<br /> Call Trace:<br /> __dump_stack lib/dump_stack.c:77 [inline]<br /> dump_stack+0x1c9/0x220 lib/dump_stack.c:118<br /> kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118<br /> __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215<br /> caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542<br /> sock_sendmsg_nosec net/socket.c:652 [inline]<br /> sock_sendmsg net/socket.c:672 [inline]<br /> ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2343<br /> ___sys_sendmsg net/socket.c:2397 [inline]<br /> __sys_sendmmsg+0x808/0xc90 net/socket.c:2480<br /> __compat_sys_sendmmsg net/compat.c:656 [inline]