Commit 7b821da55b3f for kernel

commit 7b821da55b3f88c1703ff2c2074d182295a84f6b
Author: Tabrez Ahmed <tabreztalks@gmail.com>
Date:   Tue Feb 17 19:23:49 2026 +0530

    rds: tcp: fix uninit-value in __inet_bind

    KMSAN reported an uninit-value access in __inet_bind() when binding
    an RDS TCP socket.

    The uninitialized memory originates from rds_tcp_conn_alloc(),
    which uses kmem_cache_alloc() to allocate the rds_tcp_connection structure.

    Specifically, the field 't_client_port_group' is incremented in
    rds_tcp_conn_path_connect() without being initialized first:

        if (++tc->t_client_port_group >= port_groups)

    Since kmem_cache_alloc() does not zero the memory, this field contains
    garbage, leading to the KMSAN report.

    Fix this by using kmem_cache_zalloc() to ensure the structure is
    zero-initialized upon allocation.

    Reported-by: syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=aae646f09192f72a68dc
    Tested-by: syzbot+aae646f09192f72a68dc@syzkaller.appspotmail.com
    Fixes: a20a6992558f ("net/rds: Encode cp_index in TCP source port")

    Signed-off-by: Tabrez Ahmed <tabreztalks@gmail.com>
    Reviewed-by: Charalampos Mitrodimas <charmitro@posteo.net>
    Reviewed-by: Allison Henderson <achender@kernel.org>
    Link: https://patch.msgid.link/20260217135350.33641-1-tabreztalks@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index 45484a93d75f..04f310255692 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -373,7 +373,7 @@ static int rds_tcp_conn_alloc(struct rds_connection *conn, gfp_t gfp)
 	int ret = 0;

 	for (i = 0; i < RDS_MPATH_WORKERS; i++) {
-		tc = kmem_cache_alloc(rds_tcp_conn_slab, gfp);
+		tc = kmem_cache_zalloc(rds_tcp_conn_slab, gfp);
 		if (!tc) {
 			ret = -ENOMEM;
 			goto fail;