From: Simon Horman <horms@kernel.org>
To: Shigeru Yoshida <syoshida@redhat.com>
Cc: davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
pabeni@redhat.com, linux-ppp@vger.kernel.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH net] tty: Fix uninit-value access in ppp_sync_receive()
Date: Thu, 9 Nov 2023 16:48:38 -0500 [thread overview]
Message-ID: <20231109214838.GB568506@kernel.org> (raw)
In-Reply-To: <20231108154420.1474853-1-syoshida@redhat.com>
On Thu, Nov 09, 2023 at 12:44:20AM +0900, Shigeru Yoshida wrote:
> KMSAN reported the following uninit-value access issue:
>
> =====================================================
> BUG: KMSAN: uninit-value in ppp_sync_input drivers/net/ppp/ppp_synctty.c:690 [inline]
> BUG: KMSAN: uninit-value in ppp_sync_receive+0xdc9/0xe70 drivers/net/ppp/ppp_synctty.c:334
> ppp_sync_input drivers/net/ppp/ppp_synctty.c:690 [inline]
> ppp_sync_receive+0xdc9/0xe70 drivers/net/ppp/ppp_synctty.c:334
> tiocsti+0x328/0x450 drivers/tty/tty_io.c:2295
> tty_ioctl+0x808/0x1920 drivers/tty/tty_io.c:2694
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:871 [inline]
> __se_sys_ioctl+0x211/0x400 fs/ioctl.c:857
> __x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:857
> do_syscall_x64 arch/x86/entry/common.c:51 [inline]
> do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
> entry_SYSCALL_64_after_hwframe+0x63/0x6b
>
> Uninit was created at:
> __alloc_pages+0x75d/0xe80 mm/page_alloc.c:4591
> __alloc_pages_node include/linux/gfp.h:238 [inline]
> alloc_pages_node include/linux/gfp.h:261 [inline]
> __page_frag_cache_refill+0x9a/0x2c0 mm/page_alloc.c:4691
> page_frag_alloc_align+0x91/0x5d0 mm/page_alloc.c:4722
> page_frag_alloc include/linux/gfp.h:322 [inline]
> __netdev_alloc_skb+0x215/0x6d0 net/core/skbuff.c:728
> netdev_alloc_skb include/linux/skbuff.h:3225 [inline]
> dev_alloc_skb include/linux/skbuff.h:3238 [inline]
> ppp_sync_input drivers/net/ppp/ppp_synctty.c:669 [inline]
> ppp_sync_receive+0x237/0xe70 drivers/net/ppp/ppp_synctty.c:334
> tiocsti+0x328/0x450 drivers/tty/tty_io.c:2295
> tty_ioctl+0x808/0x1920 drivers/tty/tty_io.c:2694
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:871 [inline]
> __se_sys_ioctl+0x211/0x400 fs/ioctl.c:857
> __x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:857
> do_syscall_x64 arch/x86/entry/common.c:51 [inline]
> do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
> entry_SYSCALL_64_after_hwframe+0x63/0x6b
>
> CPU: 0 PID: 12950 Comm: syz-executor.1 Not tainted 6.6.0-14500-g1c41041124bd #10
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014
> =====================================================
>
> ppp_sync_input() checks the first 2 bytes of the data are PPP_ALLSTATIONS
> and PPP_UI. However, if the data length is 1 and the first byte is
> PPP_ALLSTATIONS, an access to an uninitialized value occurs when checking
> PPP_UI. This patch resolves this issue by checking the data length.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
next prev parent reply other threads:[~2023-11-09 21:48 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-08 15:44 [PATCH net] tty: Fix uninit-value access in ppp_sync_receive() Shigeru Yoshida
2023-11-09 21:48 ` Simon Horman [this message]
2023-11-10 11:10 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231109214838.GB568506@kernel.org \
--to=horms@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-ppp@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syoshida@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.