From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: drivers/net/ppp/ppp_synctty.c:469 ppp_sync_txmunge() warn: variable dereferenced before check 'skb' (see line 443)
Date: Sun, 13 Sep 2026 22:27:25 +0200 [thread overview]
Message-ID: <202609132245.txZXoUxc-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Qingfang Deng <qingfang.deng@linux.dev>
CC: Jakub Kicinski <kuba@kernel.org>
CC: Eric Dumazet <edumazet@google.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: d681d7ef617ef83d6a4de36e5cb4418ef602e122
commit: 8aaeb56aff2a557a88f83ae866da2c91ad247e59 ppp_synctty: ensure a writeable skb header
date: 4 days ago
:::::: branch date: 3 hours ago
:::::: commit date: 4 days ago
config: x86_64-randconfig-161-20260913 (https://download.01.org/0day-ci/archive/20260913/202609132245.txZXoUxc-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 8aaeb56aff2a ("ppp_synctty: ensure a writeable skb header")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202609132245.txZXoUxc-lkp@intel.com/
smatch warnings:
drivers/net/ppp/ppp_synctty.c:469 ppp_sync_txmunge() warn: variable dereferenced before check 'skb' (see line 443)
vim +/skb +469 drivers/net/ppp/ppp_synctty.c
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 426
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 427 /*
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 428 * Procedures for encapsulation and framing.
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 429 */
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 430
3c582b30bc2592 drivers/net/ppp_synctty.c Stephen Hemminger 2008-01-23 431 static struct sk_buff*
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 432 ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *skb)
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 433 {
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 434 int proto;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 435 unsigned char *data;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 436 int islcp;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 437
aabc6596ffb377 drivers/net/ppp/ppp_synctty.c Arnaud Lecomte 2025-04-08 438 /* Ensure we can safely access protocol field and LCP code */
aabc6596ffb377 drivers/net/ppp/ppp_synctty.c Arnaud Lecomte 2025-04-08 439 if (!pskb_may_pull(skb, 3)) {
aabc6596ffb377 drivers/net/ppp/ppp_synctty.c Arnaud Lecomte 2025-04-08 440 kfree_skb(skb);
aabc6596ffb377 drivers/net/ppp/ppp_synctty.c Arnaud Lecomte 2025-04-08 441 return NULL;
aabc6596ffb377 drivers/net/ppp/ppp_synctty.c Arnaud Lecomte 2025-04-08 442 }
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 @443 data = skb->data;
96545aeb7b4457 drivers/net/ppp_synctty.c Changli Gao 2011-01-06 444 proto = get_unaligned_be16(data);
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 445
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 446 /* LCP packets with codes between 1 (configure-request)
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 447 * and 7 (code-reject) must be sent as though no options
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 448 * have been negotiated.
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 449 */
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 450 islcp = proto == PPP_LCP && 1 <= data[2] && data[2] <= 7;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 451
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 452 /* compress protocol field if option enabled */
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 453 if (data[0] == 0 && (ap->flags & SC_COMP_PROT) && !islcp)
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 454 skb_pull(skb,1);
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 455
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 456 /* prepend address/control fields if necessary */
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 457 if ((ap->flags & SC_COMP_AC) == 0 || islcp) {
8aaeb56aff2a55 drivers/net/ppp/ppp_synctty.c Qingfang Deng 2026-09-08 458 if (skb_cow_head(skb, 2)) {
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 459 kfree_skb(skb);
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 460 return NULL;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 461 }
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 462 skb_push(skb,2);
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 463 skb->data[0] = PPP_ALLSTATIONS;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 464 skb->data[1] = PPP_UI;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 465 }
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 466
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 467 ap->last_xmit = jiffies;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 468
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 @469 if (skb && ap->flags & SC_LOG_OUTPKT)
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 470 ppp_print_buffer ("send buffer", skb->data, skb->len);
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 471
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 472 return skb;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 473 }
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 474
:::::: The code at line 469 was first introduced by commit
:::::: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Linux-2.6.12-rc2
:::::: TO: Linus Torvalds <torvalds@ppc970.osdl.org>
:::::: CC: Linus Torvalds <torvalds@ppc970.osdl.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-09-13 20:27 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202609132245.txZXoUxc-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.