[PATCH] Bluetooth: 6lowpan: fix uninit-value read in bt_xmit()

[PATCH] Bluetooth: 6lowpan: fix uninit-value read in bt_xmit()

[Jiale Yao]

The bt_xmit() function lacks the skb->protocol check for IPv6 packets
that commit 3a5f3f7aff18 ("ieee802154: 6lowpan: only accept IPv6 packets
in lowpan_xmit()") added to the parallel IEEE 802.15.4 path.

A non-IPv6 packet (e.g. ETH_P_AOE) queued on a Bluetooth 6LoWPAN netdev
reaches setup_header(), which unconditionally treats the skb as IPv6 and
reads 16 bytes of uninitialized memory, causing a KMSAN uninit-value bug.

Add the missing protocol check to reject non-IPv6 packets before they
reach setup_header().

Fixes: 3a5f3f7aff18bcc36a57839cf50cf0cc8de707f3 ("ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 net/bluetooth/6lowpan.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index d504a363a30f..5729c6fbaf15 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -524,6 +524,11 @@ static netdev_tx_t bt_xmit(struct sk_buff *skb, struct net_device *netdev)
 	 *   0 - this is a multicast packet
 	 *   1 - this is unicast packet
 	 */
+	if (skb->protocol != htons(ETH_P_IPV6)) {
+		kfree_skb(skb);
+		return NET_XMIT_DROP;
+	}
+
 	err = setup_header(skb, netdev, &addr, &addr_type);
 	if (err < 0) {
 		kfree_skb(skb);
-- 
2.34.1

RE: Bluetooth: 6lowpan: fix uninit-value read in bt_xmit()

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1235 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1126105

---Test result---

Test Summary:
CheckPatch                    PASS      0.74 seconds
VerifyFixes                   PASS      0.13 seconds
VerifySignedoff               PASS      0.13 seconds
GitLint                       PASS      0.33 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      26.79 seconds
CheckAllWarning               PASS      29.29 seconds
CheckSparse                   PASS      28.03 seconds
BuildKernel32                 PASS      25.95 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      495.86 seconds
TestRunner_6lowpan-tester     PASS      22.76 seconds
IncrementalBuild              PASS      24.90 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/427

---
Regards,
Linux Bluetooth