Re: [PATCH net v3] net: atm: implement pre_send to check input before sending

[Simon Horman <horms@kernel.org>]

+ Dharanitharan

On Thu, Dec 04, 2025 at 07:17:22PM +0800, Edward Adam Davis wrote:
> syzbot found an uninitialized targetless variable. The user-provided
> data was only 28 bytes long, but initializing targetless requires at
> least 44 bytes. This discrepancy ultimately led to the uninitialized
> variable access issue reported by syzbot [1].
> 
> Besides the issues reported by syzbot regarding targetless messages
> [1], similar problems exist in other types of messages as well. We will
> uniformly add input data checks to pre_send to prevent uninitialized
> issues from recurring.
> 
> Additionally, for cases where sizeoftlvs is greater than 0, the skb
> requires more memory, and this will also be checked.
> 
> [1]
> BUG: KMSAN: uninit-value in lec_arp_update net/atm/lec.c:1845 [inline]
>  lec_arp_update net/atm/lec.c:1845 [inline]
>  lec_atm_send+0x2b02/0x55b0 net/atm/lec.c:385
>  vcc_sendmsg+0x1052/0x1190 net/atm/common.c:650
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+5dd615f890ddada54057@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=5dd615f890ddada54057
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
> v3:
>   - update coding style and practices
> v2: https://lore.kernel.org/all/tencent_E83074AB763967783C9D36949674363C4A09@qq.com/
>   - update subject and comments for pre_send
> v1: https://lore.kernel.org/all/tencent_B31D1B432549BA28BB5633CB9E2C1B124B08@qq.com

FTR, a similar patch has been posted by Dharanitharan (CCed)

- [PATCH v3] net: atm: lec: add pre_send validation to avoid uninitialized
  https://lore.kernel.org/all/20251210035354.17492-2-dharanitharan725@gmail.com/

The main difference between that patch and this one is
a check for msg_size being present in linear data.

I would appreciate some collaboration between the authors of these patches.

Thanks!

-- 
pw-bot: changes-requested