From: Jakub Kicinski <kuba@kernel.org>
To: Jiayuan Chen <jiayuan.chen@linux.dev>
Cc: horms@kernel.org, bpf@vger.kernel.org, netdev@vger.kernel.org,
andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com,
pabeni@redhat.com, ricardo@marliere.net, viro@zeniv.linux.org.uk,
dmantipov@yandex.ru, aleksander.lobakin@intel.com,
linux-ppp@vger.kernel.org, linux-kernel@vger.kernel.org,
mrpre@163.com,
syzbot+853242d9c9917165d791@syzkaller.appspotmail.com
Subject: Re: [PATCH net-next v4 1/1] ppp: Fix KMSAN warning by initializing 2-byte header
Date: Thu, 27 Feb 2025 17:48:12 -0800 [thread overview]
Message-ID: <20250227174812.50d2eabe@kernel.org> (raw)
In-Reply-To: <20250226013658.891214-2-jiayuan.chen@linux.dev>
On Wed, 26 Feb 2025 09:36:58 +0800 Jiayuan Chen wrote:
> The PPP driver adds an extra 2-byte header to enable socket filters to run
> correctly. However, the driver only initializes the first byte, which
> indicates the direction. For normal BPF programs, this is not a problem
> since they only read the first byte.
>
> Nevertheless, for carefully crafted BPF programs, if they read the second
> byte, this will trigger a KMSAN warning for reading uninitialized data.
>
> Reported-by: syzbot+853242d9c9917165d791@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/bpf/000000000000dea025060d6bc3bc@google.com/
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Could you add:
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
And combine the cover letter with the commit message?
For a single-patch postings cover letter is not necessary.
> + *(__be16 *)skb_push(skb, 2) = htons(PPP_FILTER_OUTBOUND_TAG);
> if (ppp->pass_filter &&
> bpf_prog_run(ppp->pass_filter, skb) == 0) {
> if (ppp->debug & 1)
The exact same problem seems to be present in ppp_receive_nonmp_frame()
please fix them both.
--
pw-bot: cr
next prev parent reply other threads:[~2025-02-28 1:48 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-26 1:36 [PATCH net-next v4 0/1] ppp: Fix KMSAN uninit-value warning with bpf Jiayuan Chen
2025-02-26 1:36 ` [PATCH net-next v4 1/1] ppp: Fix KMSAN warning by initializing 2-byte header Jiayuan Chen
2025-02-28 1:48 ` Jakub Kicinski [this message]
2025-02-28 4:55 ` Jiayuan Chen
2025-02-28 22:02 ` Jakub Kicinski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250227174812.50d2eabe@kernel.org \
--to=kuba@kernel.org \
--cc=aleksander.lobakin@intel.com \
--cc=andrew+netdev@lunn.ch \
--cc=bpf@vger.kernel.org \
--cc=davem@davemloft.net \
--cc=dmantipov@yandex.ru \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=jiayuan.chen@linux.dev \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-ppp@vger.kernel.org \
--cc=mrpre@163.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=ricardo@marliere.net \
--cc=syzbot+853242d9c9917165d791@syzkaller.appspotmail.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).