Re: [PATCH net-next v4 1/1] ppp: Fix KMSAN warning by initializing 2-byte header

Jakub Kicinski
2025-02-28T01:48:14Z

On Wed, 26 Feb 2025 09:36:58 +0800 Jiayuan Chen wrote:
> The PPP driver adds an extra 2-byte header to enable socket filters to run
> correctly. However, the driver only initializes the first byte, which
> indicates the direction. For normal BPF programs, this is not a problem
> since they only read the first byte.
>
> Nevertheless, for carefully crafted BPF programs, if they read the second
> byte, this will trigger a KMSAN warning for reading uninitialized data.
>
> Reported-by: syzbot+853242d9c9917165d791@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/bpf/000000000000dea025060d6bc3bc@google.com/
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>

Could you add:

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

And combine the cover letter with the commit message?
For a single-patch postings cover letter is not necessary.

> + *(__be16 *)skb_push(skb, 2) = htons(PPP_FILTER_OUTBOUND_TAG);
> if (ppp->pass_filter &&
> bpf_prog_run(ppp->pass_filter, skb) == 0) {
> if (ppp->debug & 1)

The exact same problem seems to be present in ppp_receive_nonmp_frame()
please fix them both.
--
pw-bot: cr