* [syzbot] [batman?] KMSAN: uninit-value in skb_clone
@ 2025-11-25 16:32 syzbot
2025-11-25 17:42 ` shaurya
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: syzbot @ 2025-11-25 16:32 UTC (permalink / raw)
To: antonio, b.a.t.m.a.n, davem, edumazet, horms, kuba, linux-kernel,
marek.lindner, netdev, pabeni, sven, sw, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: d13f3ac64efb Merge tag 'mips-fixes_6.18_1' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16333a12580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a1db0fea040c2a9f
dashboard link: https://syzkaller.appspot.com/bug?extid=2fa344348a579b779e05
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=123f4e92580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15418612580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-d13f3ac6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7a7fb613c712/vmlinux-d13f3ac6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ea4e1a2bb3be/bzImage-d13f3ac6.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2fa344348a579b779e05@syzkaller.appspotmail.com
syz_tun: entered promiscuous mode
bond0: (slave syz_tun): Enslaving as an active interface with an up link
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]
CPU: 0 UID: 0 PID: 5625 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:skb_clone+0xd7/0x3a0 net/core/skbuff.c:2041
Code: 03 42 80 3c 20 00 74 08 4c 89 f7 e8 23 29 05 f9 49 83 3e 00 0f 85 a0 01 00 00 e8 94 dd 9d f8 48 8d 6b 7e 49 89 ee 49 c1 ee 03 <43> 0f b6 04 26 84 c0 0f 85 d1 01 00 00 44 0f b6 7d 00 41 83 e7 0c
RSP: 0018:ffffc9000d00f200 EFLAGS: 00010207
RAX: ffffffff892235a1 RBX: 0000000000000000 RCX: ffff88803372a480
RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000000
RBP: 000000000000007e R08: ffffffff8f7d0f77 R09: 1ffffffff1efa1ee
R10: dffffc0000000000 R11: fffffbfff1efa1ef R12: dffffc0000000000
R13: 0000000000000820 R14: 000000000000000f R15: ffff88805144cc00
FS: 0000555557f6d500(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555581d35808 CR3: 000000005040e000 CR4: 0000000000352ef0
Call Trace:
<TASK>
hsr_forward_do net/hsr/hsr_forward.c:-1 [inline]
hsr_forward_skb+0x1013/0x2860 net/hsr/hsr_forward.c:741
hsr_handle_frame+0x6ce/0xa70 net/hsr/hsr_slave.c:84
__netif_receive_skb_core+0x10b9/0x4380 net/core/dev.c:5966
__netif_receive_skb_one_core net/core/dev.c:6077 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6192
netif_receive_skb_internal net/core/dev.c:6278 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6337
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0449f8e1ff
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007ffd7ad94c90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f044a1e5fa0 RCX: 00007f0449f8e1ff
RDX: 000000000000003e RSI: 0000200000000500 RDI: 00000000000000c8
RBP: 00007ffd7ad94d20 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000003e R11: 0000000000000293 R12: 0000000000000001
R13: 00007f044a1e5fa0 R14: 00007f044a1e5fa0 R15: 0000000000000003
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:skb_clone+0xd7/0x3a0 net/core/skbuff.c:2041
Code: 03 42 80 3c 20 00 74 08 4c 89 f7 e8 23 29 05 f9 49 83 3e 00 0f 85 a0 01 00 00 e8 94 dd 9d f8 48 8d 6b 7e 49 89 ee 49 c1 ee 03 <43> 0f b6 04 26 84 c0 0f 85 d1 01 00 00 44 0f b6 7d 00 41 83 e7 0c
RSP: 0018:ffffc9000d00f200 EFLAGS: 00010207
RAX: ffffffff892235a1 RBX: 0000000000000000 RCX: ffff88803372a480
RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000000
RBP: 000000000000007e R08: ffffffff8f7d0f77 R09: 1ffffffff1efa1ee
R10: dffffc0000000000 R11: fffffbfff1efa1ef R12: dffffc0000000000
R13: 0000000000000820 R14: 000000000000000f R15: ffff88805144cc00
FS: 0000555557f6d500(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555581d35808 CR3: 000000005040e000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 03 42 80 add -0x80(%rdx),%eax
3: 3c 20 cmp $0x20,%al
5: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
9: 89 f7 mov %esi,%edi
b: e8 23 29 05 f9 call 0xf9052933
10: 49 83 3e 00 cmpq $0x0,(%r14)
14: 0f 85 a0 01 00 00 jne 0x1ba
1a: e8 94 dd 9d f8 call 0xf89dddb3
1f: 48 8d 6b 7e lea 0x7e(%rbx),%rbp
23: 49 89 ee mov %rbp,%r14
26: 49 c1 ee 03 shr $0x3,%r14
* 2a: 43 0f b6 04 26 movzbl (%r14,%r12,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 d1 01 00 00 jne 0x208
37: 44 0f b6 7d 00 movzbl 0x0(%rbp),%r15d
3c: 41 83 e7 0c and $0xc,%r15d
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [syzbot] [batman?] KMSAN: uninit-value in skb_clone
2025-11-25 16:32 [syzbot] [batman?] KMSAN: uninit-value in skb_clone syzbot
@ 2025-11-25 17:42 ` shaurya
2025-11-25 17:59 ` syzbot
2025-11-25 20:03 ` shaurya
2025-11-29 16:01 ` shaurya
2 siblings, 1 reply; 7+ messages in thread
From: shaurya @ 2025-11-25 17:42 UTC (permalink / raw)
To: syzbot+2fa344348a579b779e05; +Cc: linux-kernel, netdev, syzkaller-bugs
[-- Attachment #1: Type: text/plain, Size: 83 bytes --]
#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
[-- Attachment #2: 0001-hsr-fix-NULL-pointer-dereference-in-skb_clone-with-h.patch --]
[-- Type: text/x-patch, Size: 1627 bytes --]
From 9bde86ad2ed63acc09a25e665028dbada7f5f0ac Mon Sep 17 00:00:00 2001
From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
Date: Tue, 25 Nov 2025 23:02:33 +0530
Subject: [PATCH] hsr: fix NULL pointer dereference in skb_clone with hw tag
insertion
When hardware HSR tag insertion is enabled (NETIF_F_HW_HSR_TAG_INS) and
frame->skb_std is NULL, both hsr_create_tagged_frame() and
prp_create_tagged_frame() will call skb_clone() with a NULL skb pointer,
causing a kernel crash.
Fix this by adding NULL checks for frame->skb_std before calling
skb_clone() in both functions.
Reported-by: syzbot+2fa344348a579b779e05@syzkaller.appspotmail.com
Fixes: f266a683a480 (\"net/hsr: Better frame dispatch\")
Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
---
net/hsr/hsr_forward.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index 339f0d220212..7bd82767c544 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -341,6 +341,8 @@ struct sk_buff *hsr_create_tagged_frame(struct hsr_frame_info *frame,
hsr_set_path_id(frame, hsr_ethhdr, port);
return skb_clone(frame->skb_hsr, GFP_ATOMIC);
} else if (port->dev->features & NETIF_F_HW_HSR_TAG_INS) {
+ if (!frame->skb_std)
+ return NULL;
return skb_clone(frame->skb_std, GFP_ATOMIC);
}
@@ -385,6 +387,8 @@ struct sk_buff *prp_create_tagged_frame(struct hsr_frame_info *frame,
}
return skb_clone(frame->skb_prp, GFP_ATOMIC);
} else if (port->dev->features & NETIF_F_HW_HSR_TAG_INS) {
+ if (!frame->skb_std)
+ return NULL;
return skb_clone(frame->skb_std, GFP_ATOMIC);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [syzbot] [batman?] KMSAN: uninit-value in skb_clone
2025-11-25 17:42 ` shaurya
@ 2025-11-25 17:59 ` syzbot
0 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2025-11-25 17:59 UTC (permalink / raw)
To: linux-kernel, netdev, ssranevjti, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in skb_clone
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]
CPU: 0 UID: 0 PID: 6008 Comm: syz.0.23 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:skb_clone+0xd7/0x3a0 net/core/skbuff.c:2041
Code: 03 42 80 3c 20 00 74 08 4c 89 f7 e8 f3 28 05 f9 49 83 3e 00 0f 85 a0 01 00 00 e8 94 dd 9d f8 48 8d 6b 7e 49 89 ee 49 c1 ee 03 <43> 0f b6 04 26 84 c0 0f 85 d1 01 00 00 44 0f b6 7d 00 41 83 e7 0c
RSP: 0018:ffffc9000d67f200 EFLAGS: 00010207
RAX: ffffffff89223591 RBX: 0000000000000000 RCX: ffff88803362c900
RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000000
RBP: 000000000000007e R08: ffffffff8f7d0f77 R09: 1ffffffff1efa1ee
R10: dffffc0000000000 R11: fffffbfff1efa1ef R12: dffffc0000000000
R13: 0000000000000820 R14: 000000000000000f R15: ffff888049098f00
FS: 00007f65d4fbc6c0(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f65d4fbbfc8 CR3: 0000000056473000 CR4: 0000000000352ef0
Call Trace:
<TASK>
hsr_forward_do net/hsr/hsr_forward.c:-1 [inline]
hsr_forward_skb+0x1013/0x2860 net/hsr/hsr_forward.c:745
hsr_handle_frame+0x6ce/0xa70 net/hsr/hsr_slave.c:84
__netif_receive_skb_core+0x10b9/0x4380 net/core/dev.c:5966
__netif_receive_skb_one_core net/core/dev.c:6077 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6192
netif_receive_skb_internal net/core/dev.c:6278 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6337
tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485
tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f65d598e1ff
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007f65d4fbc000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f65d5be6180 RCX: 00007f65d598e1ff
RDX: 000000000000003e RSI: 0000200000000500 RDI: 00000000000000c8
RBP: 00007f65d4fbc090 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000003e R11: 0000000000000293 R12: 0000000000000001
R13: 00007f65d5be6218 R14: 00007f65d5be6180 R15: 00007ffeb6e64a58
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:skb_clone+0xd7/0x3a0 net/core/skbuff.c:2041
Code: 03 42 80 3c 20 00 74 08 4c 89 f7 e8 f3 28 05 f9 49 83 3e 00 0f 85 a0 01 00 00 e8 94 dd 9d f8 48 8d 6b 7e 49 89 ee 49 c1 ee 03 <43> 0f b6 04 26 84 c0 0f 85 d1 01 00 00 44 0f b6 7d 00 41 83 e7 0c
RSP: 0018:ffffc9000d67f200 EFLAGS: 00010207
RAX: ffffffff89223591 RBX: 0000000000000000 RCX: ffff88803362c900
RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000000
RBP: 000000000000007e R08: ffffffff8f7d0f77 R09: 1ffffffff1efa1ee
R10: dffffc0000000000 R11: fffffbfff1efa1ef R12: dffffc0000000000
R13: 0000000000000820 R14: 000000000000000f R15: ffff888049098f00
FS: 00007f65d4fbc6c0(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f65d4fbbfc8 CR3: 0000000056473000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 03 42 80 add -0x80(%rdx),%eax
3: 3c 20 cmp $0x20,%al
5: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
9: 89 f7 mov %esi,%edi
b: e8 f3 28 05 f9 call 0xf9052903
10: 49 83 3e 00 cmpq $0x0,(%r14)
14: 0f 85 a0 01 00 00 jne 0x1ba
1a: e8 94 dd 9d f8 call 0xf89dddb3
1f: 48 8d 6b 7e lea 0x7e(%rbx),%rbp
23: 49 89 ee mov %rbp,%r14
26: 49 c1 ee 03 shr $0x3,%r14
* 2a: 43 0f b6 04 26 movzbl (%r14,%r12,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 d1 01 00 00 jne 0x208
37: 44 0f b6 7d 00 movzbl 0x0(%rbp),%r15d
3c: 41 83 e7 0c and $0xc,%r15d
Tested on:
commit: 30f09200 Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15e6cf42580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a1db0fea040c2a9f
dashboard link: https://syzkaller.appspot.com/bug?extid=2fa344348a579b779e05
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=1281a612580000
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [syzbot] [batman?] KMSAN: uninit-value in skb_clone
2025-11-25 16:32 [syzbot] [batman?] KMSAN: uninit-value in skb_clone syzbot
2025-11-25 17:42 ` shaurya
@ 2025-11-25 20:03 ` shaurya
2025-11-25 20:25 ` syzbot
2025-11-29 16:01 ` shaurya
2 siblings, 1 reply; 7+ messages in thread
From: shaurya @ 2025-11-25 20:03 UTC (permalink / raw)
To: syzbot+2fa344348a579b779e05; +Cc: linux-kernel, netdev, syzkaller-bugs
[-- Attachment #1: Type: text/plain, Size: 83 bytes --]
#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
[-- Attachment #2: 0001-hsr-fix-NULL-pointer-dereference-in-skb_clone-with-h.patch --]
[-- Type: text/x-patch, Size: 1883 bytes --]
From ff66dd840d93efe5914a824b0d4d58031115d788 Mon Sep 17 00:00:00 2001
From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
Date: Wed, 26 Nov 2025 01:25:03 +0530
Subject: [PATCH] hsr: fix NULL pointer dereference in skb_clone with hw tag
insertion
When hardware HSR tag insertion is enabled (NETIF_F_HW_HSR_TAG_INS) and
frame->skb_std is NULL, both hsr_create_tagged_frame() and
prp_create_tagged_frame() will call skb_clone() with a NULL skb pointer,
causing a kernel crash.
Fix this by adding NULL checks for frame->skb_std before calling
skb_clone() in the functions.
Reported-by: syzbot+2fa344348a579b779e05@syzkaller.appspotmail.com
Fixes: f266a683a480 (\"net/hsr: Better frame dispatch\")
Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
---
net/hsr/hsr_forward.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index 339f0d220212..4c1a311b900f 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -211,6 +211,9 @@ struct sk_buff *prp_get_untagged_frame(struct hsr_frame_info *frame,
__FILE__, __LINE__, port->dev->name);
return NULL;
}
+
+ if (!frame->skb_std)
+ return NULL;
}
return skb_clone(frame->skb_std, GFP_ATOMIC);
@@ -341,6 +344,8 @@ struct sk_buff *hsr_create_tagged_frame(struct hsr_frame_info *frame,
hsr_set_path_id(frame, hsr_ethhdr, port);
return skb_clone(frame->skb_hsr, GFP_ATOMIC);
} else if (port->dev->features & NETIF_F_HW_HSR_TAG_INS) {
+ if (!frame->skb_std)
+ return NULL;
return skb_clone(frame->skb_std, GFP_ATOMIC);
}
@@ -385,6 +390,8 @@ struct sk_buff *prp_create_tagged_frame(struct hsr_frame_info *frame,
}
return skb_clone(frame->skb_prp, GFP_ATOMIC);
} else if (port->dev->features & NETIF_F_HW_HSR_TAG_INS) {
+ if (!frame->skb_std)
+ return NULL;
return skb_clone(frame->skb_std, GFP_ATOMIC);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [syzbot] [batman?] KMSAN: uninit-value in skb_clone
2025-11-25 16:32 [syzbot] [batman?] KMSAN: uninit-value in skb_clone syzbot
2025-11-25 17:42 ` shaurya
2025-11-25 20:03 ` shaurya
@ 2025-11-29 16:01 ` shaurya
2025-11-29 16:23 ` syzbot
2 siblings, 1 reply; 7+ messages in thread
From: shaurya @ 2025-11-29 16:01 UTC (permalink / raw)
To: syzbot+2fa344348a579b779e05; +Cc: linux-kernel, netdev, syzkaller-bugs
[-- Attachment #1: Type: text/plain, Size: 83 bytes --]
#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
[-- Attachment #2: 0001-net-hsr-fix-NULL-pointer-dereference-in-prp_get_unta.patch --]
[-- Type: text/x-patch, Size: 1729 bytes --]
From 55661c87a847ed20bafa072ea6ba90e345fcfb58 Mon Sep 17 00:00:00 2001
From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
Date: Sat, 29 Nov 2025 21:29:17 +0530
Subject: [PATCH net v3] net: hsr: fix NULL pointer dereference in
prp_get_untagged_frame()
__pskb_copy() can return NULL if memory allocation fails. When this
happens in prp_get_untagged_frame(), frame->skb_std remains NULL and
is passed to skb_clone(), causing a NULL pointer dereference.
Add a NULL check immediately after __pskb_copy() to return early
when allocation fails.
BUG: KMSAN: uninit-value in skb_clone+0x1e0/0x420 net/core/skbuff.c:2129
skb_clone+0x1e0/0x420 net/core/skbuff.c:2129
prp_get_untagged_frame net/hsr/hsr_forward.c:217 [inline]
hsr_forward_do+0x2fe0/0x59d0 net/hsr/hsr_forward.c:663
hsr_forward_skb+0x330/0x460 net/hsr/hsr_forward.c:720
hsr_dev_xmit+0x4a/0x80 net/hsr/hsr_device.c:199
Reported-by: syzbot+e2ca1ef26dc1c7387658@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug\?extid\=e2ca1ef26dc1c7387658
Fixes: 451d8123f897 ("net: prp: add packet handling support")
Cc: stable@vger.kernel.org
Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
---
net/hsr/hsr_forward.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index 339f0d220212..aefc9b6936ba 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -205,6 +205,8 @@ struct sk_buff *prp_get_untagged_frame(struct hsr_frame_info *frame,
__pskb_copy(frame->skb_prp,
skb_headroom(frame->skb_prp),
GFP_ATOMIC);
+ if (!frame->skb_std)
+ return NULL;
} else {
/* Unexpected */
WARN_ONCE(1, "%s:%d: Unexpected frame received (port_src %s)\n",
--
2.34.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
end of thread, other threads:[~2025-11-29 16:23 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-25 16:32 [syzbot] [batman?] KMSAN: uninit-value in skb_clone syzbot
2025-11-25 17:42 ` shaurya
2025-11-25 17:59 ` syzbot
2025-11-25 20:03 ` shaurya
2025-11-25 20:25 ` syzbot
2025-11-29 16:01 ` shaurya
2025-11-29 16:23 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).