* drivers/net/ppp/ppp_synctty.c:469 ppp_sync_txmunge() warn: variable dereferenced before check 'skb' (see line 443)
@ 2026-09-13 20:27 kernel test robot
0 siblings, 0 replies; only message in thread
From: kernel test robot @ 2026-09-13 20:27 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Dan Carpenter
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Qingfang Deng <qingfang.deng@linux.dev>
CC: Jakub Kicinski <kuba@kernel.org>
CC: Eric Dumazet <edumazet@google.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: d681d7ef617ef83d6a4de36e5cb4418ef602e122
commit: 8aaeb56aff2a557a88f83ae866da2c91ad247e59 ppp_synctty: ensure a writeable skb header
date: 4 days ago
:::::: branch date: 3 hours ago
:::::: commit date: 4 days ago
config: x86_64-randconfig-161-20260913 (https://download.01.org/0day-ci/archive/20260913/202609132245.txZXoUxc-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 8aaeb56aff2a ("ppp_synctty: ensure a writeable skb header")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202609132245.txZXoUxc-lkp@intel.com/
smatch warnings:
drivers/net/ppp/ppp_synctty.c:469 ppp_sync_txmunge() warn: variable dereferenced before check 'skb' (see line 443)
vim +/skb +469 drivers/net/ppp/ppp_synctty.c
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 426
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 427 /*
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 428 * Procedures for encapsulation and framing.
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 429 */
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 430
3c582b30bc2592 drivers/net/ppp_synctty.c Stephen Hemminger 2008-01-23 431 static struct sk_buff*
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 432 ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *skb)
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 433 {
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 434 int proto;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 435 unsigned char *data;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 436 int islcp;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 437
aabc6596ffb377 drivers/net/ppp/ppp_synctty.c Arnaud Lecomte 2025-04-08 438 /* Ensure we can safely access protocol field and LCP code */
aabc6596ffb377 drivers/net/ppp/ppp_synctty.c Arnaud Lecomte 2025-04-08 439 if (!pskb_may_pull(skb, 3)) {
aabc6596ffb377 drivers/net/ppp/ppp_synctty.c Arnaud Lecomte 2025-04-08 440 kfree_skb(skb);
aabc6596ffb377 drivers/net/ppp/ppp_synctty.c Arnaud Lecomte 2025-04-08 441 return NULL;
aabc6596ffb377 drivers/net/ppp/ppp_synctty.c Arnaud Lecomte 2025-04-08 442 }
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 @443 data = skb->data;
96545aeb7b4457 drivers/net/ppp_synctty.c Changli Gao 2011-01-06 444 proto = get_unaligned_be16(data);
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 445
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 446 /* LCP packets with codes between 1 (configure-request)
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 447 * and 7 (code-reject) must be sent as though no options
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 448 * have been negotiated.
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 449 */
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 450 islcp = proto == PPP_LCP && 1 <= data[2] && data[2] <= 7;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 451
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 452 /* compress protocol field if option enabled */
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 453 if (data[0] == 0 && (ap->flags & SC_COMP_PROT) && !islcp)
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 454 skb_pull(skb,1);
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 455
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 456 /* prepend address/control fields if necessary */
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 457 if ((ap->flags & SC_COMP_AC) == 0 || islcp) {
8aaeb56aff2a55 drivers/net/ppp/ppp_synctty.c Qingfang Deng 2026-09-08 458 if (skb_cow_head(skb, 2)) {
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 459 kfree_skb(skb);
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 460 return NULL;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 461 }
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 462 skb_push(skb,2);
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 463 skb->data[0] = PPP_ALLSTATIONS;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 464 skb->data[1] = PPP_UI;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 465 }
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 466
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 467 ap->last_xmit = jiffies;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 468
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 @469 if (skb && ap->flags & SC_LOG_OUTPKT)
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 470 ppp_print_buffer ("send buffer", skb->data, skb->len);
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 471
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 472 return skb;
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 473 }
^1da177e4c3f41 drivers/net/ppp_synctty.c Linus Torvalds 2005-04-16 474
:::::: The code at line 469 was first introduced by commit
:::::: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Linux-2.6.12-rc2
:::::: TO: Linus Torvalds <torvalds@ppc970.osdl.org>
:::::: CC: Linus Torvalds <torvalds@ppc970.osdl.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-13 20:27 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-13 20:27 drivers/net/ppp/ppp_synctty.c:469 ppp_sync_txmunge() warn: variable dereferenced before check 'skb' (see line 443) kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox