linux-kernel - Re: [syzbot] [net?] KMSAN: uninit-value in __llc_lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <00000000000013f13b060bcd149d@google.com>
Date:   Tue, 05 Dec 2023 17:14:53 -0800
From:   syzbot <syzbot+b5ad66046b913bc04c6f@...kaller.appspotmail.com>
To:     linux-kernel@...r.kernel.org
Subject: Re: [syzbot] [net?] KMSAN: uninit-value in __llc_lookup_established

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org.

***

Subject: [net?] KMSAN: uninit-value in __llc_lookup_established
Author: eadavis@...com

please test uninit-value in __llc_lookup_established

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 1c41041124bd

diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index 51bccfb00a9c..58e0b8ab41b7 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -126,6 +126,7 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
 
 	skb->transport_header += llc_len;
 	skb_pull(skb, llc_len);
+	printk("3sp: %d\n", skb->protocol);
 	if (skb->protocol == htons(ETH_P_802_2)) {
 		__be16 pdulen;
 		s32 data_size;
@@ -141,7 +142,8 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
 			return 0;
 		if (unlikely(pskb_trim_rcsum(skb, data_size)))
 			return 0;
-	}
+	} else
+		return 0;
 	return 1;
 }
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index afa5497f7c35..bff910513fc3 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1900,6 +1900,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
 		skb->protocol = eth_type_trans(skb, tun->dev);
 		break;
 	}
+	printk("sp: %d\n", skb->protocol);
 
 	/* copy skb_ubuf_info for callback when skb has no error */
 	if (zerocopy) {
@@ -1999,6 +2000,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
 
 		local_bh_enable();
 	} else if (!IS_ENABLED(CONFIG_4KSTACKS)) {
+		printk("2sp: %d\n", skb->protocol);
 		tun_rx_batched(tun, tfile, skb, more);
 	} else {
 		netif_rx(skb);