linux-kernel - Re: [PATCH net-next v2 1/1] ppp: Fix KMSAN warning by initializing 2-byte header

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fm6hvchejtwpqp55te7rbiwt6y2pmjywikfdpnfv5ao5otxzm3@yxfem4zhdqkp>
Date: Tue, 25 Feb 2025 07:20:08 +0800
From: Jiayuan Chen <jiayuan.chen@...ux.dev>
To: Jakub Kicinski <kuba@...nel.org>
Cc: bpf@...r.kernel.org, netdev@...r.kernel.org, andrew+netdev@...n.ch, 
	davem@...emloft.net, edumazet@...gle.com, pabeni@...hat.com, horms@...nel.org, 
	ricardo@...liere.net, viro@...iv.linux.org.uk, dmantipov@...dex.ru, 
	aleksander.lobakin@...el.com, linux-ppp@...r.kernel.org, linux-kernel@...r.kernel.org, 
	mrpre@....com, syzbot+853242d9c9917165d791@...kaller.appspotmail.com
Subject: Re: [PATCH net-next v2 1/1] ppp: Fix KMSAN warning by initializing
 2-byte header

On Mon, Feb 24, 2025 at 02:26:44PM -0800, Jakub Kicinski wrote:
> On Fri, 21 Feb 2025 14:12:19 +0800 Jiayuan Chen wrote:
> > +		/* Check if we should pass this packet.
> > +		 * BPF filter instructions assume each PPP packet has a 4-byte
> > +		 * header (e.g., those generated by libpcap), and then default
> > +		 * to skipping the first 2 bytes at the beginning of the
> > +		 * instruction. However, we still need to initialize these
> > +		 * 2-byte new headers to prevent crafted BPF programs from
> > +		 * reading them which would cause reading of uninitialized
> > +		 * data. Here, we set the headers according to the RFC 1662.
> > +		 */
> > +		*(u16 *)skb_push(skb, 2) = htons(0xff03);
> 
> The constant from the RFC deserves a #define or enum.
> Looks like we may already need it in one other place:
> 
> drivers/net/wan/fsl_ucc_hdlc.h:#define DEFAULT_PPP_HEAD    0xff03
> -- 
> pw-bot: cr
Hi Jakub,

I apologize for the mistake, I've investigated the original maintainer's
user-space PPP implementation and libpcap's behavior, and found that
initializing the first byte to 0 or 1 is necessary, it indicates
direction, which is used in libpcap to distinguish between inbound and
outbound traffic.
For more details, please refer to the cover letter of my v3 patch.

https://lore.kernel.org/linux-ppp/20250222092556.274267-1-jiayuan.chen@linux.dev/T/#t