linux-kernel - Re: [PATCH net-next 1/1] ppp: Fix KMSAN warning by initializing 2-byte header

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ktitxr3td73rdoqpum2dntizbxn6di73sptx5mqrp5hppfjaqk@crugooi3shdf>
Date: Wed, 26 Feb 2025 10:05:31 +0800
From: Jiayuan Chen <jiayuan.chen@...ux.dev>
To: horms@...nel.org, kuba@...nel.org
Cc: bpf@...r.kernel.org, netdev@...r.kernel.org, andrew+netdev@...n.ch, 
	davem@...emloft.net, edumazet@...gle.com, pabeni@...hat.com, ricardo@...liere.net, 
	viro@...iv.linux.org.uk, dmantipov@...dex.ru, aleksander.lobakin@...el.com, 
	linux-ppp@...r.kernel.org, linux-kernel@...r.kernel.org, mrpre@....com, 
	syzbot+853242d9c9917165d791@...kaller.appspotmail.com
Subject: Re: [PATCH net-next 1/1] ppp: Fix KMSAN warning by initializing
 2-byte header

On Tue, Feb 25, 2025 at 10:40:04PM +0800, Jiayuan Chen wrote:
>   * An instance of /dev/ppp can be associated with either a ppp
>   * interface unit or a ppp channel.  In both cases, file->private_data
> @@ -1762,10 +1766,15 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb)
>  
>  	if (proto < 0x8000) {
>  #ifdef CONFIG_PPP_FILTER
> -		/* check if we should pass this packet */
> -		/* the filter instructions are constructed assuming
> -		   a four-byte PPP header on each packet */
> -		*(u8 *)skb_push(skb, 2) = 1;
> +		/* Check if we should pass this packet.
> +		 * The filter instructions are constructed assuming
> +		 * a four-byte PPP header on each packet. The first byte
> +		 * indicates the direction, and the second byte is meaningless,
> +		 * but we still need to initialize it to prevent crafted BPF
> +		 * programs from reading them which would cause reading of
> +		 * uninitialized data.
> +		 */
> +		*(u16 *)skb_push(skb, 2) = htons(PPP_FILTER_OUTBOUND_TAG);
>  		if (ppp->pass_filter &&
>  		    bpf_prog_run(ppp->pass_filter, skb) == 0) {
>  			if (ppp->debug & 1)
> -- 
> 2.47.1
>
My apologize, it will raise Sparse check WARNING:
  drivers/net/ppp/ppp_generic.c:1777:42: warning: incorrect type in assignment (different base types)
  drivers/net/ppp/ppp_generic.c:1777:42:    expected unsigned short [usertype]
  drivers/net/ppp/ppp_generic.c:1777:42:    got restricted __be16 [usertype]

A new revision is here, all check passed:
https://lore.kernel.org/all/20250226013658.891214-1-jiayuan.chen@linux.dev/

pw-bot: cr