linux-kernel - Re: [PATCH net-next v5] ppp: Fix KMSAN uninit-value warning with bpf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250304154236.GE3666230@kernel.org>
Date: Tue, 4 Mar 2025 15:42:36 +0000
From: Simon Horman <horms@...nel.org>
To: Jiayuan Chen <jiayuan.chen@...ux.dev>
Cc: kuba@...nel.org, bpf@...r.kernel.org, netdev@...r.kernel.org,
	andrew+netdev@...n.ch, davem@...emloft.net, edumazet@...gle.com,
	pabeni@...hat.com, ricardo@...liere.net, viro@...iv.linux.org.uk,
	dmantipov@...dex.ru, aleksander.lobakin@...el.com,
	linux-ppp@...r.kernel.org, linux-kernel@...r.kernel.org,
	mrpre@....com, Paul Mackerras <paulus@...ba.org>,
	syzbot+853242d9c9917165d791@...kaller.appspotmail.com
Subject: Re: [PATCH net-next v5] ppp: Fix KMSAN uninit-value warning with bpf

On Fri, Feb 28, 2025 at 10:14:08PM +0800, Jiayuan Chen wrote:
> Syzbot caught an "KMSAN: uninit-value" warning [1], which is caused by the
> ppp driver not initializing a 2-byte header when using socket filter.
> 
> The following code can generate a PPP filter BPF program:
> '''
> struct bpf_program fp;
> pcap_t *handle;
> handle = pcap_open_dead(DLT_PPP_PPPD, 65535);
> pcap_compile(handle, &fp, "ip and outbound", 0, 0);
> bpf_dump(&fp, 1);
> '''
> Its output is:
> '''
> (000) ldh [2]
> (001) jeq #0x21 jt 2 jf 5
> (002) ldb [0]
> (003) jeq #0x1 jt 4 jf 5
> (004) ret #65535
> (005) ret #0
> '''
> Wen can find similar code at the following link:
> https://github.com/ppp-project/ppp/blob/master/pppd/options.c#L1680
> The maintainer of this code repository is also the original maintainer
> of the ppp driver.
> 
> As you can see the BPF program skips 2 bytes of data and then reads the
> 'Protocol' field to determine if it's an IP packet. Then it read the first
> byte of the first 2 bytes to determine the direction.
> 
> The issue is that only the first byte indicating direction is initialized
> in current ppp driver code while the second byte is not initialized.
> 
> For normal BPF programs generated by libpcap, uninitialized data won't be
> used, so it's not a problem. However, for carefully crafted BPF programs,
> such as those generated by syzkaller [2], which start reading from offset
> 0, the uninitialized data will be used and caught by KMSAN.
> 
> [1] https://syzkaller.appspot.com/bug?extid=853242d9c9917165d791
> [2] https://syzkaller.appspot.com/text?tag=ReproC&x=11994913980000
> 
> Cc: Paul Mackerras <paulus@...ba.org>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+853242d9c9917165d791@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/bpf/000000000000dea025060d6bc3bc@google.com/
> Signed-off-by: Jiayuan Chen <jiayuan.chen@...ux.dev>

Reviewed-by: Simon Horman <horms@...nel.org>