netdev - Re: [Patch net] can: initialize skbcnt in j1939_tp_tx_dat

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <747813a4-eea4-b390-569e-44f8b3958fcb@pengutronix.de>
Date:   Thu, 8 Oct 2020 23:47:38 +0200
From:   Marc Kleine-Budde <mkl@...gutronix.de>
To:     Jakub Kicinski <kuba@...nel.org>,
        Cong Wang <xiyou.wangcong@...il.com>
Cc:     netdev@...r.kernel.org,
        syzbot+3f3837e61a48d32b495f@...kaller.appspotmail.com,
        Robin van der Gracht <robin@...tonic.nl>,
        Oleksij Rempel <linux@...pel-privat.de>,
        Oliver Hartkopp <socketcan@...tkopp.net>,
        Marc Kleine-Budde <mkl@...gutronix.de>
Subject: Re: [Patch net] can: initialize skbcnt in j1939_tp_tx_dat_new()

On 10/8/20 7:34 PM, Jakub Kicinski wrote:
> On Wed,  7 Oct 2020 23:18:21 -0700 Cong Wang wrote:
>> This fixes an uninit-value warning:
>> BUG: KMSAN: uninit-value in can_receive+0x26b/0x630 net/can/af_can.c:650
>>
>> Reported-and-tested-by: syzbot+3f3837e61a48d32b495f@...kaller.appspotmail.com
>> Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
>> Cc: Robin van der Gracht <robin@...tonic.nl>
>> Cc: Oleksij Rempel <linux@...pel-privat.de>
>> Cc: Pengutronix Kernel Team <kernel@...gutronix.de>
>> Cc: Oliver Hartkopp <socketcan@...tkopp.net>
>> Cc: Marc Kleine-Budde <mkl@...gutronix.de>
>> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>
>> ---
>>  net/can/j1939/transport.c | 1 +
>>  1 file changed, 1 insertion(+)
>>
>> diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
>> index 0cec4152f979..88cf1062e1e9 100644
>> --- a/net/can/j1939/transport.c
>> +++ b/net/can/j1939/transport.c
>> @@ -580,6 +580,7 @@ sk_buff *j1939_tp_tx_dat_new(struct j1939_priv *priv,
>>  	skb->dev = priv->ndev;
>>  	can_skb_reserve(skb);
>>  	can_skb_prv(skb)->ifindex = priv->ndev->ifindex;
>> +	can_skb_prv(skb)->skbcnt = 0;
>>  	/* reserve CAN header */
>>  	skb_reserve(skb, offsetof(struct can_frame, data));
> 
> Thanks! Looks like there is another can_skb_reserve(skb) on line 1489,
> is that one fine?

I think say yes, but better safe the sorry.

> Marc - should I take this directly into net, in case there is a last
> minute PR to Linus for 5.9?

Yes, of you can pull Cong Wang's patch and my patch, that fixes the other
missing init of skbcnt.

That tag includes my previous oneline-patch-pull-request from 20201006, that
fixes the c_can driver on basically all stm32mp1 based boards. Would be good to
see that in 5.9, as well.

git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git
tags/linux-can-fixes-for-5.9-20201008

I've send a proper pull request some seconds ago.

Marc
-- 
Pengutronix e.K.                 | Marc Kleine-Budde           |
Embedded Linux                   | https://www.pengutronix.de  |
Vertretung West/Dortmund         | Phone: +49-231-2826-924     |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-5555 |



Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)