kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Jiayuan Chen 4c2d14c40a ppp: Fix KMSAN uninit-value warning with bpf 
Syzbot caught an "KMSAN: uninit-value" warning [1], which is caused by the
ppp driver not initializing a 2-byte header when using socket filter.

The following code can generate a PPP filter BPF program:
'''
struct bpf_program fp;
pcap_t *handle;
handle = pcap_open_dead(DLT_PPP_PPPD, 65535);
pcap_compile(handle, &fp, "ip and outbound", 0, 0);
bpf_dump(&fp, 1);
'''
Its output is:
'''
(000) ldh [2]
(001) jeq #0x21 jt 2 jf 5
(002) ldb [0]
(003) jeq #0x1 jt 4 jf 5
(004) ret #65535
(005) ret #0
'''
Wen can find similar code at the following link:
https://github.com/ppp-project/ppp/blob/master/pppd/options.c#L1680
The maintainer of this code repository is also the original maintainer
of the ppp driver.

As you can see the BPF program skips 2 bytes of data and then reads the
'Protocol' field to determine if it's an IP packet. Then it read the first
byte of the first 2 bytes to determine the direction.

The issue is that only the first byte indicating direction is initialized
in current ppp driver code while the second byte is not initialized.

For normal BPF programs generated by libpcap, uninitialized data won't be
used, so it's not a problem. However, for carefully crafted BPF programs,
such as those generated by syzkaller [2], which start reading from offset
0, the uninitialized data will be used and caught by KMSAN.

[1] https://syzkaller.appspot.com/bug?extid=853242d9c9917165d791
[2] https://syzkaller.appspot.com/text?tag=ReproC&x=11994913980000

Cc: Paul Mackerras <paulus@samba.org>
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+853242d9c9917165d791@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/bpf/000000000000dea025060d6bc3bc@google.com/
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250228141408.393864-1-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
History 2025-03-04 16:56:41 -08:00
..
accel An reset signal polarity fix for the jd9365da-h3 panel, a folio handling 2025-02-21 09:16:35 +10:00
accessibility speakup: use SPKDIR=$(src) to specify the source directory 2024-11-04 17:53:09 +09:00
acpi ACPI: platform_profile: Fix memory leak in profile_class_is_visible() 2025-02-18 20:03:37 +01:00
amba ARM: 9415/1: amba: Add dev_is_amba() function and export it for modules 2024-11-12 16:41:45 +00:00
android Char/Misc/IIO driver updates for 6.14-rc1 2025-01-27 16:51:51 -08:00
ata ata fix for 6.14-rc4 2025-02-20 18:05:24 -08:00
atm Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
auxdisplay auxdisplay for v6.14-1 2025-01-24 08:03:52 -08:00
base Driver core api addition for 6.14-rc3 2025-02-16 12:54:42 -08:00
bcma Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
block block-6.14-20250207 2025-02-07 11:00:33 -08:00
bluetooth bluetooth: btusb: Initialize .owner field of force_poll_sync_fops 2025-02-27 16:50:05 -05:00
bus genirq: Remove leading space from irq_chip::irq_print_chip() callbacks 2025-02-07 08:56:01 +01:00
cache cache: StarFive: Require a 64-bit system 2024-08-01 07:15:02 -07:00
cdrom treewide: const qualify ctl_tables where applicable 2025-01-28 13:48:37 +01:00
cdx cdx: disable cdx bus from bus shutdown callback 2025-01-10 15:43:16 +01:00
char treewide: const qualify ctl_tables where applicable 2025-01-28 13:48:37 +01:00
clk The various patchsets are summarized below. Plus of course many 2025-01-26 18:36:23 -08:00
clocksource irqchip/jcore-aic, clocksource/drivers/jcore: Fix jcore-pit interrupt request 2025-02-17 23:27:49 +01:00
comedi comedi: Flush partial mappings in error case 2024-11-05 14:01:07 +01:00
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-13 11:15:44 +01:00
counter module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
cpufreq amd-pstate fixes 2/6/25 2025-02-06 20:39:43 +01:00
cpuidle More power management updates for 6.14-rc1 2025-01-30 15:10:34 -08:00
crypto crypto: ccp: Add external API interface for PSP module initialization 2025-02-14 18:39:19 -05:00
cxl cxl changes for v6.14 2025-01-29 11:23:22 -08:00
dax module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
dca Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
devfreq Update devfreq next for v6.14 2025-01-13 20:48:34 +01:00
dio dio: Have dio_bus_match() callback take a const * 2024-07-10 15:38:14 +02:00
dma tegra210-adma: fix 32-bit x86 build 2025-02-15 09:28:55 -08:00
dma-buf Merge tag 'drm-misc-fixes-2024-12-19' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes 2024-12-20 07:13:45 +10:00
dpll dpll: add clock quality level attribute and op 2024-11-03 08:39:07 -08:00
edac EDAC/qcom: Correct interrupt enable register configuration 2025-02-14 20:36:11 +01:00
eisa driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
extcon Update extcon next for v6.14 2025-01-12 13:44:27 +01:00
firewire Driver core and debugfs updates 2025-01-28 12:25:12 -08:00
firmware sound fixes for 6.14-rc5 2025-02-27 08:41:19 -08:00
fpga FPGA Manager changes for 6.14-rc1 2025-01-09 10:56:57 +01:00
fsi Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
gnss [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
gpio gpiolib: don't bail out if get_direction() fails in gpiochip_add_data() 2025-02-20 14:08:18 +01:00
gpu Merge tag 'drm-msm-fixes-2025-02-20' of https://gitlab.freedesktop.org/drm/msm into drm-fixes 2025-02-21 10:50:29 +10:00
greybus greybus: Fix a typo 2024-11-05 05:33:46 +01:00
hid hid-for-linus-2025021001 2025-02-10 09:50:01 -08:00
hsi Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
hte Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
hv treewide: const qualify ctl_tables where applicable 2025-01-28 13:48:37 +01:00
hwmon Driver core and debugfs updates 2025-01-28 12:25:12 -08:00
hwspinlock Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
hwtracing KVM/arm64 updates for 6.14 2025-01-28 09:01:36 -08:00
i2c i2c: core: Allocate temporary client dynamically 2025-02-22 10:27:37 +01:00
i3c I3C for 6.14 2025-01-24 15:48:01 -08:00
idle Power management updates for 6.14-rc1 2025-01-22 11:16:14 -08:00
iio IIO: 2nd set of fixes for the 6.13 cycle. 2025-01-16 13:46:08 +01:00
infiniband RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers 2025-02-23 06:57:56 -05:00
input platform-drivers-x86 for v6.14-1 2025-01-24 07:18:39 -08:00
interconnect interconnect changes for 6.14 2025-01-16 14:01:40 +01:00
iommu ARM: 2025-02-16 10:25:12 -08:00
ipack driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
irqchip irqchip/qcom-pdc: Workaround hardware register bug on X1E80100 2025-02-21 09:47:06 +01:00
isdn isdn: Remove unused get_Bprotocol4id() 2024-12-11 20:12:27 -08:00
leds Driver core and debugfs updates 2025-01-28 12:25:12 -08:00
macintosh The various patchsets are summarized below. Plus of course many 2025-01-26 18:36:23 -08:00
mailbox mailbox: th1520: Fix memory corruption due to incorrect array size 2025-01-18 16:20:55 -06:00
mcb module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
md - dm-vdo: add missing spin_lock_init 2025-02-24 16:29:48 -08:00
media [GIT PULL for v6.14] media updates 2025-02-01 09:15:01 -08:00
memory spi: Support DTR in spi-mem 2025-01-15 19:07:39 +01:00
memstick Char/Misc/IIO driver updates for 6.14-rc1 2025-01-27 16:51:51 -08:00
message Merge branch '6.13/scsi-fixes' into 6.14/scsi-staging 2025-01-10 15:20:30 -05:00
mfd mfd: syscon: Restore device_node_to_regmap() for non-syscon nodes 2025-02-11 14:53:39 +00:00
misc treewide: const qualify ctl_tables where applicable 2025-01-28 13:48:37 +01:00
mmc mmc: mtk-sd: Fix register settings for hs400(es) mode 2025-02-03 13:34:50 +01:00
most Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
mtd Fix writes on SST flashes 2025-02-19 14:38:47 +01:00
mux mux: constify mux class 2025-01-10 10:15:04 +01:00
net ppp: Fix KMSAN uninit-value warning with bpf 2025-03-04 16:56:41 -08:00
nfc nfc: mrvl: Don't use "proxy" headers 2025-01-18 17:10:05 -08:00
ntb PCI: Remove devres from pci_intx() 2025-01-18 14:38:49 -06:00
nubus nubus: Make nubus_bus_type static and constant 2024-01-03 13:33:59 +01:00
nvdimm driver core: Constify API device_find_child() and adapt for various usages 2025-01-03 11:19:35 +01:00
nvme nvme: only allow entering LIVE from CONNECTING state 2025-02-20 09:14:25 -08:00
nvmem nvmem: core: improve range check for nvmem_cell_write() 2025-01-10 16:16:48 +01:00
of of: address: Add kunit test for __of_address_resource_bounds() 2025-02-02 20:59:04 -06:00
opp Driver core and debugfs updates 2025-01-28 12:25:12 -08:00
parisc Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
parport serial: 8250_pci: Share WCH IDs with parport_serial driver 2024-12-04 16:42:55 +01:00
pci pci-v6.14-fixes-3 2025-02-14 16:49:07 -08:00
pcmcia Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
peci module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
perf treewide: const qualify ctl_tables where applicable 2025-01-28 13:48:37 +01:00
phy phy-for-6.14 2025-01-29 14:32:38 -08:00
pinctrl pinctrl: pinconf-generic: Print unsigned value if a format is registered 2025-02-06 10:13:15 +01:00
platform soc: fixes for 6.14 2025-02-21 13:16:01 -08:00
pmdomain pmdomain: airoha: Fix compilation error with Clang-20 and Thumb2 mode 2025-01-21 10:45:24 +01:00
pnp driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
power power: supply: axp20x_battery: Fix fault handling for AXP717 2025-02-03 12:41:18 +01:00
powercap Merge branch 'pm-powercap' 2025-02-07 12:43:58 +01:00
pps pps: clients: gpio: Bypass edge's direction check when not needed 2025-01-10 16:12:33 +01:00
ps3 ps3: Correct some typos in comments 2024-11-15 00:32:29 +11:00
ptp ptp: vmclock: Remove goto-based cleanup logic 2025-02-11 10:20:52 +01:00
pwm Driver core and debugfs updates 2025-01-28 12:25:12 -08:00
rapidio driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
ras x86/amd_nb: Move SMN access code to a new amd_node driver 2025-01-08 10:59:44 +01:00
regulator regulator: core: let dt properties override driver init_data 2025-02-11 16:29:01 +00:00
remoteproc remoteproc: st: Use syscon_regmap_lookup_by_phandle_args 2025-01-15 10:04:27 -07:00
reset soc: driver updates for 6.14 2025-01-24 14:56:59 -08:00
rpmsg driver core: Constify API device_find_child() and adapt for various usages 2025-01-03 11:19:35 +01:00
rtc RTC for 6.13 2025-01-30 17:50:02 -08:00
s390 Smaller than usual with no fixes from any subtree. 2025-02-20 10:19:54 -08:00
sbus Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
scsi scsi: core: Clear driver private data when retrying request 2025-02-20 21:20:58 -05:00
sh sh updates for v6.13 2024-11-30 14:45:29 -08:00
siox Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
slimbus Driver core and debugfs updates 2025-01-28 12:25:12 -08:00
soc soc: loongson: loongson2_guts: Add check for devm_kstrdup() 2025-02-20 22:29:05 +01:00
soundwire soundwire updates for 6.14 2025-01-29 14:38:19 -08:00
spi spi: sn-f-ospi: Fix division by zero 2025-02-06 11:33:51 +00:00
spmi spmi: hisi-spmi-controller: Drop duplicated OF node assignment in spmi_controller_probe() 2025-01-17 12:58:49 +01:00
ssb driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
staging Driver core and debugfs updates 2025-01-28 12:25:12 -08:00
target Merge branch '6.14/scsi-queue' into 6.14/scsi-fixes 2025-02-03 16:28:51 -05:00
tc TC: Fix the wrong format specifier 2024-11-12 15:48:08 +01:00
tee tee: optee: Fix supplicant wait loop 2025-02-14 15:17:34 +01:00
thermal thermal/cpufreq_cooling: Remove structure member documentation 2025-02-11 21:02:13 +01:00
thunderbolt Driver core and debugfs updates 2025-01-28 12:25:12 -08:00
tty Serial driver fixes for 6.14-rc3 2025-02-16 12:50:44 -08:00
ufs scsi: ufs: core: bsg: Fix crash when arpmb command fails 2025-02-20 22:18:24 -05:00
uio Char/Misc/IIO driver updates for 6.14-rc1 2025-01-27 16:51:51 -08:00
usb usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY 2025-02-14 09:26:44 +01:00
vdpa virtio: features, fixes, cleanups 2025-01-27 15:26:06 -08:00
vfio VFIO updates for v6.14-rc1 2025-01-28 14:16:46 -08:00
vhost vhost/net: Set num_buffers for virtio 1.0 2025-01-27 09:39:25 -05:00
video fbdev fixes and updates for 6.14-rc1: 2025-01-24 11:32:13 -08:00
virt - A segmented Reverse Map table (RMP) is a across-nodes distributed 2025-01-21 09:00:31 -08:00
virtio virtio: features, fixes, cleanups 2025-01-27 15:26:06 -08:00
w1 1-Wire bus drivers for v6.14 2025-01-09 10:54:19 +01:00
watchdog linux-watchdog 6.14-rc1 tag 2025-01-25 16:19:10 -08:00
xen xen: branch for v6.14-rc3 2025-02-14 08:15:17 -08:00
zorro zorro: Constify 'struct bin_attribute' 2025-01-08 18:04:36 +01:00
Kconfig - removed AR7 platform support 2023-11-10 09:19:46 -08:00
Makefile leds: Init leds class earlier 2024-09-04 17:24:58 -05:00