From: Simon Horman <horms@kernel•org>
To: Eric Dumazet <edumazet@google•com>
Cc: "David S . Miller" <davem@davemloft•net>,
Jakub Kicinski <kuba@kernel•org>, Paolo Abeni <pabeni@redhat•com>,
netdev@vger•kernel.org, eric.dumazet@gmail•com,
syzbot+1d121645899e7692f92a@syzkaller•appspotmail.com
Subject: Re: [PATCH net] ppp: fix ppp_async_encode() illegal access
Date: Thu, 10 Oct 2024 11:04:02 +0100 [thread overview]
Message-ID: <20241010100402.GE1098236@kernel.org> (raw)
In-Reply-To: <20241009185802.3763282-1-edumazet@google.com>
On Wed, Oct 09, 2024 at 06:58:02PM +0000, Eric Dumazet wrote:
> syzbot reported an issue in ppp_async_encode() [1]
>
> In this case, pppoe_sendmsg() is called with a zero size.
> Then ppp_async_encode() is called with an empty skb.
>
> BUG: KMSAN: uninit-value in ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline]
> BUG: KMSAN: uninit-value in ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675
> ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline]
> ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675
> ppp_async_send+0x130/0x1b0 drivers/net/ppp/ppp_async.c:634
> ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2280 [inline]
> ppp_input+0x1f1/0xe60 drivers/net/ppp/ppp_generic.c:2304
> pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379
> sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113
> __release_sock+0x1da/0x330 net/core/sock.c:3072
> release_sock+0x6b/0x250 net/core/sock.c:3626
> pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903
> sock_sendmsg_nosec net/socket.c:729 [inline]
> __sock_sendmsg+0x30f/0x380 net/socket.c:744
> ____sys_sendmsg+0x903/0xb60 net/socket.c:2602
> ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656
> __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742
> __do_sys_sendmmsg net/socket.c:2771 [inline]
> __se_sys_sendmmsg net/socket.c:2768 [inline]
> __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768
> x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Uninit was created at:
> slab_post_alloc_hook mm/slub.c:4092 [inline]
> slab_alloc_node mm/slub.c:4135 [inline]
> kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4187
> kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587
> __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678
> alloc_skb include/linux/skbuff.h:1322 [inline]
> sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732
> pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867
> sock_sendmsg_nosec net/socket.c:729 [inline]
> __sock_sendmsg+0x30f/0x380 net/socket.c:744
> ____sys_sendmsg+0x903/0xb60 net/socket.c:2602
> ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656
> __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742
> __do_sys_sendmmsg net/socket.c:2771 [inline]
> __se_sys_sendmmsg net/socket.c:2768 [inline]
> __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768
> x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> CPU: 1 UID: 0 PID: 5411 Comm: syz.1.14 Not tainted 6.12.0-rc1-syzkaller-00165-g360c1f1f24c6 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+1d121645899e7692f92a@syzkaller•appspotmail.com
> Signed-off-by: Eric Dumazet <edumazet@google•com>
Reviewed-by: Simon Horman <horms@kernel•org>
next prev parent reply other threads:[~2024-10-10 10:04 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-10-09 18:58 [PATCH net] ppp: fix ppp_async_encode() illegal access Eric Dumazet
2024-10-10 10:04 ` Simon Horman [this message]
2024-10-10 16:10 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20241010100402.GE1098236@kernel.org \
--to=horms@kernel$(echo .)org \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=eric.dumazet@gmail$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=syzbot+1d121645899e7692f92a@syzkaller$(echo .)appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox