From: Guillaume Nault <g.nault@alphalink.fr>
To: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Alexander Potapenko <glider@google.com>,
syzbot+f5f6080811c849739212@syzkaller.appspotmail.com,
LKML <linux-kernel@vger.kernel.org>,
mostrows@earthlink.net, Networking <netdev@vger.kernel.org>,
syzkaller-bugs@googlegroups.com
Subject: Re: KMSAN: uninit-value in pppoe_rcv
Date: Tue, 18 Sep 2018 18:52:54 +0200 [thread overview]
Message-ID: <20180918165254.GB1473@alphalink.fr> (raw)
In-Reply-To: <7424e094-afda-084a-ad80-299f219ced92@gmail.com>
On Thu, Sep 13, 2018 at 06:57:54AM -0700, Eric Dumazet wrote:
>
>
> I guess the following patch would fix the issue
>
> (I will submit it more formally)
>
Hi Eric,
Do you still plan to submit this patch? Otherwise I can take care of it.
> diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
> index ce61231e96ea5fe27f512fbd0d80d4609997e508..333e967ed968ea3ff2dda25289f7f657263db2b9 100644
> --- a/drivers/net/ppp/pppoe.c
> +++ b/drivers/net/ppp/pppoe.c
> @@ -423,6 +423,7 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
> struct pppoe_hdr *ph;
> struct pppox_sock *po;
> struct pppoe_net *pn;
> + __be16 sid;
> int len;
>
> skb = skb_share_check(skb, GFP_ATOMIC);
> @@ -434,6 +435,7 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
>
> ph = pppoe_hdr(skb);
> len = ntohs(ph->length);
> + sid = ph->sid;
>
> skb_pull_rcsum(skb, sizeof(*ph));
> if (skb->len < len)
> @@ -447,7 +449,7 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
> /* Note that get_item does a sock_hold(), so sk_pppox(po)
> * is known to be safe.
> */
> - po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
> + po = get_item(pn, sid, eth_hdr(skb)->h_source, dev->ifindex);
> if (!po)
> goto drop;
>
>
>
next prev parent reply other threads:[~2018-09-18 16:53 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-12 10:24 KMSAN: uninit-value in pppoe_rcv syzbot
2018-09-12 10:38 ` Alexander Potapenko
2018-09-13 13:57 ` Eric Dumazet
2018-09-13 14:12 ` Alexander Potapenko
2018-09-13 16:19 ` Guillaume Nault
2018-09-13 17:23 ` Guillaume Nault
2018-09-13 17:31 ` Eric Dumazet
2018-09-13 16:35 ` Eric Dumazet
2018-09-18 16:52 ` Guillaume Nault [this message]
2018-09-18 17:03 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180918165254.GB1473@alphalink.fr \
--to=g.nault@alphalink.fr \
--cc=eric.dumazet@gmail.com \
--cc=glider@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mostrows@earthlink.net \
--cc=netdev@vger.kernel.org \
--cc=syzbot+f5f6080811c849739212@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).