On Wed, 26 Feb 2025 09:36:58 +0800 Jiayuan Chen wrote: > The PPP driver adds an extra 2-byte header to enable socket filters to run > correctly. However, the driver only initializes the first byte, which > indicates the direction. For normal BPF programs, this is not a problem > since they only read the first byte. > > Nevertheless, for carefully crafted BPF programs, if they read the second > byte, this will trigger a KMSAN warning for reading uninitialized data. > > Reported-by: syzbot+853242d9c9917165d791@xxxxxxxxxxxxxxxxxxxxxxxxx > Closes: https://lore.kernel.org/bpf/000000000000dea025060d6bc3bc@xxxxxxxxxx/ > Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx> Could you add: Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") And combine the cover letter with the commit message? For a single-patch postings cover letter is not necessary. > + *(__be16 *)skb_push(skb, 2) = htons(PPP_FILTER_OUTBOUND_TAG); > if (ppp->pass_filter && > bpf_prog_run(ppp->pass_filter, skb) == 0) { > if (ppp->debug & 1) The exact same problem seems to be present in ppp_receive_nonmp_frame() please fix them both. -- pw-bot: cr
