On Fri, Feb 28, 2025 at 10:14:08PM +0800, Jiayuan Chen wrote: > Syzbot caught an "KMSAN: uninit-value" warning [1], which is caused by the > ppp driver not initializing a 2-byte header when using socket filter. > > The following code can generate a PPP filter BPF program: > ''' > struct bpf_program fp; > pcap_t *handle; > handle = pcap_open_dead(DLT_PPP_PPPD, 65535); > pcap_compile(handle, &fp, "ip and outbound", 0, 0); > bpf_dump(&fp, 1); > ''' > Its output is: > ''' > (000) ldh [2] > (001) jeq #0x21 jt 2 jf 5 > (002) ldb [0] > (003) jeq #0x1 jt 4 jf 5 > (004) ret #65535 > (005) ret #0 > ''' > Wen can find similar code at the following link: > https://github.com/ppp-project/ppp/blob/master/pppd/options.c#L1680 > The maintainer of this code repository is also the original maintainer > of the ppp driver. > > As you can see the BPF program skips 2 bytes of data and then reads the > 'Protocol' field to determine if it's an IP packet. Then it read the first > byte of the first 2 bytes to determine the direction. > > The issue is that only the first byte indicating direction is initialized > in current ppp driver code while the second byte is not initialized. > > For normal BPF programs generated by libpcap, uninitialized data won't be > used, so it's not a problem. However, for carefully crafted BPF programs, > such as those generated by syzkaller [2], which start reading from offset > 0, the uninitialized data will be used and caught by KMSAN. > > [1] https://syzkaller.appspot.com/bug?extid=853242d9c9917165d791 > [2] https://syzkaller.appspot.com/text?tag=ReproC&x=11994913980000 > > Cc: Paul Mackerras <paulus@xxxxxxxxx> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Reported-by: syzbot+853242d9c9917165d791@xxxxxxxxxxxxxxxxxxxxxxxxx > Closes: https://lore.kernel.org/bpf/000000000000dea025060d6bc3bc@xxxxxxxxxx/ > Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx> Reviewed-by: Simon Horman <horms@xxxxxxxxxx>
