Received: by 2002:ac0:bc90:0:0:0:0:0 with SMTP id a16csp675064img; Fri, 22 Mar 2019 06:22:03 -0700 (PDT) X-Google-Smtp-Source: APXvYqzcF62Il1XmTwmg4pDd2ZV7jFuBlkFdDXwWg7VWOiuMqnrc8h8Mpe0fv4hIxk9CaLoEJkk6 X-Received: by 2002:a63:54b:: with SMTP id 72mr8109089pgf.323.1553260923703; Fri, 22 Mar 2019 06:22:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553260923; cv=none; d=google.com; s=arc-20160816; b=W7qJO0dLSHeNB9UUeiUba4kORpghGGQSjqGAv03Rx8wedwfQnM+kXyYdyikNLuqse9 VT45ScwK5SqfQMB+KS/X8/o/gr4gYC68XX6PY4nGdfRu4syDM5k6+t12IcofqmJPZHYX hXyVWpoqwj5OjDZkopNdEeOc8KxyEFSCFmqydNkGABRW/izN+mEsakpFLcjnrSfWt9JL 4Dlytkx2ydMC17hqoAiMWuXfOzvPPcWFe+qLqyyEu7cq7JzVyRxtdJ7BoT8DhueYtQCp QCqo2U/7YG8AsGlgYQpJ4f8HPaHt/Bhm2DTUtdJ+46oPzW429QcK4RfU9/KxloGVyFS9 PLyw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=q/Zrklf47k5X8oNKYMC65pIojva/qEhtmfOMVkLJOFs=; b=HPxk5gtp72iwAC0zReKAhIa2hJZ9c0wXRKmhwLp5Sljysci6njRwWgMQATFzVcAhGT HD89t727qgsxdXkzgSTNP1zceT9vOTsEZagF0dIu9wVYyePQ+A0yzCzAuAX+Hfb5zxbV ZIg/X+2FMmBDekMm9+iC+/VTsJ/3Dqhcai2DsVwbpBK9ldemJwc4CA0ZWbG2ba8fgfs/ JYcA6Ajtmo3TGqnkuSfCH2jUHiJpkpawSP5/0EZ2/x6mJDWBApEm8Q0B912U+6rAFOjO QPvpTnzWuaPe1zjwn0pb080DGSZUCOkQInmEopslXP0SvYXw506dZEC3l8hzevMVBARM SfTw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=y7aR1fzZ; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id a14si6595788pgd.176.2019.03.22.06.21.48; Fri, 22 Mar 2019 06:22:03 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=y7aR1fzZ; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728252AbfCVLVV (ORCPT + 99 others); Fri, 22 Mar 2019 07:21:21 -0400 Received: from mail.kernel.org ([198.145.29.99]:47792 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728566AbfCVLVT (ORCPT ); Fri, 22 Mar 2019 07:21:19 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5DACD21929; Fri, 22 Mar 2019 11:21:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553253677; bh=lRONi4mE+VcpqLNz8wGhUHi1FFbYYfH6NnKCp4WjAyA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=y7aR1fzZc7kg8fyjdSMtqHsfI5Bw59MpPIIi7Mb/Gb4jqxwrc3F01zZmIIQGCBJTW fKyuj0vA6bHgT9XV7rv6Ct3LHIlKlXU/7hrYtmj9OeU0/EaSBUyykeVY7QJtDPV4pH l1dmBZkPrm1PIajjLq9fFgqE2gEzaF9MzWclGdnY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , Marek Lindner , Simon Wunderlich , Antonio Quartulli , "David S. Miller" Subject: [PATCH 3.18 020/134] batman-adv: fix uninit-value in batadv_interface_tx() Date: Fri, 22 Mar 2019 12:13:53 +0100 Message-Id: <20190322111211.357856070@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190322111210.465931067@linuxfoundation.org> References: <20190322111210.465931067@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eric Dumazet [ Upstream commit 4ffcbfac60642f63ae3d80891f573ba7e94a265c ] KMSAN reported batadv_interface_tx() was possibly using a garbage value [1] batadv_get_vid() does have a pskb_may_pull() call but batadv_interface_tx() does not actually make sure this did not fail. [1] BUG: KMSAN: uninit-value in batadv_interface_tx+0x908/0x1e40 net/batman-adv/soft-interface.c:231 CPU: 0 PID: 10006 Comm: syz-executor469 Not tainted 4.20.0-rc7+ #5 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x173/0x1d0 lib/dump_stack.c:113 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613 __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:313 batadv_interface_tx+0x908/0x1e40 net/batman-adv/soft-interface.c:231 __netdev_start_xmit include/linux/netdevice.h:4356 [inline] netdev_start_xmit include/linux/netdevice.h:4365 [inline] xmit_one net/core/dev.c:3257 [inline] dev_hard_start_xmit+0x607/0xc40 net/core/dev.c:3273 __dev_queue_xmit+0x2e42/0x3bc0 net/core/dev.c:3843 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3876 packet_snd net/packet/af_packet.c:2928 [inline] packet_sendmsg+0x8306/0x8f30 net/packet/af_packet.c:2953 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] __sys_sendto+0x8c4/0xac0 net/socket.c:1788 __do_sys_sendto net/socket.c:1800 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:1796 __x64_sys_sendto+0x6e/0x90 net/socket.c:1796 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x441889 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffdda6fd468 EFLAGS: 00000216 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000000441889 RDX: 000000000000000e RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000216 R12: 00007ffdda6fd4c0 R13: 00007ffdda6fd4b0 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:204 [inline] kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:158 kmsan_kmalloc+0xa6/0x130 mm/kmsan/kmsan_hooks.c:176 kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:185 slab_post_alloc_hook mm/slab.h:446 [inline] slab_alloc_node mm/slub.c:2759 [inline] __kmalloc_node_track_caller+0xe18/0x1030 mm/slub.c:4383 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0x309/0xa20 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:998 [inline] alloc_skb_with_frags+0x1c7/0xac0 net/core/skbuff.c:5220 sock_alloc_send_pskb+0xafd/0x10e0 net/core/sock.c:2083 packet_alloc_skb net/packet/af_packet.c:2781 [inline] packet_snd net/packet/af_packet.c:2872 [inline] packet_sendmsg+0x661a/0x8f30 net/packet/af_packet.c:2953 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] __sys_sendto+0x8c4/0xac0 net/socket.c:1788 __do_sys_sendto net/socket.c:1800 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:1796 __x64_sys_sendto+0x6e/0x90 net/socket.c:1796 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Marek Lindner Cc: Simon Wunderlich Cc: Antonio Quartulli Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/batman-adv/soft-interface.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/batman-adv/soft-interface.c +++ b/net/batman-adv/soft-interface.c @@ -186,6 +186,8 @@ static int batadv_interface_tx(struct sk switch (ntohs(ethhdr->h_proto)) { case ETH_P_8021Q: + if (!pskb_may_pull(skb, sizeof(*vhdr))) + goto dropped; vhdr = vlan_eth_hdr(skb); if (vhdr->h_vlan_encapsulated_proto != ethertype) {