Re: [syzbot] [net?] KMSAN: uninit-value in __llc_lookup_established

From: syzbot
Date: Wed Dec 06 2023 - 02:08:11 EST


For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx.

***

Subject: [net?] KMSAN: uninit-value in __llc_lookup_established
Author: eadavis@xxxxxx

please test uninit-value in __llc_lookup_established

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 1c41041124bd

diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index 51bccfb00a9c..58e0b8ab41b7 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -126,6 +126,7 @@ static inline int llc_fixup_skb(struct sk_buff *skb)

skb->transport_header += llc_len;
skb_pull(skb, llc_len);
+ printk("3sp: %d, %d, %d\n", skb->protocol, htons(ETH_P_802_2), htons(ETH_P_TR_802_2));
if (skb->protocol == htons(ETH_P_802_2)) {
__be16 pdulen;
s32 data_size;
@@ -141,7 +142,8 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
return 0;
if (unlikely(pskb_trim_rcsum(skb, data_size)))
return 0;
- }
+ } else if (skb->protocol != htons(ETH_P_TR_802_2))
+ return 0;
return 1;
}