Re: [syzbot] [net?] KMSAN: uninit-value in __llc_lookup_established

From: syzbot
Date: Wed Dec 06 2023 - 03:13:54 EST


For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx.

***

Subject: [net?] KMSAN: uninit-value in __llc_lookup_established
Author: eadavis@xxxxxx

please test uninit-value in __llc_lookup_established

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 1c41041124bd

diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h
index 7e73f8e5e497..cba149476e41 100644
--- a/include/net/llc_pdu.h
+++ b/include/net/llc_pdu.h
@@ -262,7 +262,8 @@ static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type,
*/
static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa)
{
- if (skb->protocol == htons(ETH_P_802_2))
+ if (skb->protocol == htons(ETH_P_802_2) ||
+ skb->protocol == htons(ETH_P_TR_802_2))
memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN);
}

@@ -275,7 +276,8 @@ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa)
*/
static inline void llc_pdu_decode_da(struct sk_buff *skb, u8 *da)
{
- if (skb->protocol == htons(ETH_P_802_2))
+ if (skb->protocol == htons(ETH_P_802_2) ||
+ skb->protocol == htons(ETH_P_TR_802_2))
memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN);
}

diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index 51bccfb00a9c..ed1a2b59b40c 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -126,7 +126,8 @@ static inline int llc_fixup_skb(struct sk_buff *skb)

skb->transport_header += llc_len;
skb_pull(skb, llc_len);
- if (skb->protocol == htons(ETH_P_802_2)) {
+ if (skb->protocol == htons(ETH_P_802_2) ||
+ skb->protocol == htons(ETH_P_TR_802_2)) {
__be16 pdulen;
s32 data_size;