From: Eric Dumazet <edumazet@google.com>

Date: Tue, 16 May 2023 14:23:42 +0000

Subject: [PATCH] vlan: fix a potential uninit-value in

 vlan_dev_hard_start_xmit()

References: bsc#1012628

Patch-mainline: 6.3.4

Git-commit: dacab578c7c6cd06c50c89dfa36b0e0f10decd4e

[ Upstream commit dacab578c7c6cd06c50c89dfa36b0e0f10decd4e ]

syzbot triggered the following splat [1], sending an empty message

through pppoe_sendmsg().

When VLAN_FLAG_REORDER_HDR flag is set, vlan_dev_hard_header()

does not push extra bytes for the VLAN header, because vlan is offloaded.

Unfortunately vlan_dev_hard_start_xmit() first reads veth->h_vlan_proto

before testing (vlan->flags & VLAN_FLAG_REORDER_HDR).

We need to swap the two conditions.

[1]

BUG: KMSAN: uninit-value in vlan_dev_hard_start_xmit+0x171/0x7f0 net/8021q/vlan_dev.c:111

vlan_dev_hard_start_xmit+0x171/0x7f0 net/8021q/vlan_dev.c:111

__netdev_start_xmit include/linux/netdevice.h:4883 [inline]

netdev_start_xmit include/linux/netdevice.h:4897 [inline]

xmit_one net/core/dev.c:3580 [inline]

dev_hard_start_xmit+0x253/0xa20 net/core/dev.c:3596

__dev_queue_xmit+0x3c7f/0x5ac0 net/core/dev.c:4246

dev_queue_xmit include/linux/netdevice.h:3053 [inline]

pppoe_sendmsg+0xa93/0xb80 drivers/net/ppp/pppoe.c:900

sock_sendmsg_nosec net/socket.c:724 [inline]

sock_sendmsg net/socket.c:747 [inline]

____sys_sendmsg+0xa24/0xe40 net/socket.c:2501

___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555

__sys_sendmmsg+0x411/0xa50 net/socket.c:2641

__do_sys_sendmmsg net/socket.c:2670 [inline]

__se_sys_sendmmsg net/socket.c:2667 [inline]

__x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2667

do_syscall_x64 arch/x86/entry/common.c:50 [inline]

do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80

entry_SYSCALL_64_after_hwframe+0x63/0xcd

Uninit was created at:

slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:774

slab_alloc_node mm/slub.c:3452 [inline]

kmem_cache_alloc_node+0x543/0xab0 mm/slub.c:3497

kmalloc_reserve+0x148/0x470 net/core/skbuff.c:520

__alloc_skb+0x3a7/0x850 net/core/skbuff.c:606

alloc_skb include/linux/skbuff.h:1277 [inline]

sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2583

pppoe_sendmsg+0x3af/0xb80 drivers/net/ppp/pppoe.c:867

sock_sendmsg_nosec net/socket.c:724 [inline]

sock_sendmsg net/socket.c:747 [inline]

____sys_sendmsg+0xa24/0xe40 net/socket.c:2501

___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2555

__sys_sendmmsg+0x411/0xa50 net/socket.c:2641

__do_sys_sendmmsg net/socket.c:2670 [inline]

__se_sys_sendmmsg net/socket.c:2667 [inline]

__x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2667

do_syscall_x64 arch/x86/entry/common.c:50 [inline]

do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80

entry_SYSCALL_64_after_hwframe+0x63/0xcd

CPU: 0 PID: 29770 Comm: syz-executor.0 Not tainted 6.3.0-rc6-syzkaller-gc478e5b17829 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

Reported-by: syzbot <syzkaller@googlegroups.com>

Signed-off-by: Eric Dumazet <edumazet@google.com>

Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Sasha Levin <sashal@kernel.org>

Signed-off-by: Jiri Slaby <jslaby@suse.cz>

---

 net/8021q/vlan_dev.c | 4 ++--

 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c

index 5920544e..0fa52bcc 100644

--- a/net/8021q/vlan_dev.c

+++ b/net/8021q/vlan_dev.c

@@ -108,8 +108,8 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,

 	 * NOTE: THIS ASSUMES DIX ETHERNET, SPECIFICALLY NOT SUPPORTING

 	 * OTHER THINGS LIKE FDDI/TokenRing/802.3 SNAPs...

 	 */

-	if (veth->h_vlan_proto != vlan->vlan_proto ||

-	    vlan->flags & VLAN_FLAG_REORDER_HDR) {

+	if (vlan->flags & VLAN_FLAG_REORDER_HDR ||

+	    veth->h_vlan_proto != vlan->vlan_proto) {

 		u16 vlan_tci;

 		vlan_tci = vlan->vlan_id;

 		vlan_tci |= vlan_dev_get_egress_qos_mask(dev, skb->priority);

-- 

2.35.3