Commit bf9a3880 authored by Mashiro Chen's avatar Mashiro Chen Committed by Jakub Kicinski
Browse files

net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf 



sixpack_receive_buf() does not properly skip bytes with TTY error flags.
The while loop iterates through the flags buffer but never advances the
data pointer (cp), and passes the original count (including error bytes)
to sixpack_decode(). This causes sixpack_decode() to process bytes that
should have been skipped due to TTY errors.  The TTY layer does not
guarantee that cp[i] holds a meaningful value when fp[i] is set, so
passing those positions to sixpack_decode() results in KMSAN reporting
an uninit-value read.

Fix this by processing bytes one at a time, advancing cp on each
iteration, and only passing valid (non-error) bytes to sixpack_decode().
This matches the pattern used by slip_receive_buf() and
mkiss_receive_buf() for the same purpose.

Reported-by: default avatar <syzbot+ecdb8c9878a81eb21e54@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=ecdb8c9878a81eb21e54


Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarMashiro Chen <mashiro.chen@mailbox.org>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260407173101.107352-1-mashiro.chen@mailbox.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 12ff2a4a

drivers/net/hamradio/6pack.c

+4 −5
Original line number Diff line number Diff line
@@ -391,7 +391,6 @@ static void sixpack_receive_buf(struct tty_struct *tty, const u8 *cp, 
				const u8 *fp, size_t count)

{

	struct sixpack *sp;

	size_t count1;



	if (!count)

		return;
@@ -401,16 +400,16 @@ static void sixpack_receive_buf(struct tty_struct *tty, const u8 *cp, 
		return;



	/* Read the characters out of the buffer */

	count1 = count;

	while (count) {

		count--;

	while (count--) {

		if (fp && *fp++) {

			if (!test_and_set_bit(SIXPF_ERROR, &sp->flags))

				sp->dev->stats.rx_errors++;

			cp++;

			continue;

		}

		sixpack_decode(sp, cp, 1);

		cp++;

	}

	sixpack_decode(sp, cp, count1);



	tty_unthrottle(tty);

}