From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 96DC5353EDF; Tue, 21 Jul 2026 22:45:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784673907; cv=none; b=dvTRRNXG/zHFOqIa197XpzHX/89RrTkPslJ1sJjRfF65Orxrjc/1TjfMh6f5J2QdvMToX/F3uUJbXpjoL8QYLJg5VHA1faV2VEynT7PACAe6iKYO6dZoFEkTzT+XMBgeIomJMtwMQ981/xoNML4TjVrK23ONAC+Q28a6i3jRDS8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784673907; c=relaxed/simple; bh=/4fvw7HOtIoo+j62jpI181vwv8LoP8NUp53zMYdO84g=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZOrc1mOygM91bYuRNUrNOUGLWGBgybRq0B24A9u+Pr5pI2y2E9zHfgrIfVdtJERGSKiVgcLudHgvPeJfLIEZRaQUWfaprEtPfAK87DM1UIfDRXD41cYCFWk3ztSs08eDVXnsgJsSyUtu6VcF61vqNecatj8IlaQ8T+y+uvV2j78= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JJpn4sAK; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="JJpn4sAK" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 090CF1F000E9; Tue, 21 Jul 2026 22:45:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784673906; bh=GrYs5qJzMFAK/CDosoN6daJULl/wkJM4tMyBx8Txlec=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=JJpn4sAK4gIbgcRogcfSUjr4tWPftBMGll3be2jKGvC4NZLIhegRKY8hh1afcHEl2 rs3f7ZVR+ZgG0rS7PkEnFXJviqCFyeUX6r6VEj9xLhjqy5WXfjOeKAJ39fHtHWSkob 2N0ksj3M1caLF3tCKaGkkHgpgvHt4hzc6U0mEKjE= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Weiming Shi , Jiri Pirko , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.10 340/699] net: psample: fix info leak in PSAMPLE_ATTR_DATA Date: Tue, 21 Jul 2026 17:21:39 +0200 Message-ID: <20260721152403.362365774@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152355.667394603@linuxfoundation.org> References: <20260721152355.667394603@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jakub Kicinski [ Upstream commit aedd02af1f8b0bceb7f42f5a21c41634ca9ed390 ] psample open codes nla_put() presumably to avoid wiping the data with 0s just to override it with packet data. This open coding is missing clearing the pad, however, each netlink attr is padded to 4B and data_len may not be divisible by 4B. Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling") Reported-by: Weiming Shi Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20260616003046.1099490-1-kuba@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/psample/psample.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/psample/psample.c b/net/psample/psample.c index 5913da77c71d2e..ef5b437804731e 100644 --- a/net/psample/psample.c +++ b/net/psample/psample.c @@ -425,15 +425,17 @@ void psample_sample_packet(struct psample_group *group, struct sk_buff *skb, goto error; if (data_len) { - int nla_len = nla_total_size(data_len); + int nla_len = nla_attr_size(data_len); struct nlattr *nla; nla = skb_put(nl_skb, nla_len); nla->nla_type = PSAMPLE_ATTR_DATA; - nla->nla_len = nla_attr_size(data_len); + nla->nla_len = nla_len; if (skb_copy_bits(skb, 0, nla_data(nla), data_len)) goto error; + + skb_put_zero(nl_skb, nla_padlen(data_len)); } #ifdef CONFIG_INET -- 2.53.0