Re: [PATCH bpf v1 1/1] bpf: Fix sk_local_storage diag dumping uninitialized special fields

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [Critical] Calling `check_and_init_map_value()` on a netlink payload buffer writes kernel pointers into the message, causing a KASLR bypass.
--

commit 3db95684928f56c741f1722b8018d7049c261634
Author: Amery Hung <ameryhung@gmail.com>

bpf: Fix sk_local_storage diag dumping uninitialized special fields

This commit attempts to prevent uninitialized memory from being leaked to
userspace during socket diag dumps. It calls check_and_init_map_value() on
the netlink payload buffer to initialize special map fields that are skipped
by copy_map_value().

> diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c
> --- a/net/core/bpf_sk_storage.c
> +++ b/net/core/bpf_sk_storage.c
> @@ -558,6 +558,7 @@ static int diag_get(struct bpf_local_storage_data *sdata, struct sk_buff *skb)
>  				      sdata->data, true);
>  	else
>  		copy_map_value(&smap->map, nla_data(nla_value), sdata->data);
> +	check_and_init_map_value(&smap->map, nla_data(nla_value));

Does calling check_and_init_map_value() directly on the netlink payload leak
kernel pointers to userspace?

The function check_and_init_map_value() calls bpf_obj_init() to initialize
the special fields in the map value.

For fields like BPF_LIST_HEAD and BPF_RB_NODE, bpf_obj_init() invokes
initialization macros like INIT_LIST_HEAD() and RB_CLEAR_NODE().

INIT_LIST_HEAD() assigns self-referential pointers to the list structure:

static inline void INIT_LIST_HEAD(struct list_head *list)
{
        WRITE_ONCE(list->next, list);
        WRITE_ONCE(list->prev, list);
}

Because this initialization is performed directly on the allocated netlink
payload inside the socket buffer, valid kernel heap addresses are written
into the message instead of zeros. When this message is sent to userspace,
it leaks the kernel addresses.

>  
>  	nla_nest_end(skb, nla_stg);
>  	return 0;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260423222356.155387-1-ameryhung@gmail.com?part=1