From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 86299346E51; Fri, 21 Nov 2025 13:17:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763731052; cv=none; b=U2EziaPGrPZXw8D1WJ3A2jnBt5mizq/JMJwAFIaXkEK2WgLexrlttVBOWJZNAoqyWOvEJKlCgwyHeY8CfHBGsUbAss0RzXYztIMIwM/cn6Upgq/R3odLar07/D0uuJFdXNgGfcg6qeCmersf6pOpMIRiSuqmi4nJ5D8f4me8cTc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763731052; c=relaxed/simple; bh=lC1vMU7fxTnwGdRr1HerRWEMozFRNnqgwzW1A4iKshY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mgfUJVWuFYu70Lg/h4ASFhy0AELLAXh+0DSGCQIrTRAiFqY4cl90meodTGWbcWwltmu7iTDvuJeG4BUFjlSXgTi2ySfkkYSlGd6njsOM27oau1em2FvZ7a0zmPwf49vYwci3S3MZkE+OfinjtPtx4PrbQJbfFSy5C1xAI2+luMM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=gCXapFJI; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="gCXapFJI" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C1D3C4CEF1; Fri, 21 Nov 2025 13:17:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1763731052; bh=lC1vMU7fxTnwGdRr1HerRWEMozFRNnqgwzW1A4iKshY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gCXapFJI9PquoK0w9a5AY3cG/gtA1IR+8AbKseO8iINjyzlpPXgVH6bdTfzDS6fKq ggAATh850x/y0ugIHU4RUz7d5of/zfziDdfy0+03vxD9LbpHLoNWYJL08u2m9lhBSy DBJ6+n/OA1hKLjSVU/JJApwtESgUhEa4gC7FOsO4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com, Ranganath V N , Eric Dumazet , Cong Wang , Paolo Abeni , Sasha Levin Subject: [PATCH 6.17 073/247] net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak Date: Fri, 21 Nov 2025 14:10:20 +0100 Message-ID: <20251121130157.218742497@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20251121130154.587656062@linuxfoundation.org> References: <20251121130154.587656062@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.17-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ranganath V N [ Upstream commit ce50039be49eea9b4cd8873ca6eccded1b4a130a ] Fix a KMSAN kernel-infoleak detected by the syzbot . [net?] KMSAN: kernel-infoleak in __skb_datagram_iter In tcf_ife_dump(), the variable 'opt' was partially initialized using a designatied initializer. While the padding bytes are reamined uninitialized. nla_put() copies the entire structure into a netlink message, these uninitialized bytes leaked to userspace. Initialize the structure with memset before assigning its fields to ensure all members and padding are cleared prior to beign copied. This change silences the KMSAN report and prevents potential information leaks from the kernel memory. This fix has been tested and validated by syzbot. This patch closes the bug reported at the following syzkaller link and ensures no infoleak. Reported-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0c85cae3350b7d486aee Tested-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com Fixes: ef6980b6becb ("introduce IFE action") Signed-off-by: Ranganath V N Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251109091336.9277-3-vnranganath.20@gmail.com Acked-by: Cong Wang Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin --- net/sched/act_ife.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c index 107c6d83dc5c4..7c6975632fc2e 100644 --- a/net/sched/act_ife.c +++ b/net/sched/act_ife.c @@ -644,13 +644,15 @@ static int tcf_ife_dump(struct sk_buff *skb, struct tc_action *a, int bind, unsigned char *b = skb_tail_pointer(skb); struct tcf_ife_info *ife = to_ife(a); struct tcf_ife_params *p; - struct tc_ife opt = { - .index = ife->tcf_index, - .refcnt = refcount_read(&ife->tcf_refcnt) - ref, - .bindcnt = atomic_read(&ife->tcf_bindcnt) - bind, - }; + struct tc_ife opt; struct tcf_t t; + memset(&opt, 0, sizeof(opt)); + + opt.index = ife->tcf_index, + opt.refcnt = refcount_read(&ife->tcf_refcnt) - ref, + opt.bindcnt = atomic_read(&ife->tcf_bindcnt) - bind, + spin_lock_bh(&ife->tcf_lock); opt.action = ife->tcf_action; p = rcu_dereference_protected(ife->params, -- 2.51.0