[PATCH] xfrm: clear trailing padding in build_polexpire()

[PATCH] xfrm: clear trailing padding in build_polexpire()

[Yasuaki Torimaru]

build_expire() clears the trailing padding bytes of struct
xfrm_user_expire after setting the hard field via memset_after(),
but the analogous function build_polexpire() does not do this for
struct xfrm_user_polexpire.

The 7 bytes of padding after the __u8 hard field are left
uninitialized from the heap allocation, and are then sent to
userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,
leaking kernel heap memory contents.

Add the missing memset_after() call, matching build_expire().

Signed-off-by: Yasuaki Torimaru <yasuakitorimaru@gmail.com>
---
 net/xfrm/xfrm_user.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 403b5ecac..ee31ef482 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -3948,6 +3948,8 @@ static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
 		return err;
 	}
 	upe->hard = !!hard;
+	/* clear the padding bytes */
+	memset_after(upe, 0, hard);
 
 	nlmsg_end(skb, nlh);
 	return 0;
-- 
2.50.1

Re: [PATCH] xfrm: clear trailing padding in build_polexpire()

[Steffen Klassert]

On Sun, Mar 22, 2026 at 06:04:21AM +0900, Yasuaki Torimaru wrote:
> build_expire() clears the trailing padding bytes of struct
> xfrm_user_expire after setting the hard field via memset_after(),
> but the analogous function build_polexpire() does not do this for
> struct xfrm_user_polexpire.
> 
> The 7 bytes of padding after the __u8 hard field are left
> uninitialized from the heap allocation, and are then sent to
> userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,
> leaking kernel heap memory contents.
> 
> Add the missing memset_after() call, matching build_expire().
> 
> Signed-off-by: Yasuaki Torimaru <yasuakitorimaru@gmail.com>

Can you please add a 'Fixes:' tag, so it can be backported?

Thanks!

[PATCH v2] xfrm: clear trailing padding in build_polexpire()

[Yasuaki Torimaru]

build_expire() clears the trailing padding bytes of struct
xfrm_user_expire after setting the hard field via memset_after(),
but the analogous function build_polexpire() does not do this for
struct xfrm_user_polexpire.

The padding bytes after the __u8 hard field are left
uninitialized from the heap allocation, and are then sent to
userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,
leaking kernel heap memory contents.

Add the missing memset_after() call, matching build_expire().

Fixes: e3e5fc1698ae ("xfrm_user: fix info leak in build_expire()")
Cc: stable@vger.kernel.org
Signed-off-by: Yasuaki Torimaru <yasuakitorimaru@gmail.com>
---
Verified with pahole (struct xfrm_user_polexpire):
- x86_64:       sizeof=176, padding=7
- i386:         sizeof=168, padding=3
- aarch64:      sizeof=176, padding=7
- armv7l (hf):  sizeof=176, padding=7
 net/xfrm/xfrm_user.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 403b5ecac2c5..ee31ef482be4 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -3948,6 +3948,8 @@ static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
 		return err;
 	}
 	upe->hard = !!hard;
+	/* clear the padding bytes */
+	memset_after(upe, 0, hard);
 
 	nlmsg_end(skb, nlh);
 	return 0;
-- 
2.50.1

Re: [PATCH v2] xfrm: clear trailing padding in build_polexpire()

[Simon Horman]

On Tue, Mar 24, 2026 at 10:37:42AM +0900, Yasuaki Torimaru wrote:
> build_expire() clears the trailing padding bytes of struct
> xfrm_user_expire after setting the hard field via memset_after(),
> but the analogous function build_polexpire() does not do this for
> struct xfrm_user_polexpire.
> 
> The padding bytes after the __u8 hard field are left
> uninitialized from the heap allocation, and are then sent to
> userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,
> leaking kernel heap memory contents.
> 
> Add the missing memset_after() call, matching build_expire().
> 
> Fixes: e3e5fc1698ae ("xfrm_user: fix info leak in build_expire()")

I think the Fixes tag should cite the patch that introduced the bug. The
commit cited above looks like a related fix, but no the cause of the bug.

> Cc: stable@vger.kernel.org
> Signed-off-by: Yasuaki Torimaru <yasuakitorimaru@gmail.com>
> ---
> Verified with pahole (struct xfrm_user_polexpire):
> - x86_64:       sizeof=176, padding=7
> - i386:         sizeof=168, padding=3
> - aarch64:      sizeof=176, padding=7
> - armv7l (hf):  sizeof=176, padding=7
>  net/xfrm/xfrm_user.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
> index 403b5ecac2c5..ee31ef482be4 100644
> --- a/net/xfrm/xfrm_user.c
> +++ b/net/xfrm/xfrm_user.c
> @@ -3948,6 +3948,8 @@ static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
>  		return err;
>  	}
>  	upe->hard = !!hard;
> +	/* clear the padding bytes */
> +	memset_after(upe, 0, hard);
>  
>  	nlmsg_end(skb, nlh);
>  	return 0;
> -- 
> 2.50.1
> 

Re: [PATCH v2] xfrm: clear trailing padding in build_polexpire()

[Yasuaki Torimaru]

On Thu, 27 Mar 2026, Simon Horman wrote:
> I think the Fixes tag should cite the patch that introduced the bug. The
> commit cited above looks like a related fix, but no the cause of the bug.

You're right. build_polexpire() has existed since the initial
import (1da177e4c3f4), so the padding has been uninitialized from
the beginning. Sending v3 with the corrected Fixes tag.

Re: [PATCH v2] xfrm: clear trailing padding in build_polexpire()

[Yasuaki Torimaru]

On Thu, 27 Mar 2026, Simon Horman wrote:
> I think the Fixes tag should cite the patch that introduced the bug. The
> commit cited above looks like a related fix, but no the cause of the bug.

You're right. build_polexpire() has existed since the initial
import (1da177e4c3f4), so the padding has been uninitialized from
the beginning. Sending v3 with the corrected Fixes tag.