netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] net: core: Initialize new header to zero in pskb_expand_head
@ 2025-11-06 19:24 Prithvi Tambewagh
  2025-11-07  0:57 ` Jakub Kicinski
  2025-11-11  7:40 ` kernel test robot
  0 siblings, 2 replies; 4+ messages in thread
From: Prithvi Tambewagh @ 2025-11-06 19:24 UTC (permalink / raw)
  To: davem, edumazet, kuba, pabeni, horms, alexanderduyck, chuck.lever,
	linyunsheng
  Cc: netdev, linux-kernel, skhan, david.hunter.linux, khalid,
	linux-kernel-mentees, Prithvi Tambewagh,
	syzbot+4b8a1e4690e64b018227

KMSAN reports uninitialized value in can_receive(). The crash trace shows
the uninitialized value was created in pskb_expand_head(). This function
expands header of a socket buffer using kmalloc_reserve() which doesn't
zero-initialize the memory. When old packet data is copied to the new
buffer at an offset of data+nhead, new header area (first nhead bytes of
the new buffer) are left uninitialized. This is fixed by using memset()
to zero-initialize this header of the new buffer.

Reported-by: syzbot+4b8a1e4690e64b018227@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4b8a1e4690e64b018227
Signed-off-by: Prithvi Tambewagh <activprithvi@gmail.com>
---
 net/core/skbuff.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 6841e61a6bd0..3486271260ac 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2282,6 +2282,8 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 	 */
 	memcpy(data + nhead, skb->head, skb_tail_pointer(skb) - skb->head);
 
+	memset(data, 0, size);
+
 	memcpy((struct skb_shared_info *)(data + size),
 	       skb_shinfo(skb),
 	       offsetof(struct skb_shared_info, frags[skb_shinfo(skb)->nr_frags]));
-- 
2.34.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2025-11-11  7:41 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-06 19:24 [PATCH] net: core: Initialize new header to zero in pskb_expand_head Prithvi Tambewagh
2025-11-07  0:57 ` Jakub Kicinski
2025-11-07 17:54   ` Shuah Khan
2025-11-11  7:40 ` kernel test robot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).