[PATCH net v3] xfrm: clear trailing padding in build_polexpire()

[PATCH net v3] xfrm: clear trailing padding in build_polexpire()

[Yasuaki Torimaru]

build_expire() clears the trailing padding bytes of struct
xfrm_user_expire after setting the hard field via memset_after(),
but the analogous function build_polexpire() does not do this for
struct xfrm_user_polexpire.

The padding bytes after the __u8 hard field are left
uninitialized from the heap allocation, and are then sent to
userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,
leaking kernel heap memory contents.

Add the missing memset_after() call, matching build_expire().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Yasuaki Torimaru <yasuakitorimaru@gmail.com>
---
v3:
  - fix Fixes tag to cite the commit that introduced the bug
    (was: e3e5fc1698ae which fixed the related build_expire() function)
v2: https://lore.kernel.org/netdev/20260324013742.939533-1-yasuakitorimaru@gmail.com/
  - add Fixes tag and Cc stable (requested by Steffen Klassert)
v1: https://lore.kernel.org/netdev/20260321210421.2504711-1-yasuakitorimaru@gmail.com/

 net/xfrm/xfrm_user.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 403b5ecac2c5..ee31ef482be4 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -3948,6 +3948,8 @@ static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
 		return err;
 	}
 	upe->hard = !!hard;
+	/* clear the padding bytes */
+	memset_after(upe, 0, hard);
 
 	nlmsg_end(skb, nlh);
 	return 0;
-- 
2.50.1

Re: [PATCH net v3] xfrm: clear trailing padding in build_polexpire()

[Simon Horman]

On Thu, Mar 26, 2026 at 02:58:00PM +0900, Yasuaki Torimaru wrote:
> build_expire() clears the trailing padding bytes of struct
> xfrm_user_expire after setting the hard field via memset_after(),
> but the analogous function build_polexpire() does not do this for
> struct xfrm_user_polexpire.
> 
> The padding bytes after the __u8 hard field are left
> uninitialized from the heap allocation, and are then sent to
> userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,
> leaking kernel heap memory contents.
> 
> Add the missing memset_after() call, matching build_expire().
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yasuaki Torimaru <yasuakitorimaru@gmail.com>
> ---
> v3:
>   - fix Fixes tag to cite the commit that introduced the bug
>     (was: e3e5fc1698ae which fixed the related build_expire() function)
> v2: https://lore.kernel.org/netdev/20260324013742.939533-1-yasuakitorimaru@gmail.com/
>   - add Fixes tag and Cc stable (requested by Steffen Klassert)
> v1: https://lore.kernel.org/netdev/20260321210421.2504711-1-yasuakitorimaru@gmail.com/

Thanks for the updates.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net v3] xfrm: clear trailing padding in build_polexpire()

[Breno Leitao]

On Thu, Mar 26, 2026 at 02:58:00PM +0900, Yasuaki Torimaru wrote:
> build_expire() clears the trailing padding bytes of struct
> xfrm_user_expire after setting the hard field via memset_after(),
> but the analogous function build_polexpire() does not do this for
> struct xfrm_user_polexpire.
> 
> The padding bytes after the __u8 hard field are left
> uninitialized from the heap allocation, and are then sent to
> userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,
> leaking kernel heap memory contents.
> 
> Add the missing memset_after() call, matching build_expire().
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yasuaki Torimaru <yasuakitorimaru@gmail.com>

Reviewed-by: Breno Leitao <leitao@debian.org>