From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4D6D12550DD; Mon, 1 Dec 2025 11:31:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764588701; cv=none; b=cs+GqQk8t7xrnhhgDm3lhKO3XB0Qhifmx7TCR/ifO0Xprs5SnxTaizcF/4+Ki6AOvLcu/r+Ytv6DLIdHN+DIBahpFNm3+escJ7Z0gV33gY+N4pegHHdkVSNKsJQAA0P1KWREx1fOsezqlcx9hkdzSDo5puzB1O2o6t3OMwcdeB8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764588701; c=relaxed/simple; bh=TBGjJBZ57AzQtbf2znI0jXm7gkrzxqocntHfefkamYo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CttK4Goj6+697iwiikM+0wX5wo/5YyTwsHfN6VVDWLVeDPBAfM3sEhbs7Hvst9tU1CGkcSR5KqQEhVDmvG5QfQEMUKeZQf6il6B1sKoMJ0BEHbUPmjfp6+zICPXzWDz++qqv3FG5h7L6PaKgY205LcgW6Z7Bf48WSypFnd9MpPo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=fTbKxwhO; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="fTbKxwhO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C394BC4CEF1; Mon, 1 Dec 2025 11:31:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1764588701; bh=TBGjJBZ57AzQtbf2znI0jXm7gkrzxqocntHfefkamYo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fTbKxwhOg7Vt3767LiI6IBehrlRt2PqFNk1pYtoFJlUqNUlGVn3ieM7yLb+KxKcXq uMreYkhBxxpYOqaeBV/kQ3+ntEAuhuERtorkiD5mn0IjXxwooyAX955uObZifv8WzV UsVYmfgyag4qGtRkC1iiuOIbTCa8RTSDlkiKjG2c= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com, Ranganath V N , Eric Dumazet , Cong Wang , Paolo Abeni , Sasha Levin Subject: [PATCH 5.4 140/187] net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak Date: Mon, 1 Dec 2025 12:24:08 +0100 Message-ID: <20251201112246.280889418@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20251201112241.242614045@linuxfoundation.org> References: <20251201112241.242614045@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ranganath V N [ Upstream commit ce50039be49eea9b4cd8873ca6eccded1b4a130a ] Fix a KMSAN kernel-infoleak detected by the syzbot . [net?] KMSAN: kernel-infoleak in __skb_datagram_iter In tcf_ife_dump(), the variable 'opt' was partially initialized using a designatied initializer. While the padding bytes are reamined uninitialized. nla_put() copies the entire structure into a netlink message, these uninitialized bytes leaked to userspace. Initialize the structure with memset before assigning its fields to ensure all members and padding are cleared prior to beign copied. This change silences the KMSAN report and prevents potential information leaks from the kernel memory. This fix has been tested and validated by syzbot. This patch closes the bug reported at the following syzkaller link and ensures no infoleak. Reported-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0c85cae3350b7d486aee Tested-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com Fixes: ef6980b6becb ("introduce IFE action") Signed-off-by: Ranganath V N Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251109091336.9277-3-vnranganath.20@gmail.com Acked-by: Cong Wang Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin --- net/sched/act_ife.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c index 488d10476e850..8f82842ad8cb5 100644 --- a/net/sched/act_ife.c +++ b/net/sched/act_ife.c @@ -642,13 +642,15 @@ static int tcf_ife_dump(struct sk_buff *skb, struct tc_action *a, int bind, unsigned char *b = skb_tail_pointer(skb); struct tcf_ife_info *ife = to_ife(a); struct tcf_ife_params *p; - struct tc_ife opt = { - .index = ife->tcf_index, - .refcnt = refcount_read(&ife->tcf_refcnt) - ref, - .bindcnt = atomic_read(&ife->tcf_bindcnt) - bind, - }; + struct tc_ife opt; struct tcf_t t; + memset(&opt, 0, sizeof(opt)); + + opt.index = ife->tcf_index, + opt.refcnt = refcount_read(&ife->tcf_refcnt) - ref, + opt.bindcnt = atomic_read(&ife->tcf_bindcnt) - bind, + spin_lock_bh(&ife->tcf_lock); opt.action = ife->tcf_action; p = rcu_dereference_protected(ife->params, -- 2.51.0