From nobody Fri Jul 24 22:57:06 2026 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 001CE1FA859 for ; Wed, 22 Jul 2026 10:44:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784717084; cv=none; b=t4eO8Ivz7pkOqNyyeHq+uVecv/AVCnGNIH5fpnx3gOiwHdyIyh0fl8QsuVJJcA7+Na0NC6ZpcndtXeZ0BFWY3CmH04Bh/skSDJOgLCHTJontWQi/QTQCilZhl9yL9Nntuh77gyma3R254obhUJMTuc6adHhA4S/Vf2faiOzclZQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784717084; c=relaxed/simple; bh=aa+xes5EVTH2cdfL9asTzmuuxnDoeHgeRLEzA1fR3z0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=dUVFQ17rxNeMt83XBCopnftZtLBi3+L/ULp6rkDoO/Z+h2AxUGoVN7sRuMnV4e1HyCut4lmga0HcAYKKMUwLeRgU3rpcX7n+uPIqUA6DgqaFfs6irSPYxnPQEU47jTJWzZzdnViTCtRuM+GuG3h0shYgPNJOsDB47c8rTKj6O9A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr; spf=none smtp.mailfrom=isslab.korea.ac.kr; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b=iwPFDUHX; arc=none smtp.client-ip=209.85.216.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b="iwPFDUHX" Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-38e041ea211so10165225a91.0 for ; Wed, 22 Jul 2026 03:44:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isslab-korea-ac-kr.20251104.gappssmtp.com; s=20251104; t=1784717080; x=1785321880; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=HtMiEqgjJ43JzVvLsgi0+3J6JR6aigqKa2wm4e7uPrI=; b=iwPFDUHX1ekmHXpFAuq6R/YMYd9iTlyAMNAAR6KDvVilF9XnzdZvQ2Tmx4eZNZDheG 7I54/W78fqIHF6zQPW/1fS26B9xNiBguzpLkTIRxioLEPDlVdS4nljk5xuCib4SiUm2a 1eadEsIZN7QysWS8YPeH9Ywxh543EyuUmEJySiXA0wQp39QZl+S+tMHYGFH8RMKc7d1x OrPhQ/w8/SKMcUgmpCBrjLNq4WCQO05qsSXclEzf0O5mRQtsHOpTrAJyLGbvrOpMcauV uZELifBRdSYP9ln2XkNznzE3xHsiYBJxgiQ0MruJR/37HVZtxvGqnhmcJFCSK8+eEipV oY9g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784717080; x=1785321880; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=HtMiEqgjJ43JzVvLsgi0+3J6JR6aigqKa2wm4e7uPrI=; b=jsVxANBwEoXZ/7fIREZrs2YtKA2ciolgbKAC4zDMEcoVSCvphxP1O1AQ1X1IwD4R1v 5TMR2/9VzKF65zsS6erRwLau5ZgUD5I2V+jYrjhtyhRBG7u4krYGFQwnXoeotX87Vus9 yRXVKgXwoPy/wBlangi1W0/vkPRlfIggGfWAMoopV4laspg2+Fu/OEAinExJ1IljdF4o XaRzymCQ0OIaBJHKqrVOMbPYn9GcnzuuOxQvIf/ETTJ5ceKC4qlPf4gptjTfb1KnOhof YOzIFEQ67gwnvQuZnDj1FYNvKe7JQZKSCEIPlWCJZ2/9NzoCGupc9ZmtldU/oLsn5OMO SIYg== X-Forwarded-Encrypted: i=1; AHgh+RpAt1d4onOxTEd5HuhZdgdnPDOVl3neqDQYywuI9V/1AP2NC1IFaREVNYdeX1R00MupJi9iZyLNhwWqy9c=@vger.kernel.org X-Gm-Message-State: AOJu0Yzuy4MSnPzaVwkHOst9jyYsRn5kmLTx3DoR40g4+O4WOamPAkbR vQRzWE/YDdFofVCR3WFBwL0aLMQf1QMNR9IpWQ4hKpwI9ElRNd0bzOFaDQFJ6ra/uIU= X-Gm-Gg: AR+sD11t/8X+XA3af1SVbfUaV2RUncye+ZjdUMaNwlsPqSdvWYIiXtnvXK6LA2i3p5r qwr+uFsV04xPdt0z40bxFHi5m0zzNK+N9Xa/CQlAsZsAX6+15GI0hmTeHTXDFjPSP5Hd/d855Q8 3EllUSHtHXV9ZgLyVoO2Z62pCbM84CBIAR1z5cjrHv3hRqaCXnAaDFCH0MNBX4rpdNFemu7fOXK ZsDmAl03pNNEKzlvBf9HTDW6MeRN+aWyJn7f1XFQToTKJOUwv87ETzfVM8i5zDprCddXg2uAaH7 /YvZDNLO/vIcdUWAKywH3Ata/LyuFBxuqE1V23rLgGm/PU7JbCZvq71b0nIYmPV7Ze4kiOKwLso 8b8rKK6wuxXt91PGdGei1XHKMSOMBnjTxNLILLC2ho/r6B5hTxnu097HtW6LD+Y0/ZPyfd+bKST 3jm6PWuVl4CQ== X-Received: by 2002:a17:90b:3c0f:b0:38e:408:9d7d with SMTP id 98e67ed59e1d1-38e4b56d824mr22043839a91.36.1784717080006; Wed, 22 Jul 2026 03:44:40 -0700 (PDT) Received: from yhlee-960QFG.. ([125.131.91.97]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38e921698d7sm3090392a91.10.2026.07.22.03.44.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 Jul 2026 03:44:39 -0700 (PDT) From: Yehyeong Lee To: Neil Horman , netdev@vger.kernel.org Cc: "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Ido Schimmel , Jiri Pirko , linux-kernel@vger.kernel.org, Yehyeong Lee Subject: [PATCH net] net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD Date: Wed, 22 Jul 2026 19:44:19 +0900 Message-ID: <20260722104419.273358-1-yhlee@isslab.korea.ac.kr> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() open code the NET_DM_ATTR_PAYLOAD attribute to avoid zeroing the packet payload before overwriting it with skb_copy_bits(): attr =3D skb_put(msg, nla_total_size(payload_len)); attr->nla_type =3D NET_DM_ATTR_PAYLOAD; attr->nla_len =3D nla_attr_size(payload_len); if (skb_copy_bits(skb, 0, nla_data(attr), payload_len)) goto nla_put_failure; skb_put() reserves nla_total_size(payload_len), i.e. the header plus the NLA_ALIGN() padding, but only payload_len bytes are copied in. When payload_len is not a multiple of 4 the 1-3 padding bytes are never initialized and are leaked to user space inside the netlink message. This is the same bug, and the same open-coded pattern, that commit aedd02af1f8b ("net: psample: fix info leak in PSAMPLE_ATTR_DATA") fixed in psample by reserving only nla_attr_size() and zeroing the pad with skb_put_zero(nla_padlen()). KMSAN confirms the leak for the software path when the packet payload length is not 4-byte aligned: BUG: KMSAN: kernel-infoleak in _copy_to_iter _copy_to_iter __skb_datagram_iter skb_copy_datagram_iter netlink_recvmsg sock_recvmsg __sys_recvfrom Uninit was created at: kmem_cache_alloc_node_noprof __alloc_skb net_dm_packet_work Bytes 173-175 of 176 are uninitialized Zero the attribute padding in both the software and hardware drop report paths, mirroring the psample fix. Fixes: ca30707dee2b ("drop_monitor: Add packet alert mode") Fixes: 5e58109b1ea4 ("drop_monitor: Add support for packet alert mode for h= ardware drops") Signed-off-by: Yehyeong Lee --- net/core/drop_monitor.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c index 2bf3cab5e557..6a5bcaf21b57 100644 --- a/net/core/drop_monitor.c +++ b/net/core/drop_monitor.c @@ -671,12 +671,14 @@ static int net_dm_packet_report_fill(struct sk_buff *= msg, struct sk_buff *skb, if (nla_put_u16(msg, NET_DM_ATTR_PROTO, be16_to_cpu(skb->protocol))) goto nla_put_failure; =20 - attr =3D skb_put(msg, nla_total_size(payload_len)); + attr =3D skb_put(msg, nla_attr_size(payload_len)); attr->nla_type =3D NET_DM_ATTR_PAYLOAD; attr->nla_len =3D nla_attr_size(payload_len); if (skb_copy_bits(skb, 0, nla_data(attr), payload_len)) goto nla_put_failure; =20 + skb_put_zero(msg, nla_padlen(payload_len)); + out: genlmsg_end(msg, hdr); =20 @@ -831,12 +833,14 @@ static int net_dm_hw_packet_report_fill(struct sk_buf= f *msg, if (nla_put_u16(msg, NET_DM_ATTR_PROTO, be16_to_cpu(skb->protocol))) goto nla_put_failure; =20 - attr =3D skb_put(msg, nla_total_size(payload_len)); + attr =3D skb_put(msg, nla_attr_size(payload_len)); attr->nla_type =3D NET_DM_ATTR_PAYLOAD; attr->nla_len =3D nla_attr_size(payload_len); if (skb_copy_bits(skb, 0, nla_data(attr), payload_len)) goto nla_put_failure; =20 + skb_put_zero(msg, nla_padlen(payload_len)); + out: genlmsg_end(msg, hdr); =20 --=20 2.43.0