From nobody Fri Jul 24 22:19:41 2026 Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD89528033B for ; Thu, 23 Jul 2026 01:08:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784768941; cv=none; b=OYAJuYIyNESRf1noCa+iuAl2GyMj4AMOq8/izypoKz7G9KyHOZD/PHatdp8V8lMhQAyRBkNIEV1ROzCsFGLgrvtMPhELTp4cFcZQxDzgArLrODAUNRZ5AA0MTGOfjBsx6nZn+iXdK8VOZIRefzvF2jcYIAny9UvmbQky+hZ3d2Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784768941; c=relaxed/simple; bh=iXUuvJeZUbnAHSQ0/JdYKQmMD9hx4+UAYjmrTdSZrWo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Xcnyi4cXezjMQUyyJe5NY1ez2KMBga85YvRNIXtni/7EwOh1XWvYaRqDFO4Qh1CFEsrkRAQWLV4RBR5zQ1xJhYN60zrtx6tfNzL5wWO+LZm1+Y1pZxmrLr1aJPJdXzIQ1AivEmwhoIWCwSv9IWrsDFOp11EZQSWz27+zg9VgIE0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr; spf=none smtp.mailfrom=isslab.korea.ac.kr; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b=PGTLEAZj; arc=none smtp.client-ip=209.85.216.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=isslab.korea.ac.kr Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=isslab-korea-ac-kr.20251104.gappssmtp.com header.i=@isslab-korea-ac-kr.20251104.gappssmtp.com header.b="PGTLEAZj" Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-38e42560ebcso58085a91.1 for ; Wed, 22 Jul 2026 18:08:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isslab-korea-ac-kr.20251104.gappssmtp.com; s=20251104; t=1784768937; x=1785373737; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=fZ7X6+icMEjia70EzX8AwOSl7Wvo6R7yS+bSyCVqIVY=; b=PGTLEAZj7+cgt8q5PQg3CG6GY6lwXjmENaT4lqDfudQE8iO6ZIHjuML1NrczF/MSZe UGx4jb5ayI9sEVqSEXdk/PICqfiM1U3vroYQR40ixSWYRgziJKo0p6g0O0PTEfnHbhDe SmKYahPY1Eh0wPaJ2me3oUANJFTHN/8rG07ueNjkpboDDgaFKqnN86hy53ZoTqFzdLjH 6DQv6YjCvFMqDaIgrc9hBari5TNH8fN+irxh9QDxz7mxMTBNJdeYtlpfNr4F38Kis/M7 dUUSmVu8nz4JqDF0OxdPwUHWMOy6NQ9AB/IlDEdZUnICH12Em7n11Wotpe5ufdfCEX/p 6XYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784768937; x=1785373737; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=fZ7X6+icMEjia70EzX8AwOSl7Wvo6R7yS+bSyCVqIVY=; b=PrTScojfS9bI3dZWU4jRKf1yazXmw3wKD+Va+z3llDXfrz6evnbZ7JH1HL3cEfW3Qp icqPNs/8cJlmbhpXNSujdt4X/94b7AulnYOdR05JOxYZm7BAKzAIkl0vwtkYHtV1MARt 5ATOa30m//05b3FINGSabzMfxdaKRbeNaNPCg8U7E5r0sCCrvxQRmPxNKoCiPKKV+a0n xOCQlu6vR4w6cnoZpCnMS71jI0rhfbQ8C78GzvOjGZeA8TuDLkW1nPs+D+dx+nijzs3N zsjRKe0057T1T1h5PX4kGxdNPDInf0NHO4ikFvolcyyY9D66TqAgSnzNVRww9i9MTF50 MJUQ== X-Forwarded-Encrypted: i=1; AHgh+Rraz9O6Wol0A5x1bI2Kda21tBZext0jyQNyaOB1RlLN2Pw9qFBqaMeg/9cVW7mpSaHmq4D/M9Su8Rkaqms=@vger.kernel.org X-Gm-Message-State: AOJu0Yx/gf68CYT2Q5R/N+TAXbqONMoMXwMuk5M8FxnJXqIMDhnVSTXa JR9rxKqcElR6vSQXklSXyuJ1J/bPxfRs7JoTpDyT1+fztmN9IIVGfcPfbd4kvWlqqIc= X-Gm-Gg: AR+sD11KiBOlm0XqKdd+t0TOzCHkfSbIW5BA7St44j7ecWT5mHN2f/4/ugfW7zrkgdW MsTy7dU64lB/gTemfjfUCfprfTvcYEXjLQBQkXMsAwXFrobTg+haHOU9DA993+QDUQ/mDfxrZiz 7wMECJUag6qlZTdhlaHUOsITydzOuUkJt0I8FMADx8snu7KxmlQaAaoZKAuWvMZ2eT+AIJL4Eha wOMxn+xEhNclfobOcCe77sLQJMwm90Jrg3lhK9Nk9t7vToK8aGyI0hDTzjGznL02g3fdG9B3/8z k27F8fyZuvpd+0NtZpObezn1sh2KEGTzdl6StNddGh9yyyufxyQX0yWPW4Ou8MZ58JWgr4ZTi8E DKFrhKngON3BVso5aLmJcKGTtJOqJcKs/shvrKbu0pYecj8V8HBkhNcUVurOkKkrFGuPbOfz40g cSDEsTS8jPQY8C7yNszMYf X-Received: by 2002:a17:90b:3c42:b0:38e:5c6:4db9 with SMTP id 98e67ed59e1d1-38ec64f0739mr1010747a91.11.1784768936738; Wed, 22 Jul 2026 18:08:56 -0700 (PDT) Received: from yhlee-960QFG.. ([125.131.91.97]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38eca7361b4sm37828a91.0.2026.07.22.18.08.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 Jul 2026 18:08:56 -0700 (PDT) From: Yehyeong Lee To: Jakub Kicinski , Paolo Abeni , Eric Dumazet , "David S . Miller" Cc: Roopa Prabhu , Simon Horman , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Yehyeong Lee Subject: [PATCH net] net: mpls: initialize rtm_tos in mpls_getroute() Date: Thu, 23 Jul 2026 10:08:29 +0900 Message-ID: <20260723010830.289917-1-yhlee@isslab.korea.ac.kr> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every field of the header except rtm_tos: r =3D nlmsg_data(nlh); r->rtm_family =3D AF_MPLS; r->rtm_dst_len =3D 20; r->rtm_src_len =3D 0; r->rtm_table =3D RT_TABLE_MAIN; r->rtm_type =3D RTN_UNICAST; r->rtm_scope =3D RT_SCOPE_UNIVERSE; r->rtm_protocol =3D rt->rt_protocol; r->rtm_flags =3D 0; struct rtmsg has no padding, so the one uninitialised byte rtm_tos (offset 3) is copied straight to user space on recvmsg(), leaking a byte of uninitialised heap memory. This is in contrast to mpls_dump_route(), which fills the very same header and does set rtm_tos =3D 0. Initialize rtm_tos to 0, matching mpls_dump_route(). Reproduced with KMSAN by adding an MPLS route and issuing a non-RTM_F_FIB_MATCH RTM_GETROUTE for its label: BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0 _copy_to_iter+0x36c/0x33f0 __skb_datagram_iter+0x196/0x12c0 skb_copy_datagram_iter+0x5b/0x210 netlink_recvmsg+0x37b/0xef0 ... Uninit was created at: __alloc_skb+0x8ca/0x10e0 mpls_getroute+0x1280/0x3a40 rtnetlink_rcv_msg+0x1138/0x15a0 ... Byte 19 of 64 is uninitialized (byte 19 =3D nlmsghdr(16) + rtmsg offset 3 =3D rtm_tos) Fixes: 397fc9e5cefe ("mpls: route get support") Signed-off-by: Yehyeong Lee --- net/mpls/af_mpls.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c index 318cb7e2ac5f..f1c9fc8504e1 100644 --- a/net/mpls/af_mpls.c +++ b/net/mpls/af_mpls.c @@ -2537,6 +2537,7 @@ static int mpls_getroute(struct sk_buff *in_skb, stru= ct nlmsghdr *in_nlh, r->rtm_family =3D AF_MPLS; r->rtm_dst_len =3D 20; r->rtm_src_len =3D 0; + r->rtm_tos =3D 0; r->rtm_table =3D RT_TABLE_MAIN; r->rtm_type =3D RTN_UNICAST; r->rtm_scope =3D RT_SCOPE_UNIVERSE; --=20 2.43.0