For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] net: skbuff: fix KMSAN uninit-value in pskb_expand_head()
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
When pskb_expand_head() allocates a new buffer with additional headroom,
both the new headroom (nhead bytes) and the old headroom copied from the
original buffer contain uninitialized memory. This can be accessed when
BPF programs use bpf_skb_adjust_room() to push headers into this space.
The call chain is:
bpf_skb_adjust_room()
-> bpf_skb_net_grow()
-> skb_cow_head()
-> pskb_expand_head() // allocates and copies uninit headroom
-> bpf_skb_net_hdr_push()
-> bpf_skb_generic_push()
-> skb_postpush_data_move()
-> skb_data_move() // moves uninit memory
Fix this by zeroing both the new headroom and the copied old headroom
after the memcpy in pskb_expand_head().
Reported-by: syzbot+619b9ef527f510a57cfc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=619b9ef527f510a57cfc
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
net/core/skbuff.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a00808f7be6a..4a41dccffc03 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2288,6 +2288,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
* optimized for the cases when header is void.
*/
memcpy(data + nhead, skb->head, skb_tail_pointer(skb) - skb->head);
+ memset(data, 0, nhead + skb_headroom(skb));
memcpy((struct skb_shared_info *)(data + size),
skb_shinfo(skb),
--
2.43.0