From nobody Sat Feb 7 18:16:09 2026 Received: from mail-ot1-f72.google.com (mail-ot1-f72.google.com [209.85.210.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C79D818BC3B for ; Sun, 4 Jan 2026 03:48:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767498519; cv=none; b=IGBMrzt9SdHoQlrkoneXPuwb93IEOYBTaJsyWW3lOxTi1ZWlpUSDjrjc8ZuskW3y5Ot0BmQkhpLDDjcdsD5Em4xjdRmoo8HiS8SYxPPKAk53n8PW6p2tOdv0epheUkQjgxzAmSsXz/CsyRjRjnhqCsoQitAccQ4sDp5TzlN2+PY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767498519; c=relaxed/simple; bh=O4qZBQcs/OwoC3hkZDdIqJW82OpeZWzgUJVAPp9tCj8=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=eXOKZxvUEaauT1MhN7fH8iwRuY+OyoTqA6svSuxV18iBSvuJGTr+S8GhU7l0hxOO5QmwlsKxXnPxTmvIaESoCrIlQ2HtSBU2i5Af115QW9bZW46iyKLiaHKRxSED9MlExSlqtUVxEsLf+eOQiZWufGCrqpnmVJ7IfKoizGMIOF4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.210.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-ot1-f72.google.com with SMTP id 46e09a7af769-7c76977192eso51195916a34.3 for ; Sat, 03 Jan 2026 19:48:37 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767498516; x=1768103316; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=0N99O9zDoWUe/u7BriYM5v4TR9ZWPKQSH/hzAMmhlCE=; b=fifgjyYYddNpxOCsRePiKQi4aggWsypmK4bGihZzVeVVutoxLypTOnPWqYAitghBva ioWUDlUwLlEouGS7HJz6K2MZqXd2dqm3ooe9k+kJBB3zhQGbkVHL6DHfn8xezRXvRhN4 cSgW6Zu7zLMxFo1XVEeHi6fHlOFmHi3Df7YF6vSrYFNZwyg6cv/HVEcefzgGXI/U2en5 uDJdNAOtlUpcWbnb0n4QxmpUNpBhFKhulJ57J/ufURkswi73JLiMrZ8+aj2bGthRaG1L BaBBYhFB7l46qJNKLAIRJalRdGcigEfuAIa+1VPN0pt38E16MfdOq+jUwH7XvZB8muAv rs8A== X-Gm-Message-State: AOJu0YytpVv3buXo619j2lqJdS9BHkTMuKWXxQxEcwasYI7SQrc5Lske MWITIsWoo09RcWMMejR0SEW5TrjhNwbs7nky/wy1/ZIjncpb+fL2Bp+usqMtAZXUPA1F1mVyUlE gOwbJ8vAEfXE4pMY0Ljhx6Qol/DKgDsEvqKqXDXj75svbCrKAj883P4s6uao= X-Google-Smtp-Source: AGHT+IE6KFqVWjkAzoT+NgVCSOEP8pDGKTpPeHsOqRJ1eFQmgR8QdqFYwlEB12FpWElSJlvG00SzslgmXNAJGy7nKloZqcscFvOJ Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:1c89:b0:65d:1bf8:bb74 with SMTP id 006d021491bc7-65d1bf8bdd5mr18135925eaf.61.1767498516676; Sat, 03 Jan 2026 19:48:36 -0800 (PST) Date: Sat, 03 Jan 2026 19:48:36 -0800 In-Reply-To: <6954bc70.050a0220.a1b6.0310.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6959e314.050a0220.a5285.0002.GAE@google.com> Subject: Forwarded: [PATCH] net: skbuff: fix KMSAN uninit-value in pskb_expand_head() From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] net: skbuff: fix KMSAN uninit-value in pskb_expand_head() Author: kartikey406@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git= master When pskb_expand_head() allocates a new buffer with additional headroom, the memcpy copies the entire old buffer including the old headroom which contains uninitialized memory. KMSAN detects this when the garbage data is copied, triggering uninit-value warnings. The call chain is: bpf_skb_adjust_room() -> bpf_skb_net_grow() -> skb_cow_head() -> pskb_expand_head() // copies uninit old headroom -> bpf_skb_net_hdr_push() -> bpf_skb_generic_push() -> skb_postpush_data_move() -> skb_data_move() // moves uninit memory Fix this by: 1. Zeroing the entire headroom region (new nhead + old headroom) 2. Copying only the actual packet data (from skb->data to skb->tail) instead of copying from skb->head which includes garbage headroom This ensures no uninitialized memory is ever copied while maintaining the same buffer layout with packet data in the correct location. Reported-by: syzbot+619b9ef527f510a57cfc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D619b9ef527f510a57cfc Signed-off-by: Deepanshu Kartikey --- net/core/skbuff.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index a00808f7be6a..ce3e335e4729 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2284,10 +2284,12 @@ int pskb_expand_head(struct sk_buff *skb, int nhead= , int ntail, goto nodata; size =3D SKB_WITH_OVERHEAD(size); =20 - /* Copy only real data... and, alas, header. This should be - * optimized for the cases when header is void. + /* Zero the headroom to avoid copying uninit memory. + * Then copy only the actual packet data. */ - memcpy(data + nhead, skb->head, skb_tail_pointer(skb) - skb->head); + memset(data, 0, nhead + skb_headroom(skb)); + memcpy(data + nhead + skb_headroom(skb), skb->data, + skb_tail_pointer(skb) - skb->data); =20 memcpy((struct skb_shared_info *)(data + size), skb_shinfo(skb), --=20 2.43.0