diff options
| author | Amery Hung <ameryhung@gmail.com> | 2026-04-24 01:23:55 +0300 |
|---|---|---|
| committer | Martin KaFai Lau <martin.lau@kernel.org> | 2026-04-24 21:21:34 +0300 |
| commit | b5c111f4967ba4fdecdd318923ec7b081e9ef95f (patch) | |
| tree | e6f69eeea923cfeb788dbe78c91bae43c266176b | |
| parent | 1081de1accb2b224516cca7071122c59532d0b22 (diff) | |
| download | linux-b5c111f4967ba4fdecdd318923ec7b081e9ef95f.tar.xz | |
bpf: Fix sk_local_storage diag dumping uninitialized special fields
Call check_and_init_map_value() after the copy_map_value() to zero out
special field regions. diag_get() copies sk_local_storage map values
into a netlink message using copy_map_value{_locked}(), which
intentionally skip special fields. However, the destination buffer from
nla_reserve_64bit() is not zeroed and the skipped regions contain
uninitialized skb data can be sent to userspace.
Fixes: 1ed4d92458a9 ("bpf: INET_DIAG support in bpf_sk_storage")
Signed-off-by: Amery Hung <ameryhung@gmail.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://patch.msgid.link/20260423222356.155387-1-ameryhung@gmail.com
| -rw-r--r-- | net/core/bpf_sk_storage.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c index dc3e8fce8809..ecd659f79fd4 100644 --- a/net/core/bpf_sk_storage.c +++ b/net/core/bpf_sk_storage.c @@ -557,6 +557,7 @@ static int diag_get(struct bpf_local_storage_map *smap, sdata->data, true); else copy_map_value(&smap->map, nla_data(nla_value), sdata->data); + check_and_init_map_value(&smap->map, nla_data(nla_value)); nla_nest_end(skb, nla_stg); return 0; |