linux-kernel - Re: [syzbot] Re: KMSAN: uninit-value in ip6table_mangle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <674f0796.050a0220.48a03.0038.GAE@google.com>
Date: Tue, 03 Dec 2024 05:28:54 -0800
From: syzbot <syzbot+6023ea32e206eef7920a@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] Re: KMSAN: uninit-value in ip6table_mangle_hook()

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: Re: KMSAN: uninit-value in ip6table_mangle_hook()
Author: dmantipov@...dex.ru

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git cdd30ebb1b9f36159d66f088b61aee264e649d7a

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 48fd53b98972..00840249554a 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1224,7 +1224,9 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
 	    (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
 		struct sk_buff *new_skb;
 
-		new_skb = skb_realloc_headroom(skb, max_headroom);
+		new_skb = skb_copy_expand(skb, max_headroom,
+					  skb_tailroom(skb),
+					  GFP_ATOMIC);
 		if (!new_skb)
 			goto tx_err_dst_release;