linux-kernel - Forwarded: [PATCH] net: skbuff: fix KMSAN uninit-value in pskb_expand

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6959e314.050a0220.a5285.0002.GAE@google.com>
Date: Sat, 03 Jan 2026 19:48:36 -0800
From: syzbot <syzbot+619b9ef527f510a57cfc@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] net: skbuff: fix KMSAN uninit-value in pskb_expand_head()

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] net: skbuff: fix KMSAN uninit-value in pskb_expand_head()
Author: kartikey406@...il.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

When pskb_expand_head() allocates a new buffer with additional headroom,
the memcpy copies the entire old buffer including the old headroom which
contains uninitialized memory. KMSAN detects this when the garbage data
is copied, triggering uninit-value warnings.

The call chain is:
  bpf_skb_adjust_room()
    -> bpf_skb_net_grow()
      -> skb_cow_head()
        -> pskb_expand_head()  // copies uninit old headroom
      -> bpf_skb_net_hdr_push()
        -> bpf_skb_generic_push()
          -> skb_postpush_data_move()
            -> skb_data_move()  // moves uninit memory

Fix this by:
1. Zeroing the entire headroom region (new nhead + old headroom)
2. Copying only the actual packet data (from skb->data to skb->tail)
   instead of copying from skb->head which includes garbage headroom

This ensures no uninitialized memory is ever copied while maintaining
the same buffer layout with packet data in the correct location.

Reported-by: syzbot+619b9ef527f510a57cfc@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=619b9ef527f510a57cfc
Signed-off-by: Deepanshu Kartikey <kartikey406@...il.com>
---
 net/core/skbuff.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a00808f7be6a..ce3e335e4729 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2284,10 +2284,12 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 		goto nodata;
 	size = SKB_WITH_OVERHEAD(size);
 
-	/* Copy only real data... and, alas, header. This should be
-	 * optimized for the cases when header is void.
+	/* Zero the headroom to avoid copying uninit memory.
+	 * Then copy only the actual packet data.
 	 */
-	memcpy(data + nhead, skb->head, skb_tail_pointer(skb) - skb->head);
+	memset(data, 0, nhead + skb_headroom(skb));
+	memcpy(data + nhead + skb_headroom(skb), skb->data,
+	       skb_tail_pointer(skb) - skb->data);
 
 	memcpy((struct skb_shared_info *)(data + size),
 	       skb_shinfo(skb),
-- 
2.43.0