linux-kernel - Forwarded: [PATCH] net: skbuff: fix KMSAN uninit-value in pskb_expand

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6959e571.050a0220.a1b6.0381.GAE@google.com>
Date: Sat, 03 Jan 2026 19:58:41 -0800
From: syzbot <syzbot+619b9ef527f510a57cfc@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] net: skbuff: fix KMSAN uninit-value in pskb_expand_head()

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] net: skbuff: fix KMSAN uninit-value in pskb_expand_head()
Author: kartikey406@...il.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

pskb_expand_head() copies the entire old buffer starting from skb->head,
which includes the old headroom region that may contain uninitialized
memory. KMSAN detects this during the copy and when the data is later
moved by BPF's skb_data_move().

The call chain triggering the warning is:
  bpf_skb_adjust_room()
    -> bpf_skb_net_grow()
      -> skb_cow_head()
        -> pskb_expand_head()  // copies uninit old headroom
      -> bpf_skb_net_hdr_push()
        -> bpf_skb_generic_push()
          -> skb_postpush_data_move()
            -> skb_data_move()  // moves uninit memory

Fix this by pre-initializing the entire new headroom region (nhead +
old headroom) in the new buffer before copying. This ensures the
destination bytes corresponding to headroom are defined and zero,
while keeping the original linear layout intact. The memcpy still
copies from skb->head to preserve the relative offset (skb->data -
skb->head) and all header offsets (mac_header, network_header,
transport_header) in the new buffer.

Reported-by: syzbot+619b9ef527f510a57cfc@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=619b9ef527f510a57cfc
Signed-off-by: Deepanshu Kartikey <kartikey406@...il.com>
---
 net/core/skbuff.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a00808f7be6a..7e493904d47a 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2284,9 +2284,10 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 		goto nodata;
 	size = SKB_WITH_OVERHEAD(size);

-	/* Copy only real data... and, alas, header. This should be
-	 * optimized for the cases when header is void.
+	/* Zero new and old headroom in the new buffer, then copy
+	 * original contents to preserve layout and header offsets.
 	 */
+	memset(data, 0, nhead + skb_headroom(skb));
 	memcpy(data + nhead, skb->head, skb_tail_pointer(skb) - skb->head);

 	memcpy((struct skb_shared_info *)(data + size),
-- 
2.43.0