Re: [PATCH] net: core: Initialize new header to zero in pskb_expand_head
From: Jakub Kicinski <kuba@kernel.org>
Date: 2025-11-07 00:57:34
Also in:
linux-kernel-mentees, lkml
On Fri, 7 Nov 2025 00:54:23 +0530 Prithvi Tambewagh wrote:
KMSAN reports uninitialized value in can_receive(). The crash trace shows the uninitialized value was created in pskb_expand_head(). This function expands header of a socket buffer using kmalloc_reserve() which doesn't zero-initialize the memory. When old packet data is copied to the new buffer at an offset of data+nhead, new header area (first nhead bytes of the new buffer) are left uninitialized. This is fixed by using memset() to zero-initialize this header of the new buffer.
It's caller's responsibility to initialize the skb data, please leave the core alone..
quoted hunk ↗ jump to hunk
diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 6841e61a6bd0..3486271260ac 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c@@ -2282,6 +2282,8 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail, */ memcpy(data + nhead, skb->head, skb_tail_pointer(skb) - skb->head); + memset(data, 0, size);
We just copied the data in there, and now you're zeroing it.
memcpy((struct skb_shared_info *)(data + size),
-- pw-bot: cr