Re: [PATCH v2] net: skbuff: fix uninitialized memory use in pskb_expand_head()
From: Eric Dumazet <edumazet@google.com>
Date: 2026-01-26 13:26:48
Also in:
bpf, linux-kernel-mentees, lkml
On Mon, Jan 26, 2026 at 2:22 PM Soham Metha [off-list ref] wrote:
quoted hunk ↗ jump to hunk
pskb_expand_head() allocates a new skb data buffer using kmalloc_reserve(), which does not initialize memory. skb helpers may later copy or move padding bytes from the buffer. Initialize the newly allocated skb buffer to avoid propagating uninitialized memory. Reported-by: syzbot+619b9ef527f510a57cfc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=619b9ef527f510a57cfc Tested-by: syzbot+619b9ef527f510a57cfc@syzkaller.appspotmail.com Signed-off-by: Soham Metha <redacted> --- v2: - No code changes - Resent to netdev list - Added Closes tag - Added Tested-by tag net/core/skbuff.c | 3 +++ 1 file changed, 3 insertions(+)diff --git a/net/core/skbuff.c b/net/core/skbuff.c index a56133902c0d..b0f0d3a0310b 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c@@ -2282,6 +2282,9 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail, data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL); if (!data) goto nodata; + + memset(data, 0, size); +
Certainly not. You might wonder why we have GFP_ZERO ? Answer : we do not generally want to pay the price of zeroing memory _unless_ absolutely needed. Fix the caller instead, ie root-cause the issue, thank you