Re: [PATCH net] psample: zero the netlink attribute padding in PSAMPLE_ATTR_DATA
From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-06-10 01:30:19
On Sat, 6 Jun 2026 20:16:40 -0700 Xiang Mei wrote:
quoted hunk ↗ jump to hunk
psample_sample_packet() open-codes the PSAMPLE_ATTR_DATA attribute. It reserves nla_total_size(data_len) bytes via skb_put() but only writes NLA_HDRLEN + data_len of them, so when data_len is not a multiple of 4 the up to 3 trailing alignment-padding bytes are left uninitialised. The skb head comes from kmalloc_reserve(), which does not zero memory, so those bytes hold stale slab contents that are then broadcast to all listeners on the PSAMPLE_NL_MCGRP_SAMPLE multicast group, leaking kernel heap memory to userspace. Zero the trailing padding after the payload copy. Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling") Reported-by: Weiming Shi <redacted> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei <redacted> --- net/psample/psample.c | 3 +++ 1 file changed, 3 insertions(+)diff --git a/net/psample/psample.c b/net/psample/psample.c index 7763662036fb..26220dca0f12 100644 --- a/net/psample/psample.c +++ b/net/psample/psample.c@@ -485,6 +485,9 @@ void psample_sample_packet(struct psample_group *group, if (skb_copy_bits(skb, 0, nla_data(nla), data_len)) goto error; + + memset((unsigned char *)nla + nla->nla_len, 0, + nla_padlen(data_len)); } #ifdef CONFIG_INET
Could you see if this diff works? I think it's slightly cleaner: diff --git a/net/psample/psample.c b/net/psample/psample.c index 7763662036fb..c112e1f0ccac 100644
--- a/net/psample/psample.c
+++ b/net/psample/psample.c@@ -476,15 +476,17 @@ void psample_sample_packet(struct psample_group *group, goto error; if (data_len) { - int nla_len = nla_total_size(data_len); + int nla_len = nla_attr_size(data_len); struct nlattr *nla; nla = skb_put(nl_skb, nla_len); nla->nla_type = PSAMPLE_ATTR_DATA; - nla->nla_len = nla_attr_size(data_len); + nla->nla_len = nla_len; if (skb_copy_bits(skb, 0, nla_data(nla), data_len)) goto error; + + skb_put_zero(nl_skb, nla_padlen(data_len)); } #ifdef CONFIG_INET