]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
bpf: Fix sk_local_storage diag dumping uninitialized special fields
authorAmery Hung <ameryhung@gmail.com>
Thu, 23 Apr 2026 22:23:55 +0000 (15:23 -0700)
committerMartin KaFai Lau <martin.lau@kernel.org>
Fri, 24 Apr 2026 18:21:34 +0000 (11:21 -0700)
commitb5c111f4967ba4fdecdd318923ec7b081e9ef95f
treee6f69eeea923cfeb788dbe78c91bae43c266176b
parent1081de1accb2b224516cca7071122c59532d0b22
bpf: Fix sk_local_storage diag dumping uninitialized special fields

Call check_and_init_map_value() after the copy_map_value() to zero out
special field regions. diag_get() copies sk_local_storage map values
into a netlink message using copy_map_value{_locked}(), which
intentionally skip special fields. However, the destination buffer from
nla_reserve_64bit() is not zeroed and the skipped regions contain
uninitialized skb data can be sent to userspace.

Fixes: 1ed4d92458a9 ("bpf: INET_DIAG support in bpf_sk_storage")
Signed-off-by: Amery Hung <ameryhung@gmail.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://patch.msgid.link/20260423222356.155387-1-ameryhung@gmail.com
net/core/bpf_sk_storage.c