bpf: Fix sk_local_storage diag dumping uninitialized special fields

Call check_and_init_map_value() after the copy_map_value() to zero out
special field regions. diag_get() copies sk_local_storage map values
into a netlink message using copy_map_value{_locked}(), which
intentionally skip special fields. However, the destination buffer from
nla_reserve_64bit() is not zeroed and the skipped regions contain
uninitialized skb data can be sent to userspace.

Fixes: 1ed4d92458a9 ("bpf: INET_DIAG support in bpf_sk_storage")
Signed-off-by: Amery Hung <ameryhung@gmail.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://patch.msgid.link/20260423222356.155387-1-ameryhung@gmail.com

diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c
index dc3e8fce8809e43091450e55cb1a5d71faea4328..ecd659f79fd4a0ba6d268cfe4e1a6f68f2ff3177 100644 (file)
--- a/net/core/bpf_sk_storage.c
+++ b/net/core/bpf_sk_storage.c
@@ -557,6 +557,7 @@ static int diag_get(struct bpf_local_storage_map *smap,
                                      sdata->data, true);
        else
                copy_map_value(&smap->map, nla_data(nla_value), sdata->data);
+       check_and_init_map_value(&smap->map, nla_data(nla_value));
 
        nla_nest_end(skb, nla_stg);
        return 0;