Commit b5c111f4 authored by Amery Hung's avatar Amery Hung Committed by Martin KaFai Lau
Browse files

bpf: Fix sk_local_storage diag dumping uninitialized special fields 



Call check_and_init_map_value() after the copy_map_value() to zero out
special field regions. diag_get() copies sk_local_storage map values
into a netlink message using copy_map_value{_locked}(), which
intentionally skip special fields. However, the destination buffer from
nla_reserve_64bit() is not zeroed and the skipped regions contain
uninitialized skb data can be sent to userspace.

Fixes: 1ed4d924 ("bpf: INET_DIAG support in bpf_sk_storage")
Signed-off-by: default avatarAmery Hung <ameryhung@gmail.com>
Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
Link: https://patch.msgid.link/20260423222356.155387-1-ameryhung@gmail.com
parent 1081de1a

net/core/bpf_sk_storage.c

+1 −0
Original line number Diff line number Diff line
@@ -557,6 +557,7 @@ static int diag_get(struct bpf_local_storage_map *smap, 
				      sdata->data, true);

	else

		copy_map_value(&smap->map, nla_data(nla_value), sdata->data);

	check_and_init_map_value(&smap->map, nla_data(nla_value));



	nla_nest_end(skb, nla_stg);

	return 0;