Josef Bacik ab9414ed70 net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() ... When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy into a buffer that is about to go out on the wire: an ICMP error quoting the offending packet, or a driver's TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer is zeroed beforehand, so whatever was in memory there gets sent. Zero the part of the buffer we didn't fill. The checksum usually won't match the data any more, so the receiver will usually drop the packet, but either way it no longer carries anything it shouldn't. Only zero for a positive @len, a negative one from a broken caller must not turn into a huge memset(). Fixes: 65249feb6b ("net: add support for skbs with unreadable frags") Cc: stable@vger.kernel.org Signed-off-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: Mina Almasry <almasrymina@google.com> Link: https://patch.msgid.link/20261007-b4-skb-copy-csum-stale-bytes-v1-1-adbbde033fb3@toxicpanda.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-10-08 10:57:41 -07:00
..
bpf_ksock.c	bpf: Add ksock kfuncs	2026-08-15 23:36:18 +02:00
bpf_sk_storage.c	bpf: Fix UAF in sock clone early bailouts	2026-07-09 18:44:16 +02:00
datagram.c	net: devmem: prevent net-iov / page mixing	2026-07-30 16:27:03 -07:00
dev_addr_lists_test.c	net: cache snapshot entries for ndo_set_rx_mode_async	2026-04-21 12:50:13 +02:00
dev_addr_lists.c	net: turn the rx_mode work into a generic netdev_work facility	2026-06-25 10:18:40 -07:00
dev_api.c	net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work	2026-04-21 12:50:03 +02:00
dev_ioctl.c	net: ethtool: let tsconfig reach a PHY-only timestamp provider	2026-09-28 19:26:41 -07:00
dev.c	net: make dev_xdp_sb_prog_count() see programs attached through a link	2026-10-05 15:01:19 -07:00
dev.h	net: flush skb_defer_nodes in dev_cpu_dead()	2026-09-24 10:48:10 -07:00
devmem.c	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
devmem.h	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
drop_monitor.c	drop_monitor: fix out-of-bounds write in reset_per_cpu_data()	2026-09-15 17:58:35 -07:00
dst_cache.c
dst.c
failover.c	net: failover: check register_netdevice_notifier() error in failover_init()	2026-08-04 18:46:34 -07:00
fib_notifier.c
fib_rules.c	net: fib_rules: Destroy ops->lock in fib_rules_unregister().	2026-07-07 10:51:06 +02:00
filter.c	bpf: Fix bpf_sock context code generation	2026-09-22 19:34:04 +00:00
flow_dissector.c	flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()	2026-10-07 17:57:04 -07:00
flow_offload.c
gen_estimator.c
gen_stats.c	net/sched: add const qualifiers to gnet_stats helpers	2026-05-11 18:28:08 -07:00
gro_cells.c	net: iptunnel: fix stale transport header during tunnel decapsulation	2026-08-28 15:53:46 -07:00
gro.c	net: gro: fix double aggregation of flush-marked skbs	2026-07-21 08:30:54 -07:00
gso.c	net: gso: limit recursive IP-in-IP segmentation	2026-09-29 12:02:37 +02:00
hotdata.c
hwbm.c
ieee8021q_helpers.c
link_watch.c	net: rename netdev_ops_assert_locked()	2026-06-04 14:04:55 -07:00
lock_debug.c	net: require instance lock for NETDEV_DOWN/GOING_DOWN notifiers	2026-07-07 15:31:37 +02:00
lwt_bpf.c	lwt_bpf: Restore reserved headroom after xmit program	2026-08-17 10:59:03 +02:00
lwtunnel.c	net: lwtunnel: Drop skb metadata before LWT encapsulation	2026-06-23 19:07:23 -07:00
Makefile	bpf: Add ksock kfuncs	2026-08-15 23:36:18 +02:00
mp_dmabuf_devmem.h
neighbour.c	neighbour: Skip default parms when resumed in neightbl_dump_info().	2026-09-11 17:25:14 -07:00
net_namespace.c	net: fix a resource leak in copy_net_ns() error handling path	2026-08-25 12:30:55 +02:00
net_test.c
net-procfs.c
net-sysfs.c	net: add READ_ONCE()/WRITE_ONCE() annotations for dev->num_tc	2026-08-17 10:27:48 -07:00
net-sysfs.h	net: Defer netdev KOBJ_ADD uevent until the device is published	2026-08-06 09:36:18 -07:00
net-traces.c
netclassid_cgroup.c
netdev_config.c
netdev_queues.c	net: expect instance lock in netdev_queue_get_dma_dev()	2026-08-10 15:54:42 -07:00
netdev_rx_queue.c	net: Stop leased rxq before uninstalling its memory provider	2026-06-11 15:57:39 -07:00
netdev_work.c	net: avoid theoretical races with ref drain	2026-08-06 09:37:03 -07:00
netdev-genl-gen.c	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
netdev-genl-gen.h	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
netdev-genl.c	net: devmem: document that bind-tx is unprivileged by design	2026-09-22 18:40:15 -07:00
netevent.c
netmem_priv.h	Revert "mm: introduce a new page type for page pool in page type"	2026-05-21 19:06:13 -07:00
netpoll.c	netconsole: move netpoll_wait_carrier() as netcons_wait_carrier()	2026-07-30 12:14:39 +02:00
netprio_cgroup.c
of_net.c
page_pool_priv.h
page_pool_user.c	net: make page_pool_get_stats() void	2026-05-28 18:10:03 -07:00
page_pool.c	net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()	2026-09-28 18:24:05 -07:00
pktgen.c	net: pktgen: use a consistent flow count	2026-08-17 12:50:51 -07:00
ptp_classifier.c
rtnetlink.c	net: reject oversized tx_queue_len at netlink parse time	2026-09-04 16:30:49 -07:00
scm.c	net: af_unix: useful handling of LSM denials on SCM_RIGHTS	2026-08-17 18:14:52 -07:00
secure_seq.c
selftests.c	net: Use helpers to get/set UDP len tree-wide	2026-07-22 13:47:02 +02:00
skb_fault_injection.c
skbuff.c	net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()	2026-10-08 10:57:41 -07:00
skmsg.c	bpf, sockmap: Fix self-redirect copied_seq double-counting	2026-09-13 21:50:26 -07:00
sock_diag.c
sock_map.c	bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc	2026-09-22 23:52:20 +00:00
sock_reuseport.c
sock.c	net: restrict SO_RESERVE_MEM to TCP sockets and cap max value	2026-09-28 19:31:54 -07:00
stream.c	net: remove some unused EXPORT_SYMBOL()s	2026-06-12 16:43:11 -07:00
sysctl_net_core.c	net: Const qualify network templated ctl_tables Arrays	2026-08-13 13:12:24 +02:00
timestamping.c
tso.c	net: Use helpers to get/set UDP len tree-wide	2026-07-22 13:47:02 +02:00
utils.c
xdp.c	xdp: fix zero-copy frame layout	2026-08-22 13:10:48 -07:00