github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-25 08:16:03 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
16d464013e
linux/net/sched
History
Bernard Ladenthin 9c572a8303 net/sched: fix potential stack infoleak in em_text_dump() 
em_text_dump() allocates struct tcf_em_text on the stack without zeroing
it.  strscpy() writes the algorithm name and a NUL terminator into
conf.algo[], leaving the remaining bytes uninitialised.  nla_put_nohdr()
then copies the full struct to the netlink response.

KMSAN on Linux 7.2-rc6 reports two kernel-infoleak splats from this path,
one triggered via "tc filter show" and one via a raw RTM_GETTFILTER dump:

  BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x1c9/0x2620
    nla_put_nohdr+0x83/0x130
    em_text_dump+0x291/0x550
  Local variable conf created at: em_text_dump+0x5d/0x550
  Bytes 168-179 of 199 are uninitialized

I am not certain whether this constitutes a real security problem in
practice: the test was conducted in a controlled KMSAN environment and
the leaked stack bytes may or may not carry sensitive data on actual
production kernels.  I am reporting it because KMSAN flagged it as a
kernel-infoleak and the fix is straightforward.  I can provide a
userspace reproducer on request.

The original code used strncpy() which zero-pads to the destination size.
Commit b04202d606 ("net/sched: replace strncpy with strscpy") replaced
it with strscpy(), which does not pad, creating this condition.
Zero-initialising the struct closes it.

Fixes: b04202d606 ("net/sched: replace strncpy with strscpy")
Link: https://lore.kernel.org/netdev/20250327143733.187438-1-richard120310@gmail.com/
Assisted-by: Claude:claude-sonnet-4-6 [KMSAN]
Signed-off-by: Bernard Ladenthin <bernard.ladenthin@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260918133953.12494-1-bernard.ladenthin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-22 19:14:25 -07:00
..
act_api.c net/sched: reject IDR error pointers when deleting actions 2026-09-19 14:48:44 -07:00
act_bpf.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_connmark.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
act_csum.c net: Use helpers to get/set UDP len tree-wide 2026-07-22 13:47:02 +02:00
act_ct.c net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure 2026-09-18 16:35:19 -07:00
act_ctinfo.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_gact.c net/sched: act_gact, act_police: range check the fallback control action 2026-08-10 16:00:19 -07:00
act_gate.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
act_ife.c net/sched: act_ife: Only operate on Ethernet frames 2026-08-24 11:59:59 -07:00
act_meta_mark.c
act_meta_skbprio.c
act_meta_skbtcindex.c
act_mirred.c net/sched: act_mirred: Fix return code in early mirred redirect error paths 2026-05-28 12:26:36 +02:00
act_mpls.c net/sched: add qstats_cpu_drop_inc() helper 2026-05-04 18:59:07 -07:00
act_nat.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
act_pedit.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_police.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_sample.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_simple.c net/sched: Remove redundant memset(0) call in reset_policy() 2025-08-12 17:13:29 -07:00
act_skbedit.c net/sched: add qstats_cpu_drop_inc() helper 2026-05-04 18:59:07 -07:00
act_skbmod.c net/sched: act_skbmod: fix length calculations and avoid invalid header warnings 2026-08-25 11:04:12 +02:00
act_tunnel_key.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
act_vlan.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
bpf_qdisc.c bpf: net_sched: Use the correct destructor kfunc type 2026-01-12 18:53:57 -08:00
cls_api.c net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). 2026-09-10 12:06:23 +02:00
cls_basic.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_bpf.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_cgroup.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_flow.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_flower.c net/sched: cls_flower: validate mask pointer after nla_next() 2026-08-31 17:02:56 -07:00
cls_fw.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_matchall.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_route.c net/sched: cls_route: Fix in-place replace 2026-09-10 11:27:52 +02:00
cls_u32.c net/sched: cls_u32: fix manual hash table handle IDR aliasing 2026-09-17 17:00:28 -07:00
em_canid.c net/sched: em_canid: fix uninit-value in em_canid_match 2025-11-26 16:28:10 +01:00
em_cmp.c net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() 2025-11-24 18:53:14 -08:00
em_ipset.c
em_ipt.c
em_meta.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
em_nbyte.c net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() 2025-11-24 18:53:14 -08:00
em_text.c net/sched: fix potential stack infoleak in em_text_dump() 2026-09-22 19:14:25 -07:00
em_u32.c
ematch.c
Kconfig
Makefile
sch_api.c net/sched: defer qdisc freeing after failed creation 2026-09-05 12:40:05 -07:00
sch_blackhole.c
sch_cake.c net/sched: sch_cake: fix autorate reconfiguration throttling 2026-08-22 13:51:40 -07:00
sch_cbs.c net: sched: avoid printing uninitialized link speed 2026-06-11 15:44:55 +02:00
sch_choke.c net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() 2026-05-11 18:28:07 -07:00
sch_codel.c net/sched: sch_codel: clamp default mtu to avoid disabling CoDel 2026-08-25 13:09:32 +02:00
sch_drr.c net/sched: drr: clamp quantum in change class 2026-09-05 13:48:08 -07:00
sch_dualpi2.c net/sched: dualpi2: clamp psched_mtu at all call sites 2026-09-05 13:48:02 -07:00
sch_etf.c net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() 2026-05-11 18:28:07 -07:00
sch_ets.c net/sched: ets: clamp quantum in parse and fallback paths 2026-09-05 13:48:08 -07:00
sch_fifo.c net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue 2026-08-20 13:28:45 -07:00
sch_fq_codel.c net/sched: fq_codel: clamp default quantum and mtu 2026-08-25 13:09:32 +02:00
sch_fq_pie.c net/sched: fq_pie: clamp quantum in change path 2026-09-05 13:47:29 -07:00
sch_fq.c net/sched: fq: clamp quantum and initial_quantum in change path 2026-09-05 13:47:29 -07:00
sch_frag.c net: convert remaining ipv6_stub users to direct function calls 2026-03-29 11:21:23 -07:00
sch_generic.c net/sched: defer qdisc freeing after failed creation 2026-09-05 12:40:05 -07:00
sch_gred.c net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue 2026-08-20 13:28:45 -07:00
sch_hfsc.c net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget 2026-09-19 16:42:11 -07:00
sch_hhf.c net/sched: hhf: cap hh_flows_limit at change time 2026-09-15 13:30:53 +02:00
sch_htb.c net/sched: sch_htb: limit htb_classify inner-class filter hops 2026-08-27 12:47:58 -07:00
sch_ingress.c clsact: Fix use-after-free in init/destroy rollback asymmetry 2026-03-17 12:09:16 +01:00
sch_mq.c net/sched: mq: no longer acquire qdisc spinlocks in dump operations 2026-05-11 18:28:08 -07:00
sch_mqprio_lib.c net: add READ_ONCE()/WRITE_ONCE() annotations for dev->prio_tc_map 2026-08-17 10:27:48 -07:00
sch_mqprio_lib.h
sch_mqprio.c net: prevent torn reads in netdev_tc_txq 2026-08-17 10:27:48 -07:00
sch_multiq.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_netem.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-05-28 14:02:21 -07:00
sch_pie.c net/sched: pie: clamp psched_mtu in pie_drop_early 2026-09-05 13:48:08 -07:00
sch_plug.c net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue 2026-08-20 13:28:45 -07:00
sch_prio.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_qfq.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_red.c net/sched: annotate data-races around sch->qstats.backlog 2026-05-11 18:28:07 -07:00
sch_sfb.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_sfq.c net/sched: sfq: clamp quantum in change path 2026-09-05 13:47:30 -07:00
sch_skbprio.c net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() 2026-05-11 18:28:07 -07:00
sch_taprio.c net: add READ_ONCE()/WRITE_ONCE() annotations for dev->prio_tc_map 2026-08-17 10:27:48 -07:00
sch_tbf.c net/sched: tbf: add extack to offload params 2026-05-22 17:23:37 -07:00
sch_teql.c net/sched: sch_teql: restore skb->dev on the slave failure path 2026-08-25 15:24:35 +02:00