From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f173.google.com (mail-dy1-f173.google.com [74.125.82.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E4D7426694 for ; Thu, 11 Jun 2026 16:53:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781196825; cv=none; b=s1zUeKSuTTp6nT9lQoeNSlgrJPH6dC05JSIRGEEmkMKTbYRd4Zt+wxKKPwXp4O1J+Uxa2DLFAXzJ3OoKauviH4sAQGhs7rbUiRChh3vwMyCfEhwiNkYtXaDWGppuD6QsQSfiW3Rl+54+vE2lmC4jp36y660U4pFhMn35RQRqCyM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781196825; c=relaxed/simple; bh=Dk1MPEW5mG9bxfvtt3CfMtvzXRHMQBCjfp7cwnyOlRM=; h=Mime-Version:Content-Type:Date:Message-Id:To:Cc:Subject:From: References:In-Reply-To; b=em8OtWQid8UQJymXeTvLicRppZpUQGKbWpqmWbh8p2zMnBRsh5iHtaRxd69Fv69cG4Fyym7AsvJhmHCzXV0xnjh7iDo2xiy2RK/PGYMMLhUDSosTf/8hIpjD182xF6KX3L1M+WHQYY9wCxRqXrg/JieUz7GDFx7kTDPBAbEXjMM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=etsalapatis.com; spf=pass smtp.mailfrom=etsalapatis.com; dkim=pass (2048-bit key) header.d=etsalapatis-com.20251104.gappssmtp.com header.i=@etsalapatis-com.20251104.gappssmtp.com header.b=el/nEkc8; arc=none smtp.client-ip=74.125.82.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=etsalapatis.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=etsalapatis.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=etsalapatis-com.20251104.gappssmtp.com header.i=@etsalapatis-com.20251104.gappssmtp.com header.b="el/nEkc8" Received: by mail-dy1-f173.google.com with SMTP id 5a478bee46e88-304d7f31215so103133eec.1 for ; Thu, 11 Jun 2026 09:53:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=etsalapatis-com.20251104.gappssmtp.com; s=20251104; t=1781196823; x=1781801623; darn=vger.kernel.org; h=in-reply-to:references:from:subject:cc:to:message-id:date :content-transfer-encoding:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=yV1yJVHjmtpmQuw49fMKDZa3YtMwjdJaARv8Q+M7YxE=; b=el/nEkc8aGkWc/8OaLMRGsQS5lixUx96qDGRfw69bbo+eYl0kIQovVSw1gGGOYnbbH qh8+NaNjatCJA1f8Nf4MOUfMEtlr8i2NVHGl+m6pnGFvdw+lleGbsZNbIEkYaMizsuPJ 9H7ygippdhHLLPeOJQpyEDvz1RoYhiL7a8ncVe2hv6zA01cO0kEooBNW2WHF2Sg9uiZt KbpqL0EkBn8koAuKtwamoPMx/YVYoi8wEXq5+LW9Q5keJBUr5HmFZw9wfb/HOWz1jgrC ujCGIFFkdM4N1kgh0C4AYaUw4vnsw5c/DS5lAwjFXbtp4InTf4GAfEVQrCZFDmNKD2fx xwqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781196823; x=1781801623; h=in-reply-to:references:from:subject:cc:to:message-id:date :content-transfer-encoding:mime-version:x-gm-gg:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=yV1yJVHjmtpmQuw49fMKDZa3YtMwjdJaARv8Q+M7YxE=; b=c4rVMJAE1d7/vDn4Wg/h+Db/M/kyo6rNTptZZwkR1BEaa909bCFK6RFtxpQhjSUwF5 nDhwGoORE14R8pFSpVobuYLf9m1rHeXWqnWeE9vAMRtVb8t1zBxuqIMfmxeV47JBBka8 pfunE8eAomSxfOtD+eI1oFkbCwRCquxAlp1DWkwpEEKCBxPwfq+dQueLf1VsPxbscBeC x1ZKSDXPSGsGerf5ZUbfqIYUaDmV2FYvAYK8q9rG8asAYLgm7cxaAIegbUirwIqfj/4c dJ2+Fea7aZLmAoUhlK5Z7geAtMxS6jyKwn3k7p2d39jdQa+SIAAffdpslB5JRobPKnCT loTA== X-Forwarded-Encrypted: i=1; AFNElJ84on79ekDbRFJklxQgi4Ip9IYUnbgkxb0Zee4VpEHTQEkCtDKq03Khlsvz1KQ/WUpR5p1dmMipuiLAbLM=@vger.kernel.org X-Gm-Message-State: AOJu0YxrKVQqB0tk0MIDnTUaC59jJ7TB/hUyG+rr9tgCqtvs0830/G6z /4ERMtwYhww2krwQKy/hIeaEr8bUEDEzJepgVyoxCZsfrPjwPWJudxZTHoN9wCO4sug= X-Gm-Gg: Acq92OFwVV0ZW1G7JnoPTItqD23R78LgJR7fr8uRVkttMD7L/mFbh3kFVrqVxKENU4L J7SNRKGZaNaWJc/leLNbHrAcN8hd/Ovl+Df+mA3QAytpqIG1TgKDJyqXOL/6xvGqyI8l4sMZF9C o4SXkwlIQUZof4hH6ammS7cxMhrEUaRn7uHd7Yvbx3x953VLwla0qBFn5iLWN9QKpRx4aMc10eh 5ZLrY1mje4J93mC53ANSMNM8URkRPI+7fjkr6exitBKbrlemG4vwhTjuDLpebc9WSAfTZVuIVvy an7Qw8t1eFcsD4eK1+dyN9xJnEh9V90eqZ1WDm/gOtBfXr+3U/Zf33R5RLqxe2ADvAh4S38Kacg ksTVjSTT2b1CYxFnX6pFFje5cY5UT5ZY7r1RL4aTbWMrE06sIvBkkAsu3p4sEoCCtPlGCQ9RyLp 8daPbB0YhSx43Kkdk= X-Received: by 2002:a05:7300:2382:b0:304:cefc:5fd7 with SMTP id 5a478bee46e88-30804d42f83mr2516335eec.32.1781196823165; Thu, 11 Jun 2026 09:53:43 -0700 (PDT) Received: from localhost ([2620:10d:c090:600::9f35]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30806eb7570sm2455352eec.20.2026.06.11.09.53.40 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 11 Jun 2026 09:53:42 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Thu, 11 Jun 2026 12:53:39 -0400 Message-Id: To: "Jiayuan Chen" , Cc: "Weiming Shi" , "Xiang Mei" , "Xinyu Ma" , "Alexei Starovoitov" , "Daniel Borkmann" , "Andrii Nakryiko" , "Eduard Zingerman" , "Kumar Kartikeya Dwivedi" , "Martin KaFai Lau" , "Song Liu" , "Yonghong Song" , "Jiri Olsa" , "Emil Tsalapatis" , "John Fastabend" , "Stanislav Fomichev" , "David S. Miller" , "Eric Dumazet" , "Jakub Kicinski" , "Paolo Abeni" , "Simon Horman" , "Jakub Sitnicki" , "Shuah Khan" , "Jesper Dangaard Brouer" , "Ihor Solodrai" , "Sechang Lim" , "Cong Wang" , , , Subject: Re: [PATCH bpf v2 3/7] bpf, sockmap: zero-initialize pages allocated in bpf_msg_push_data From: "Emil Tsalapatis" X-Mailer: aerc 0.21.0-0-g5549850facc2 References: <20260611123538.156005-1-jiayuan.chen@linux.dev> <20260611123538.156005-4-jiayuan.chen@linux.dev> In-Reply-To: <20260611123538.156005-4-jiayuan.chen@linux.dev> On Thu Jun 11, 2026 at 8:34 AM EDT, Jiayuan Chen wrote: > From: Weiming Shi > > bpf_msg_push_data() allocates pages via alloc_pages() without > __GFP_ZERO. In the non-copy path, the entire page of uninitialized > heap content is added directly to the sk_msg scatterlist, which is > then transmitted over TCP to userspace via tcp_bpf_push(). In the > copy path, a gap of len bytes between the front and back memcpy > regions is similarly left uninitialized. > > This leads to a kernel heap information leak: stale page content > including kernel pointers from the direct-map and vmemmap regions > is transmitted to userspace, which can be used to defeat KASLR. > > Add __GFP_ZERO to the alloc_pages() call to ensure the allocated > page is always zeroed before it enters the scatterlist. > Reviewed-by: Emil Tsalapatis > Link: https://lore.kernel.org/all/20260424155913.A19FDC19425@smtp.kernel.= org > Fixes: 6fff607e2f14 ("bpf: sk_msg program helper bpf_msg_push_data") > Tested-by: Xiang Mei > Tested-by: Xinyu Ma > Reviewed-by: Jiayuan Chen > Cc: Jiayuan Chen > Signed-off-by: Weiming Shi > --- > net/core/filter.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/core/filter.c b/net/core/filter.c > index 3e555f276ba80..6e345ca65ca14 100644 > --- a/net/core/filter.c > +++ b/net/core/filter.c > @@ -2832,7 +2832,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg,= u32, start, > if (unlikely(copy + len < copy)) > return -EINVAL; > =20 > - page =3D alloc_pages(__GFP_NOWARN | GFP_ATOMIC | __GFP_COMP, > + page =3D alloc_pages(__GFP_NOWARN | GFP_ATOMIC | __GFP_COMP | __GFP_ZER= O, > get_order(copy + len)); > if (unlikely(!page)) > return -ENOMEM;