pskb_expand_head() allocates a new skb data buffer using kmalloc_reserve(), which does not initialize memory. skb helpers may later copy or move padding bytes from the buffer. Initialize the newly allocated skb buffer to avoid propagating uninitialized memory. Reported-by: syzbot+619b9ef527f510a57cfc@syzkaller.appspotmail.com Signed-off-by: Soham Metha --- #syz test net/core/skbuff.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index a56133902c0d..b0f0d3a0310b 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2282,6 +2282,9 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail, data = kmalloc_reserve(&size, gfp_mask, NUMA_NO_NODE, NULL); if (!data) goto nodata; + + memset(data, 0, size); + size = SKB_WITH_OVERHEAD(size); /* Copy only real data... and, alas, header. This should be -- 2.34.1