Re: [PATCH] net/sched: fix potential stack infoleak in em_text_dump()

[Jamal Hadi Salim]

On Fri, Sep 18, 2026 at 9:40 AM Bernard Ladenthin
<bernard.ladenthin@xxxxxxxxx> wrote:
>
> em_text_dump() allocates struct tcf_em_text on the stack without zeroing
> it.  strscpy() writes the algorithm name and a NUL terminator into
> conf.algo[], leaving the remaining bytes uninitialised.  nla_put_nohdr()
> then copies the full struct to the netlink response.
>
> KMSAN on Linux 7.2-rc6 reports two kernel-infoleak splats from this path,
> one triggered via "tc filter show" and one via a raw RTM_GETTFILTER dump:
>
>   BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x1c9/0x2620
>     nla_put_nohdr+0x83/0x130
>     em_text_dump+0x291/0x550
>   Local variable conf created at: em_text_dump+0x5d/0x550
>   Bytes 168-179 of 199 are uninitialized
>
> I am not certain whether this constitutes a real security problem in
> practice: the test was conducted in a controlled KMSAN environment and
> the leaked stack bytes may or may not carry sensitive data on actual
> production kernels.  I am reporting it because KMSAN flagged it as a
> kernel-infoleak and the fix is straightforward.  I can provide a
> userspace reproducer on request.
>
> The original code used strncpy() which zero-pads to the destination size.
> Commit b04202d6065c ("net/sched: replace strncpy with strscpy") replaced
> it with strscpy(), which does not pad, creating this condition.
> Zero-initialising the struct closes it.
>
> Fixes: b04202d6065c ("net/sched: replace strncpy with strscpy")
> Link: https://lore.kernel.org/netdev/20250327143733.187438-1-richard120310@xxxxxxxxx/
> Assisted-by: Claude:claude-sonnet-4-6 [KMSAN]
> Signed-off-by: Bernard Ladenthin <bernard.ladenthin@xxxxxxxxx>

Thanks for providing the PoC offline.

Tested-by: Hybris <hybris@xxxxxxxxxxx>
I reviewed, but I think ACK also means "I reviewed". So:
Acked-by: Jamal Hadi Salim <jhs@xxxxxxxxxxxx>

cheers,
jamal

> ---
>  net/sched/em_text.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/sched/em_text.c b/net/sched/em_text.c
> index 343f1aebeec2..4132f8c3c5fc 100644
> --- a/net/sched/em_text.c
> +++ b/net/sched/em_text.c
> @@ -113,7 +113,7 @@ static void em_text_destroy(struct tcf_ematch *m)
>  static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m)
>  {
>         struct text_match *tm = EM_TEXT_PRIV(m);
> -       struct tcf_em_text conf;
> +       struct tcf_em_text conf = {};
>
>         strscpy(conf.algo, tm->config->ops->name);
>         conf.from_offset = tm->from_offset;
> --
> 2.49.0.windows.1
>