diff options
| author |   Jason A. Donenfeld <Jason@zx2c4.com> | 2026-05-05 15:53:22 +0200 |
|---|---|---|
| committer | Jason A. Donenfeld <Jason@zx2c4.com> | 2026-05-24 10:38:24 +0200 |
| commit | e29733d8b8e6e11be1710cecab4450448e1ec69d (patch) | |
| tree | 1104a00cd08755e62fb7e7497df18671b8f73a4e /tools/testing/selftests/vfio/lib/include/libvfio.h | |
| parent | ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (diff) | |
With how this is currently written, we add the trailer, zero it out, and
then add the header space on. If that headers pace requires a
reallocation + copy, the zeros in the trailer aren't copied, because the
skb len hasn't actually been yet expanded to cover that. In that case,
the trailer bytes are uninitialized. This winds up getting sent out
encrypted over the network.
I'm unable to actually cause this to happen, except by twiddling locally
with tc-bpf, calling bpf_skb_change_head(skb, 32, 0) in a hook, so it
doesn't seem to be a real problem. Nevertheless, it seems correct to fix
this.
Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
Cc: stable@vger.kernel.org
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Diffstat (limited to 'tools/testing/selftests/vfio/lib/include/libvfio.h')
0 files changed, 0 insertions, 0 deletions