Subject: Re: [PATCH net v3] xfrm: clear trailing padding in build_polexpire()

From: Simon Horman <[email-masked]>
Date: Fri, 27 Mar 2026 13:38:47 +0000

On Thu, Mar 26, 2026 at 02:58:00PM +0900, Yasuaki Torimaru wrote:
> build_expire() clears the trailing padding bytes of struct
> xfrm_user_expire after setting the hard field via memset_after(),
> but the analogous function build_polexpire() does not do this for
> struct xfrm_user_polexpire.
> 
> The padding bytes after the __u8 hard field are left
> uninitialized from the heap allocation, and are then sent to
> userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,
> leaking kernel heap memory contents.
> 
> Add the missing memset_after() call, matching build_expire().
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: [email-masked]
> Signed-off-by: Yasuaki Torimaru <[email-masked]>
> ---
> v3:
>   - fix Fixes tag to cite the commit that introduced the bug
>     (was: e3e5fc1698ae which fixed the related build_expire() function)
> v2: https://lore.kernel.org/netdev/[email-masked]/
>   - add Fixes tag and Cc stable (requested by Steffen Klassert)
> v1: https://lore.kernel.org/netdev/[email-masked]/

Thanks for the updates.

Reviewed-by: Simon Horman <[email-masked]>