Subject: Re: [PATCH] xfrm: clear trailing padding in build_polexpire()

From: Steffen Klassert <[email-masked]>
Date: Mon, 23 Mar 2026 13:21:40 +0100

On Sun, Mar 22, 2026 at 06:04:21AM +0900, Yasuaki Torimaru wrote:
> build_expire() clears the trailing padding bytes of struct
> xfrm_user_expire after setting the hard field via memset_after(),
> but the analogous function build_polexpire() does not do this for
> struct xfrm_user_polexpire.
> 
> The 7 bytes of padding after the __u8 hard field are left
> uninitialized from the heap allocation, and are then sent to
> userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,
> leaking kernel heap memory contents.
> 
> Add the missing memset_after() call, matching build_expire().
> 
> Signed-off-by: Yasuaki Torimaru <[email-masked]>

Can you please add a 'Fixes:' tag, so it can be backported?

Thanks!