git: 5eaad7c9c593 - releng/13.2 - netlink: Zero-initialize mbuf messages

From: Alexander V. Chernikov <>
Date: Mon, 20 Feb 2023 20:13:04 UTC
The branch releng/13.2 has been updated by melifaro:


commit 5eaad7c9c593908dfd4ab7e665b66e0e19542e60
Author:     Mark Johnston <>
AuthorDate: 2023-01-17 14:36:54 +0000
Commit:     Alexander V. Chernikov <>
CommitDate: 2023-02-20 19:47:42 +0000

    netlink: Zero-initialize mbuf messages
    Some users of nlmsg_reserve_object() and nlmsg_reserve_data() are not
    careful to fully initialize pad and reserved fields, allowing
    uninitialized bytes to leak to userspace.  For example, dump_nhgrp()
    doesn't set nhm->resvd = 0.
    Meanwhile, nlmsg_get_ns_buf() and nlmsg_get_ns_lbuf() zero-initialize
    the buffer, so nlmsg_get_ns_mbuf() is inconsistent.  Let's just make
    them all behave the same here.
    Reported by:    KMSAN
    Reviewed by:    melifaro
    Approved by:    re(cperciva)
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:
    (cherry picked from commit d91be0f1211b0196a0087cdfa237a6a0d2a43b65)
    (cherry picked from commit 13e997289240c4697536f904167720a29abf7a58)
 sys/netlink/netlink_message_writer.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sys/netlink/netlink_message_writer.c b/sys/netlink/netlink_message_writer.c
index 37414703c6f6..6573394eb881 100644
--- a/sys/netlink/netlink_message_writer.c
+++ b/sys/netlink/netlink_message_writer.c
@@ -215,6 +215,7 @@ nlmsg_get_ns_mbuf(struct nl_writer *nw, int size, bool waitok)
 	nw->malloc_flag = mflag;
 	nw->num_messages = 0;
 	nw->enomem = false;
+	memset(nw->data, 0, size);
         NL_LOG(LOG_DEBUG2, "alloc mbuf %p req_len %d alloc_len %d data_ptr %p",
             m, size, nw->alloc_len, nw->data);
         return (true);