[PATCH RFC] kobject_uevent: explicitly initialize creds in alloc_uevent_skb()

A KMSAN uninit-value warning in put_cmsg() is triggered when a userspace
process receives a uevent with SO_PASSCRED enabled. The uninitialized data
originates from the ucreds local variable in __scm_recv_common(), which is
populated using scm->creds.pid. The scm cookie is initialized in
netlink_recvmsg() by copying the credentials from the socket buffer's
control block.

In alloc_uevent_skb(), the skb control block is populated, but only the uid
and gid fields of the creds structure are explicitly set, omitting the pid
field. Although __alloc_skb() internally zeroes the skb->cb array, KMSAN's
shadow memory tracking does not consistently unpoison this memory when skbs
are recycled from the NAPI cache. Consequently, the uninitialized state
persists through the netlink transmission and triggers a KMSAN warning when
put_cmsg() attempts to copy the pid to userspace.

To fix this, explicitly zero the entire creds structure in
alloc_uevent_skb() before setting the individual fields. This ensures that
the pid field is properly tracked by KMSAN as initialized memory.

Fixes: 26045a7b14bc ("uevent: add alloc_uevent_skb() helper")
Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=08b819a87faa6def6dfb
Link: https://syzkaller.appspot.com/ai_job?id=4575cb01-d27e-485e-a646-6fb71c8694da
To: "Andrew Morton" <[email protected]>
To: "Danilo Krummrich" <[email protected]>
To: <[email protected]>
To: "Greg Kroah-Hartman" <[email protected]>
To: "Rafael J. Wysocki" <[email protected]>
Cc: <[email protected]>

---
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index ddbc4d748..9552aaa87 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -297,6 +297,7 @@ static struct sk_buff *alloc_uevent_skb(struct kobj_uevent_env *env,
 	skb_put_data(skb, env->buf, env->buflen);
 
 	parms = &NETLINK_CB(skb);
+	memset(&parms->creds, 0, sizeof(parms->creds));
 	parms->creds.uid = GLOBAL_ROOT_UID;
 	parms->creds.gid = GLOBAL_ROOT_GID;
 	parms->dst_group = 1;


base-commit: e7ae89a0c97ce2b68b0983cd01eda67cf373517d
-- 
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to Sign-off the patch as a human author
and send it to the upstream kernel mailing lists.
Reply with '#syz reject' to reject it ('#syz unreject' to undo).

See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at [email protected].