br_mrp_alloc_test_skb() builds MRP test frames on an skb from dev_alloc_skb(), which does not zero the linear data area. On the MRA ring-role branch the sub-option TLV header is appended with sub_tlv = skb_put(skb, sizeof(*sub_tlv)); sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR; leaving sub_tlv->length unwritten, and the two trailing alignment bytes are appended with a bare skb_put() that neither writes nor clears them. The surrounding oui and sub_opt regions are explicitly memset(0), which bounds the exposure to exactly these three bytes. Every MRA MRP_Test frame therefore carries three bytes of stale page-allocator memory, at frame offsets 65 to 67, to any observer of the MRP control traffic. A capture on a kernel without CONFIG_INIT_ON_ALLOC_DEFAULT_ON shows those bytes varying frame to frame and, after a page-allocator spray, carrying the sprayed pattern; the same reproducer on an otherwise identical CONFIG_INIT_ON_ALLOC_DEFAULT_ON kernel leaks nothing, confirming the source is uninitialised allocation memory. Reaching it needs CAP_NET_ADMIN, which is self-satisfiable on a stock kernel through unprivileged user and network namespaces. Assign the sub-option TLV length explicitly, which is 0 as the AUTO_MGR sub-TLV carries no payload, and append the alignment padding with skb_put_zero(). Discovered by XBOW, triaged by Baul Lee Fixes: f7458934b079 ("net: bridge: mrp: Update the Test frames for MRA") Reported-by: Federico Kirschbaum Reported-by: Baul Lee Cc: stable@vger.kernel.org Signed-off-by: Baul Lee --- net/bridge/br_mrp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bridge/br_mrp.c b/net/bridge/br_mrp.c index 3f7126a7d720..a5548f475604 100644 --- a/net/bridge/br_mrp.c +++ b/net/bridge/br_mrp.c @@ -226,9 +226,10 @@ static struct sk_buff *br_mrp_alloc_test_skb(struct br_mrp *mrp, sub_tlv = skb_put(skb, sizeof(*sub_tlv)); sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR; + sub_tlv->length = 0x0; /* 32 bit alligment shall be ensured therefore add 2 bytes */ - skb_put(skb, MRP_OPT_PADDING); + skb_put_zero(skb, MRP_OPT_PADDING); } br_mrp_skb_tlv(skb, BR_MRP_TLV_HEADER_END, 0x0); -- 2.50.1 (Apple Git-155)