[PATCH net] net: mctp: ensure our nlmsg responses are initialised

[PATCH net] net: mctp: ensure our nlmsg responses are initialised

[Jeremy Kerr]

Syed Faraz Abrar (@farazsth98) from Zellic, and Pumpkin (@u1f383) from
DEVCORE Research Team working with Trend Micro Zero Day Initiative
report that a RTM_GETNEIGH will return uninitalised data in the pad
bytes of the ndmsg data.

Ensure we're initialising the netlink data to zero, in the link, addr
and neigh response messages.

Fixes: 831119f88781 ("mctp: Add neighbour netlink interface")
Fixes: 06d2f4c583a7 ("mctp: Add netlink route management")
Fixes: 583be982d934 ("mctp: Add device handling and netlink interface")
Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
---
 net/mctp/device.c | 1 +
 net/mctp/neigh.c  | 1 +
 net/mctp/route.c  | 1 +
 3 files changed, 3 insertions(+)

diff --git a/net/mctp/device.c b/net/mctp/device.c
index 4d404edd7446e187dd3aa18ee2086c4e2e3da3ee..04c5570bacff69690456d73490a9e4bdebf49d8d 100644
--- a/net/mctp/device.c
+++ b/net/mctp/device.c
@@ -70,6 +70,7 @@ static int mctp_fill_addrinfo(struct sk_buff *skb,
 		return -EMSGSIZE;
 
 	hdr = nlmsg_data(nlh);
+	memset(hdr, 0, sizeof(*hdr));
 	hdr->ifa_family = AF_MCTP;
 	hdr->ifa_prefixlen = 0;
 	hdr->ifa_flags = 0;
diff --git a/net/mctp/neigh.c b/net/mctp/neigh.c
index 05b899f22d902b275ca1e300542a8d546d59ea15..fc85f0e693014309da9c60e46485466cb5bb6dda 100644
--- a/net/mctp/neigh.c
+++ b/net/mctp/neigh.c
@@ -218,6 +218,7 @@ static int mctp_fill_neigh(struct sk_buff *skb, u32 portid, u32 seq, int event,
 		return -EMSGSIZE;
 
 	hdr = nlmsg_data(nlh);
+	memset(hdr, 0, sizeof(*hdr));
 	hdr->ndm_family = AF_MCTP;
 	hdr->ndm_ifindex = dev->ifindex;
 	hdr->ndm_state = 0; // TODO other state bits?
diff --git a/net/mctp/route.c b/net/mctp/route.c
index 2ac4011a953fffe9e01f3bfe0f571b3727b3e903..ecbbe4beb2133b90d2a02031baaa058644f0e8fe 100644
--- a/net/mctp/route.c
+++ b/net/mctp/route.c
@@ -1643,6 +1643,7 @@ static int mctp_fill_rtinfo(struct sk_buff *skb, struct mctp_route *rt,
 		return -EMSGSIZE;
 
 	hdr = nlmsg_data(nlh);
+	memset(hdr, 0, sizeof(*hdr));
 	hdr->rtm_family = AF_MCTP;
 
 	/* we use the _len fields as a number of EIDs, rather than

---
base-commit: 05f7e89ab9731565d8a62e3b5d1ec206485eeb0b
change-id: 20251205-dev-mctp-nlmsg-69dbefa5df7f

Best regards,
-- 
Jeremy Kerr <jk@codeconstruct.com.au>

Re: [PATCH net] net: mctp: ensure our nlmsg responses are initialised

[Simon Horman]

On Mon, Feb 09, 2026 at 03:27:33PM +0800, Jeremy Kerr wrote:
> Syed Faraz Abrar (@farazsth98) from Zellic, and Pumpkin (@u1f383) from
> DEVCORE Research Team working with Trend Micro Zero Day Initiative
> report that a RTM_GETNEIGH will return uninitalised data in the pad
> bytes of the ndmsg data.
> 
> Ensure we're initialising the netlink data to zero, in the link, addr
> and neigh response messages.
> 
> Fixes: 831119f88781 ("mctp: Add neighbour netlink interface")
> Fixes: 06d2f4c583a7 ("mctp: Add netlink route management")
> Fixes: 583be982d934 ("mctp: Add device handling and netlink interface")
> Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net] net: mctp: ensure our nlmsg responses are initialised

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 09 Feb 2026 15:27:33 +0800 you wrote:
> Syed Faraz Abrar (@farazsth98) from Zellic, and Pumpkin (@u1f383) from
> DEVCORE Research Team working with Trend Micro Zero Day Initiative
> report that a RTM_GETNEIGH will return uninitalised data in the pad
> bytes of the ndmsg data.
> 
> Ensure we're initialising the netlink data to zero, in the link, addr
> and neigh response messages.
> 
> [...]

Here is the summary with links:
  - [net] net: mctp: ensure our nlmsg responses are initialised
    https://git.kernel.org/netdev/net/c/a6a9bc544b67

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html