[PATCH] net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak

[PATCH] net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak

[Yochai Eisenrich]

When processing Router Advertisements with user options the kernel
builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct
has three padding fields that are never zeroed and can leak kernel data

The fix is simple, just zeroes the padding fields.

Fixes: 31910575a9de ("[IPv6]: Export userland ND options through netlink
    (RDNSS support)")
Signed-off-by: Yochai Eisenrich <echelonh@gmail.com>

---
 net/ipv6/ndisc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index f6a5d8c73af9..186e60c79214 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1209,6 +1209,9 @@ static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
 	ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
 	ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
 	ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
+	ndmsg->nduseropt_pad1 = 0;
+	ndmsg->nduseropt_pad2 = 0;
+	ndmsg->nduseropt_pad3 = 0;

 	memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);

--
2.53.0

Re: [PATCH] net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak

[Simon Horman]

On Wed, Mar 25, 2026 at 12:49:25AM +0200, Yochai Eisenrich wrote:
> When processing Router Advertisements with user options the kernel
> builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct
> has three padding fields that are never zeroed and can leak kernel data
> 
> The fix is simple, just zeroes the padding fields.
> 
> Fixes: 31910575a9de ("[IPv6]: Export userland ND options through netlink
>     (RDNSS support)")

Fixes tags should be all on one line; no line wrapping.

> Signed-off-by: Yochai Eisenrich <echelonh@gmail.com>

Reviewed-by: Simon Horman <horms@kernel.org>

...

Re: [PATCH] net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 25 Mar 2026 00:49:25 +0200 you wrote:
> When processing Router Advertisements with user options the kernel
> builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct
> has three padding fields that are never zeroed and can leak kernel data
> 
> The fix is simple, just zeroes the padding fields.
> 
> Fixes: 31910575a9de ("[IPv6]: Export userland ND options through netlink
>     (RDNSS support)")
> Signed-off-by: Yochai Eisenrich <echelonh@gmail.com>
> 
> [...]

Here is the summary with links:
  - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
    https://git.kernel.org/netdev/net/c/ae05340ccaa9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html