Re: [PATCH net] ipmr: prevent info-leak in pmr_cache_report()

[Ido Schimmel <idosch@nvidia.com>]

Nit: s/pmr_cache_report/ipmr_cache_report/ in subject

On Thu, Apr 30, 2026 at 07:06:11AM +0000, Eric Dumazet wrote:
> Yiming Qian reported:
> 
> <quote>
>  ipmr_cache_report()` allocates a report skb with `alloc_skb(128,
>  GFP_ATOMIC)` and appends a `struct igmphdr` using `skb_put()`. In the
>  non-`IGMPMSG_WHOLEPKT` path it initializes only:
> 
>  - `igmp->type`
>  - `igmp->code`
> 
>  but does not initialize:
> 
>  - `igmp->csum`
>  - `igmp->group`
> 
>  Later, `igmpmsg_netlink_event()` copies the bytes after `sizeof(struct
>  igmpmsg)` into the `IPMRA_CREPORT_PKT` netlink attribute and emits
>  `RTM_NEWCACHEREPORT` on `RTNLGRP_IPV4_MROUTE_R`.
> 
>  As a result, 6 bytes of stale heap data from the skb head are
>  disclosed to userspace.
> </quote>
> 
> Let's use skb_put_zero() instead of skb_put() to fix this bug.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Yiming Qian <yimingqian591@gmail.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

FYI, I checked and ip6mr_cache_report() seems OK.