[BUG] net/sched: act_ife can emit uninitialized bytes for zero metadata

[shaos <shawnq1@163.com>]

Hello,

An attacker with only namespace-scoped CAP_NET_ADMIN and CAP_NET_RAW installs a matchall IFE encode action carrying a zero-valued skb mark in a fresh user/network namespace. The presence callback reserves an 8-byte TLV, but the encoder emits no value bytes. The resulting frame contains six bytes from a freed kmalloc object previously populated by a different UID.

HEAD commit:    c03c1a14507dfaf8b856c2608f9ac216021fc222
git tree:       30fd2ef82912c26cf3a58ad0ba6afc375fa851ac
source version: Linux 7.3.0, local master
compiler:       gcc 11.4.0, GNU ld 2.38

console output:
https://gist.githubusercontent.com/shaos26/ef81659b25f21284f8e947074fc2a249/raw/fed962675ff9018ab35483e75af1f64b349d0465/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/ef81659b25f21284f8e947074fc2a249/raw/cbbe560851613f20ee1d9893671a4bd8ab44c44b/kernel-config.txt
reproducer sources:
https://gist.githubusercontent.com/shaos26/5e309509387950d97539adf449e7f725/raw/d9a204d10cb437095253c4ff74675c99245a6a2c/poc.c
https://gist.githubusercontent.com/shaos26/5e309509387950d97539adf449e7f725/raw/a81c7411e6b232f24cd42ea4b88a2e84b66af4ba/ife_trace.c

Build the tested kernel with the attached configuration and boot a disposable QEMU guest with user/network namespaces, veth, packet sockets, matchall, and IFE skb-mark metadata support. The linked userspace sources reproduce the zero-mark and allocator-trace cases with separate victim and attacker identities.

Impact and prerequisites:
A UID 65534 attacker in a fresh user/network namespace repeatedly received six bytes from a freed kmalloc object populated by a UID 65533 helper, although the attacker could not read the helper's mode-0600 marker file. This is a cross-user information disclosure. User namespaces, network namespaces, CAP_NET_ADMIN, CAP_NET_RAW, veth, and IFE support are required; no privilege escalation or credential extraction is demonstrated.

Validation: Two fresh cross-UID boots reproduced the marker bytes; init_on_alloc=1 zeroed the TLV bytes, and the nonzero-mark control emitted a valid TLV.

Thanks,

shaos