[PATCH net] ip6mr: prevent info-leak in ip6mr_cache_report()

[Henry Martin <bsdhenrymartin@gmail.com>]

The non-WHOLEPKT branch copies the IPv6 header at offset 0 and then
appends 40 bytes with skb_put(), but the mrt6msg is written at offset 0
after skb_reset_transport_header(), so the appended 40 bytes are never
initialized.  They hold stale heap contents.

The report is queued to the mroute6 socket and copied into the
IP6MRA_CREPORT_PKT netlink attribute, disclosing the stale bytes to
user space.  The stale bytes can contain kernel heap and image
pointers, and the report is reachable from an unprivileged user
namespace (MRT6_INIT in a new netns, plus the non-root
RTNLGRP_IPV6_MROUTE_R group).

Use skb_put_zero() instead, as the IPv4 code does since
commit 4f34002e2e376 ("ipmr: prevent info-leak in pmr_cache_report()").

This issue was discovered by Tencent CodeBuddy Security.

Fixes: 7bc570c8b4f75 ("[IPV6] MROUTE: Support multicast forwarding.")
Cc: stable@vger.kernel.org
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
 net/ipv6/ip6mr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index dd0638d3c3f95..b7ae220d6b21d 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1154,7 +1154,7 @@ static int ip6mr_cache_report(const struct mr_table *mrt, struct sk_buff *pkt,
 	/*
 	 *	Add our header
 	 */
-	skb_put(skb, sizeof(*msg));
+	skb_put_zero(skb, sizeof(*msg));
 	skb_reset_transport_header(skb);
 	msg = (struct mrt6msg *)skb_transport_header(skb);
 
-- 
2.43.7