Re: [PATCH net v2] net: bridge: mrp: fix uninitialised bytes on the wire

[Nikolay Aleksandrov <razor@blackwall.org>]

On Wed, Jul 29, 2026 at 10:19:41PM +0900, Baul Lee wrote:
> br_mrp_alloc_test_skb() builds MRP test frames on an skb from
> dev_alloc_skb(), which does not clear the linear data area.  On the MRA
> ring-role branch the sub-option TLV header is appended with
> 
> 	sub_tlv = skb_put(skb, sizeof(*sub_tlv));
> 	sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;
> 
> so sub_tlv->length is never written, and the two trailing alignment bytes
> are appended with a bare skb_put() that does not clear them either.  The
> neighbouring oui and sub_opt regions are explicitly zeroed, so three
> uninitialised bytes are left in every MRA MRP_Test frame that goes out.
> 
> Put the sub-option TLV header and the alignment padding in a single
> skb_put_zero(), which clears both.  The AUTO_MGR sub-TLV carries no
> payload, so the zeroed length field is already the value it should have.
> 
> Fixes: f7458934b079 ("net: bridge: mrp: Update the Test frames for MRA")
> Suggested-by: Nikolay Aleksandrov <razor@blackwall.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: Baul Lee <baul.lee@xbow.com>
> ---
> v2:
>  - fold the alignment padding into a single skb_put_zero() for the
>    sub-option TLV header, dropping the explicit length assignment and the
>    second skb_put() (Nikolay Aleksandrov)
>  - drop the paragraph about observing the leak, and the Reported-by tags
> 
> Link to v1: https://lore.kernel.org/netdev/20260726062518.43774-1-baul.lee@xbow.com/
> 
>  net/bridge/br_mrp.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/net/bridge/br_mrp.c b/net/bridge/br_mrp.c
> index 179d2470b..ef16d0703 100644
> --- a/net/bridge/br_mrp.c
> +++ b/net/bridge/br_mrp.c
> @@ -224,11 +224,9 @@ static struct sk_buff *br_mrp_alloc_test_skb(struct br_mrp *mrp,
>  		sub_opt = skb_put(skb, sizeof(*sub_opt));
>  		memset(sub_opt, 0x0, sizeof(*sub_opt));
>  
> -		sub_tlv = skb_put(skb, sizeof(*sub_tlv));
> -		sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;
> -
>  		/* 32 bit alligment shall be ensured therefore add 2 bytes */
> -		skb_put(skb, MRP_OPT_PADDING);
> +		sub_tlv = skb_put_zero(skb, sizeof(*sub_tlv) + MRP_OPT_PADDING);
> +		sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;
>  	}
>  
>  	br_mrp_skb_tlv(skb, BR_MRP_TLV_HEADER_END, 0x0);
> -- 
> 2.53.0
> 

You should not send patches as replies, they should be sent on
their own. Aside from that the patch looks good to me:

Acked-by: Nikolay Aleksandrov <razor@blackwall.org>