On Wed, Jul 29, 2026 at 10:19:41PM +0900, Baul Lee wrote:
> br_mrp_alloc_test_skb() builds MRP test frames on an skb from
> dev_alloc_skb(), which does not clear the linear data area. On the MRA
> ring-role branch the sub-option TLV header is appended with
>
> sub_tlv = skb_put(skb, sizeof(*sub_tlv));
> sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;
>
> so sub_tlv->length is never written, and the two trailing alignment bytes
> are appended with a bare skb_put() that does not clear them either. The
> neighbouring oui and sub_opt regions are explicitly zeroed, so three
> uninitialised bytes are left in every MRA MRP_Test frame that goes out.
>
> Put the sub-option TLV header and the alignment padding in a single
> skb_put_zero(), which clears both. The AUTO_MGR sub-TLV carries no
> payload, so the zeroed length field is already the value it should have.
>
> Fixes: f7458934b079 ("net: bridge: mrp: Update the Test frames for MRA")
> Suggested-by: Nikolay Aleksandrov <[email protected]>
> Cc: [email protected]
> Signed-off-by: Baul Lee <[email protected]>
> ---
> v2:
> - fold the alignment padding into a single skb_put_zero() for the
> sub-option TLV header, dropping the explicit length assignment and the
> second skb_put() (Nikolay Aleksandrov)
> - drop the paragraph about observing the leak, and the Reported-by tags
>
> Link to v1:
> https://lore.kernel.org/netdev/[email protected]/
>
> net/bridge/br_mrp.c | 6 ++----
> 1 file changed, 2 insertions(+), 4 deletions(-)
>
> diff --git a/net/bridge/br_mrp.c b/net/bridge/br_mrp.c
> index 179d2470b..ef16d0703 100644
> --- a/net/bridge/br_mrp.c
> +++ b/net/bridge/br_mrp.c
> @@ -224,11 +224,9 @@ static struct sk_buff *br_mrp_alloc_test_skb(struct
> br_mrp *mrp,
> sub_opt = skb_put(skb, sizeof(*sub_opt));
> memset(sub_opt, 0x0, sizeof(*sub_opt));
>
> - sub_tlv = skb_put(skb, sizeof(*sub_tlv));
> - sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;
> -
> /* 32 bit alligment shall be ensured therefore add 2 bytes */
> - skb_put(skb, MRP_OPT_PADDING);
> + sub_tlv = skb_put_zero(skb, sizeof(*sub_tlv) + MRP_OPT_PADDING);
> + sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;
> }
>
> br_mrp_skb_tlv(skb, BR_MRP_TLV_HEADER_END, 0x0);
> --
> 2.53.0
>
You should not send patches as replies, they should be sent on
their own. Aside from that the patch looks good to me:
Acked-by: Nikolay Aleksandrov <[email protected]>
