net: bridge: mrp: fix uninitialised bytes on the wire

br_mrp_alloc_test_skb() builds MRP test frames on an skb from
dev_alloc_skb(), which does not clear the linear data area.  On the MRA
ring-role branch the sub-option TLV header is appended with

	sub_tlv = skb_put(skb, sizeof(*sub_tlv));
	sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;

so sub_tlv->length is never written, and the two trailing alignment bytes
are appended with a bare skb_put() that does not clear them either.  The
neighbouring oui and sub_opt regions are explicitly zeroed, so three
uninitialised bytes are left in every MRA MRP_Test frame that goes out.

Put the sub-option TLV header and the alignment padding in a single
skb_put_zero(), which clears both.  The AUTO_MGR sub-TLV carries no
payload, so the zeroed length field is already the value it should have.

Fixes: f7458934b079 ("net: bridge: mrp: Update the Test frames for MRA")
Suggested-by: Nikolay Aleksandrov <razor@blackwall.org>
Cc: stable@vger.kernel.org
Signed-off-by: Baul Lee <baul.lee@xbow.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260729131941.10254-1-baul.lee@xbow.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/bridge/br_mrp.c b/net/bridge/br_mrp.c
index 179d2470b724888ed2eff979ea333691d3410eb1..ef16d07039241a76dde0a0923030024bba2c1c33 100644 (file)
--- a/net/bridge/br_mrp.c
+++ b/net/bridge/br_mrp.c
@@ -224,11 +224,9 @@ static struct sk_buff *br_mrp_alloc_test_skb(struct br_mrp *mrp,
                sub_opt = skb_put(skb, sizeof(*sub_opt));
                memset(sub_opt, 0x0, sizeof(*sub_opt));
 
-               sub_tlv = skb_put(skb, sizeof(*sub_tlv));
-               sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;
-
                /* 32 bit alligment shall be ensured therefore add 2 bytes */
-               skb_put(skb, MRP_OPT_PADDING);
+               sub_tlv = skb_put_zero(skb, sizeof(*sub_tlv) + MRP_OPT_PADDING);
+               sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;
        }
 
        br_mrp_skb_tlv(skb, BR_MRP_TLV_HEADER_END, 0x0);