On Sun, Jul 26, 2026 at 12:54:33PM +0300, Nikolay Aleksandrov wrote:
> On Sun, Jul 26, 2026 at 03:25:18PM +0900, Baul Lee wrote:
> > br_mrp_alloc_test_skb() builds MRP test frames on an skb from
> > dev_alloc_skb(), which does not zero the linear data area. On the MRA
> > ring-role branch the sub-option TLV header is appended with
> >
> > sub_tlv = skb_put(skb, sizeof(*sub_tlv));
> > sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;
> >
> > leaving sub_tlv->length unwritten, and the two trailing alignment bytes
> > are appended with a bare skb_put() that neither writes nor clears them.
> > The surrounding oui and sub_opt regions are explicitly memset(0), which
> > bounds the exposure to exactly these three bytes.
> >
> > Every MRA MRP_Test frame therefore carries three bytes of stale
> > page-allocator memory, at frame offsets 65 to 67, to any observer of the
> > MRP control traffic. A capture on a kernel without
> > CONFIG_INIT_ON_ALLOC_DEFAULT_ON shows those bytes varying frame to frame
> > and, after a page-allocator spray, carrying the sprayed pattern; the
> > same reproducer on an otherwise identical CONFIG_INIT_ON_ALLOC_DEFAULT_ON
> > kernel leaks nothing, confirming the source is uninitialised allocation
> > memory. Reaching it needs CAP_NET_ADMIN, which is self-satisfiable on a
> > stock kernel through unprivileged user and network namespaces.
>
> Drop this entire unnecessary paragraph (slop).
Hi Baul
Please be careful with this. AI slop will quickly damage your
reputation with Reviewers and Maintainers. If you have a poor
reputation, your patches are likely to be slower to get reviewed, get
more examination and more minor problems pointed out. AI is a useful
tool, but it is just a tool. You personally are responsible for
everything in the patch, so it is up to you to decided if what the AI
has generated is correct/useful.
> > Fixes: f7458934b079 ("net: bridge: mrp: Update the Test frames for MRA")
> > Reported-by: Federico Kirschbaum <[email protected]>
> > Reported-by: Baul Lee <[email protected]>
>
> You don't need a reported-by tag since you've already signed off
> the patch.
Please handle this for all the other patches you have posted to
netdev.
It is a good idea to only post one patch, get review comments for all
the errors you make, and learn from them. Only once you are confident
you are likely to get everything correct can you start posting
multiple patches in parallel. Posting lots of patches with the same
error will also quickly damage your reputation.
Andrew
