netdev - skb->mark not cleared for MLDv2 Reports? (skb->mark == 212 / 0xd4)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 17 Jul 2023 13:22:03 +0200
From: Linus Lüssing <linus.luessing@...3.blue>
To: Eric Dumazet <edumazet@...gle.com>
Cc: netdev@...r.kernel.org, netfilter@...r.kernel.org
Subject: skb->mark not cleared for MLDv2 Reports? (skb->mark == 212 / 0xd4)

Hi,

I noticed that MLDv2 Reports don't seem to have a default
skb->mark of 0. Instead it is 212 / 0xd4 for me:

```
$ ip link add dummy0 type dummy
$ ip link set up dummy0 arp on
$ ip6tables -I INPUT -i dummy0 -j LOG --log-ip-options
[ send an MLDv2 Query, for instance via the ipv6toolkit
  https://github.com/T-X/ipv6toolkit/tree/pr-mldq6-mldv2
]
$ dmesg
...
[38336.524879] IN= OUT=dummy0 SRC=fe80:0000:0000:0000:1c01:1cff:fec1:5669 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=76 TC=0 HOPLIMIT=1 FLOWLBL=0 OPT ( ) PROTO=ICMPv6 TYPE=143 CODE=0 MARK=0xd4
...
```

For MLDv1 Reports I don't see this issue, there it's always
0 by default.

I'm wondering if this 212 value comes from the
skb->reserved_tailroom (formerly avail_size) which the skb->mark
is unioned with? Am I reading
a21d45726a ("tcp: avoid order-1 allocations on wifi and tx path")
correctly that the IPv6 stack should have reset skb->mark to 0
before transmission?

Initially observed on a Linux 5.10.184. But I can reproduce
this on a Linux 6.3.7, too.

Regards, Linus