| Message ID | 20210404175031.3834734-1-i.maximets@ovn.org |
|---|---|
| State | New |
| Headers | show |
| Series | [net] openvswitch: fix send of uninitialized stack memory in ct limit reply | expand |
CC: ovs-dev On 4/4/21 7:50 PM, Ilya Maximets wrote: > 'struct ovs_zone_limit' has more members than initialized in > ovs_ct_limit_get_default_limit(). The rest of the memory is a random > kernel stack content that ends up being sent to userspace. > > Fix that by using designated initializer that will clear all > non-specified fields. > > Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") > Signed-off-by: Ilya Maximets <i.maximets@ovn.org> > --- > net/openvswitch/conntrack.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c > index c29b0ef1fc27..cadb6a29b285 100644 > --- a/net/openvswitch/conntrack.c > +++ b/net/openvswitch/conntrack.c > @@ -2032,10 +2032,10 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, > static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info, > struct sk_buff *reply) > { > - struct ovs_zone_limit zone_limit; > - > - zone_limit.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE; > - zone_limit.limit = info->default_limit; > + struct ovs_zone_limit zone_limit = { > + .zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE, > + .limit = info->default_limit, > + }; > > return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); > } >
On Mon, Apr 5, 2021 at 2:01 AM Ilya Maximets <i.maximets@ovn.org> wrote: > > CC: ovs-dev > > On 4/4/21 7:50 PM, Ilya Maximets wrote: > > 'struct ovs_zone_limit' has more members than initialized in > > ovs_ct_limit_get_default_limit(). The rest of the memory is a random > > kernel stack content that ends up being sent to userspace. > > > > Fix that by using designated initializer that will clear all > > non-specified fields. > > > > Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") > > Signed-off-by: Ilya Maximets <i.maximets@ovn.org> > > --- > > net/openvswitch/conntrack.c | 8 ++++---- > > 1 file changed, 4 insertions(+), 4 deletions(-) > > > > diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c > > index c29b0ef1fc27..cadb6a29b285 100644 > > --- a/net/openvswitch/conntrack.c > > +++ b/net/openvswitch/conntrack.c > > @@ -2032,10 +2032,10 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, > > static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info, > > struct sk_buff *reply) > > { > > - struct ovs_zone_limit zone_limit; > > - > > - zone_limit.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE; > > - zone_limit.limit = info->default_limit; > > + struct ovs_zone_limit zone_limit = { > > + .zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE, > > + .limit = info->default_limit, > > + }; I review the code, userspace don't use the count of ovs_zone_lime struct, but this patch looks to to me. Thanks Ilya. Acked-by: Tonghao Zhang <xiangxia.m.yue@gmail.com> > > return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); > > } > > > > _______________________________________________ > dev mailing list > dev@openvswitch.org > https://mail.openvswitch.org/mailman/listinfo/ovs-dev -- Best regards, Tonghao
Hello: This patch was applied to netdev/net.git (refs/heads/master): On Sun, 4 Apr 2021 19:50:31 +0200 you wrote: > 'struct ovs_zone_limit' has more members than initialized in > ovs_ct_limit_get_default_limit(). The rest of the memory is a random > kernel stack content that ends up being sent to userspace. > > Fix that by using designated initializer that will clear all > non-specified fields. > > [...] Here is the summary with links: - [net] openvswitch: fix send of uninitialized stack memory in ct limit reply https://git.kernel.org/netdev/net/c/4d51419d4993 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index c29b0ef1fc27..cadb6a29b285 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -2032,10 +2032,10 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info, struct sk_buff *reply) { - struct ovs_zone_limit zone_limit; - - zone_limit.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE; - zone_limit.limit = info->default_limit; + struct ovs_zone_limit zone_limit = { + .zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE, + .limit = info->default_limit, + }; return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); }
'struct ovs_zone_limit' has more members than initialized in ovs_ct_limit_get_default_limit(). The rest of the memory is a random kernel stack content that ends up being sent to userspace. Fix that by using designated initializer that will clear all non-specified fields. Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") Signed-off-by: Ilya Maximets <i.maximets@ovn.org> --- net/openvswitch/conntrack.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)