| Message ID | 20210404175031.3834734-1-i.maximets@ovn.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 4d51419d49930be2701c2633ae271b350397c3ca |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] openvswitch: fix send of uninitialized stack memory in ct limit reply | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Clearly marked for net |
| netdev/subject_prefix | success | Link |
| netdev/cc_maintainers | warning | 1 maintainers not CCed: dev@openvswitch.org |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 0 this patch: 0 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 14 lines checked |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 0 this patch: 0 |
| netdev/header_inline | success | Link |
CC: ovs-dev On 4/4/21 7:50 PM, Ilya Maximets wrote: > 'struct ovs_zone_limit' has more members than initialized in > ovs_ct_limit_get_default_limit(). The rest of the memory is a random > kernel stack content that ends up being sent to userspace. > > Fix that by using designated initializer that will clear all > non-specified fields. > > Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") > Signed-off-by: Ilya Maximets <i.maximets@ovn.org> > --- > net/openvswitch/conntrack.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c > index c29b0ef1fc27..cadb6a29b285 100644 > --- a/net/openvswitch/conntrack.c > +++ b/net/openvswitch/conntrack.c > @@ -2032,10 +2032,10 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, > static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info, > struct sk_buff *reply) > { > - struct ovs_zone_limit zone_limit; > - > - zone_limit.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE; > - zone_limit.limit = info->default_limit; > + struct ovs_zone_limit zone_limit = { > + .zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE, > + .limit = info->default_limit, > + }; > > return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); > } >
On Mon, Apr 5, 2021 at 2:01 AM Ilya Maximets <i.maximets@ovn.org> wrote: > > CC: ovs-dev > > On 4/4/21 7:50 PM, Ilya Maximets wrote: > > 'struct ovs_zone_limit' has more members than initialized in > > ovs_ct_limit_get_default_limit(). The rest of the memory is a random > > kernel stack content that ends up being sent to userspace. > > > > Fix that by using designated initializer that will clear all > > non-specified fields. > > > > Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") > > Signed-off-by: Ilya Maximets <i.maximets@ovn.org> > > --- > > net/openvswitch/conntrack.c | 8 ++++---- > > 1 file changed, 4 insertions(+), 4 deletions(-) > > > > diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c > > index c29b0ef1fc27..cadb6a29b285 100644 > > --- a/net/openvswitch/conntrack.c > > +++ b/net/openvswitch/conntrack.c > > @@ -2032,10 +2032,10 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, > > static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info, > > struct sk_buff *reply) > > { > > - struct ovs_zone_limit zone_limit; > > - > > - zone_limit.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE; > > - zone_limit.limit = info->default_limit; > > + struct ovs_zone_limit zone_limit = { > > + .zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE, > > + .limit = info->default_limit, > > + }; I review the code, userspace don't use the count of ovs_zone_lime struct, but this patch looks to to me. Thanks Ilya. Acked-by: Tonghao Zhang <xiangxia.m.yue@gmail.com> > > return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); > > } > > > > _______________________________________________ > dev mailing list > dev@openvswitch.org > https://mail.openvswitch.org/mailman/listinfo/ovs-dev
Hello: This patch was applied to netdev/net.git (refs/heads/master): On Sun, 4 Apr 2021 19:50:31 +0200 you wrote: > 'struct ovs_zone_limit' has more members than initialized in > ovs_ct_limit_get_default_limit(). The rest of the memory is a random > kernel stack content that ends up being sent to userspace. > > Fix that by using designated initializer that will clear all > non-specified fields. > > [...] Here is the summary with links: - [net] openvswitch: fix send of uninitialized stack memory in ct limit reply https://git.kernel.org/netdev/net/c/4d51419d4993 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index c29b0ef1fc27..cadb6a29b285 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -2032,10 +2032,10 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info, struct sk_buff *reply) { - struct ovs_zone_limit zone_limit; - - zone_limit.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE; - zone_limit.limit = info->default_limit; + struct ovs_zone_limit zone_limit = { + .zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE, + .limit = info->default_limit, + }; return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); }
'struct ovs_zone_limit' has more members than initialized in ovs_ct_limit_get_default_limit(). The rest of the memory is a random kernel stack content that ends up being sent to userspace. Fix that by using designated initializer that will clear all non-specified fields. Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") Signed-off-by: Ilya Maximets <i.maximets@ovn.org> --- net/openvswitch/conntrack.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)