lkml.org 
[lkml]   [2021]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 57/64] netfilter: conntrack: Use struct_group() to zero struct nf_conn
    Date
    In preparation for FORTIFY_SOURCE performing compile-time and run-time
    field bounds checking for memset(), avoid intentionally writing across
    neighboring fields.

    Replace the empty __nfct_init_offset member with a struct_group() to
    mark the region of struct nf_conn that should be initialized to zero,
    allowing memset() to correctly reason about the size of the write.

    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    include/net/netfilter/nf_conntrack.h | 20 ++++++++++----------
    net/netfilter/nf_conntrack_core.c | 4 +---
    2 files changed, 11 insertions(+), 13 deletions(-)

    diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
    index cc663c68ddc4..51004fce2937 100644
    --- a/include/net/netfilter/nf_conntrack.h
    +++ b/include/net/netfilter/nf_conntrack.h
    @@ -101,24 +101,24 @@ struct nf_conn {
    struct hlist_node nat_bysource;
    #endif
    /* all members below initialized via memset */
    - struct { } __nfct_init_offset;
    -
    - /* If we were expected by an expectation, this will be it */
    - struct nf_conn *master;
    + struct_group(init,
    + /* If we were expected by an expectation, this will be it */
    + struct nf_conn *master;

    #if defined(CONFIG_NF_CONNTRACK_MARK)
    - u_int32_t mark;
    + u_int32_t mark;
    #endif

    #ifdef CONFIG_NF_CONNTRACK_SECMARK
    - u_int32_t secmark;
    + u_int32_t secmark;
    #endif

    - /* Extensions */
    - struct nf_ct_ext *ext;
    + /* Extensions */
    + struct nf_ct_ext *ext;

    - /* Storage reserved for other modules, must be the last member */
    - union nf_conntrack_proto proto;
    + /* Storage reserved for other modules, must be the last member */
    + union nf_conntrack_proto proto;
    + );
    };

    static inline struct nf_conn *
    diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
    index 5c03e5106751..b05eb64ec788 100644
    --- a/net/netfilter/nf_conntrack_core.c
    +++ b/net/netfilter/nf_conntrack_core.c
    @@ -1527,9 +1527,7 @@ __nf_conntrack_alloc(struct net *net,
    ct->status = 0;
    ct->timeout = 0;
    write_pnet(&ct->ct_net, net);
    - memset(&ct->__nfct_init_offset, 0,
    - offsetof(struct nf_conn, proto) -
    - offsetof(struct nf_conn, __nfct_init_offset));
    + memset(&ct->init, 0, sizeof(ct->init));

    nf_ct_zone_add(ct, zone);

    --
    2.30.2
    \
     
     \ /
      Last update: 2021-07-27 23:17    [W:5.614 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site