lkml.org 
[lkml]   [2022]   [Mar]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 5.10 28/38] netfilter: nf_tables: initialize registers in nft_do_chain()
On Fri 2022-03-25 16:05:12, Greg Kroah-Hartman wrote:
> From: Pablo Neira Ayuso <pablo@netfilter.org>
>
> commit 4c905f6740a365464e91467aa50916555b28213d upstream.
>
> Initialize registers to avoid stack leak into userspace.

For that, memset() is better, due to padding. There is no padding in
the struct AFAICT, still memset would be better for robustness.

> --- a/net/netfilter/nf_tables_core.c
> +++ b/net/netfilter/nf_tables_core.c
> @@ -162,7 +162,7 @@ nft_do_chain(struct nft_pktinfo *pkt, vo
> struct nft_rule *const *rules;
> const struct nft_rule *rule;
> const struct nft_expr *expr, *last;
> - struct nft_regs regs;
> + struct nft_regs regs = {};
> unsigned int stackptr = 0;
> struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE];
> bool genbit = READ_ONCE(net->nft.gencursor);
>

Best regards,
Pavel
--
People of Russia, stop Putin before his war on Ukraine escalates.
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2022-03-26 21:11    [W:0.867 / U:0.400 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site