net sched: fix some kernel memory leaks

commit 1c40be12f7d8ca1d387510d39787b12e512a7ce8 upstream.

We leak at least 32bits of kernel memory to user land in tc dump,
because we dont init all fields (capab ?) of the dumped structure.

Use C99 initializers so that holes and non explicit fields are zeroed.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: dann frazier <dannf@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index e7f796aec657f90089a4872ab79c831b62bde467..f9fc6ec1fef66e4c9a445da367b7a3f42a826ca7 100644 (file)
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -152,21 +152,24 @@ static int tcf_gact(struct sk_buff *skb, struct tc_action *a, struct tcf_result
 static int tcf_gact_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
        unsigned char *b = skb_tail_pointer(skb);
-       struct tc_gact opt;
        struct tcf_gact *gact = a->priv;
+       struct tc_gact opt = {
+               .index   = gact->tcf_index,
+               .refcnt  = gact->tcf_refcnt - ref,
+               .bindcnt = gact->tcf_bindcnt - bind,
+               .action  = gact->tcf_action,
+       };
        struct tcf_t t;
 
-       opt.index = gact->tcf_index;
-       opt.refcnt = gact->tcf_refcnt - ref;
-       opt.bindcnt = gact->tcf_bindcnt - bind;
-       opt.action = gact->tcf_action;
        NLA_PUT(skb, TCA_GACT_PARMS, sizeof(opt), &opt);
 #ifdef CONFIG_GACT_PROB
        if (gact->tcfg_ptype) {
-               struct tc_gact_p p_opt;
-               p_opt.paction = gact->tcfg_paction;
-               p_opt.pval = gact->tcfg_pval;
-               p_opt.ptype = gact->tcfg_ptype;
+               struct tc_gact_p p_opt = {
+                       .paction = gact->tcfg_paction,
+                       .pval    = gact->tcfg_pval,
+                       .ptype   = gact->tcfg_ptype,
+               };
+
                NLA_PUT(skb, TCA_GACT_PROB, sizeof(p_opt), &p_opt);
        }
 #endif

diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index b9aaab4e03548a848c4f9bba9b527803fa602157..5e49286548383d41609ff92b51e0cc1ed2b396c4 100644 (file)
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -205,15 +205,16 @@ static int tcf_mirred_dump(struct sk_buff *skb, struct tc_action *a, int bind, i
 {
        unsigned char *b = skb_tail_pointer(skb);
        struct tcf_mirred *m = a->priv;
-       struct tc_mirred opt;
+       struct tc_mirred opt = {
+               .index   = m->tcf_index,
+               .action  = m->tcf_action,
+               .refcnt  = m->tcf_refcnt - ref,
+               .bindcnt = m->tcf_bindcnt - bind,
+               .eaction = m->tcfm_eaction,
+               .ifindex = m->tcfm_ifindex,
+       };
        struct tcf_t t;
 
-       opt.index = m->tcf_index;
-       opt.action = m->tcf_action;
-       opt.refcnt = m->tcf_refcnt - ref;
-       opt.bindcnt = m->tcf_bindcnt - bind;
-       opt.eaction = m->tcfm_eaction;
-       opt.ifindex = m->tcfm_ifindex;
        NLA_PUT(skb, TCA_MIRRED_PARMS, sizeof(opt), &opt);
        t.install = jiffies_to_clock_t(jiffies - m->tcf_tm.install);
        t.lastuse = jiffies_to_clock_t(jiffies - m->tcf_tm.lastuse);

diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 3e593a8f7be9547f6926d881695b1ed7eba679ce..047c234bfabf83f2f1713e465f03b61296e6b125 100644 (file)
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -261,19 +261,19 @@ static int tcf_nat_dump(struct sk_buff *skb, struct tc_action *a,
 {
        unsigned char *b = skb_tail_pointer(skb);
        struct tcf_nat *p = a->priv;
-       struct tc_nat opt;
+       struct tc_nat opt = {
+               .old_addr = p->old_addr,
+               .new_addr = p->new_addr,
+               .mask     = p->mask,
+               .flags    = p->flags,
+
+               .index    = p->tcf_index,
+               .action   = p->tcf_action,
+               .refcnt   = p->tcf_refcnt - ref,
+               .bindcnt  = p->tcf_bindcnt - bind,
+       };
        struct tcf_t t;
 
-       opt.old_addr = p->old_addr;
-       opt.new_addr = p->new_addr;
-       opt.mask = p->mask;
-       opt.flags = p->flags;
-
-       opt.index = p->tcf_index;
-       opt.action = p->tcf_action;
-       opt.refcnt = p->tcf_refcnt - ref;
-       opt.bindcnt = p->tcf_bindcnt - bind;
-
        NLA_PUT(skb, TCA_NAT_PARMS, sizeof(opt), &opt);
        t.install = jiffies_to_clock_t(jiffies - p->tcf_tm.install);
        t.lastuse = jiffies_to_clock_t(jiffies - p->tcf_tm.lastuse);

diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 8daa1ebc7413b971dafde75606af039d52a7e83e..41c8a445f1f23f616676466246f1b4a2141c5f37 100644 (file)
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -163,13 +163,14 @@ static inline int tcf_simp_dump(struct sk_buff *skb, struct tc_action *a,
 {
        unsigned char *b = skb_tail_pointer(skb);
        struct tcf_defact *d = a->priv;
-       struct tc_defact opt;
+       struct tc_defact opt = {
+               .index   = d->tcf_index,
+               .refcnt  = d->tcf_refcnt - ref,
+               .bindcnt = d->tcf_bindcnt - bind,
+               .action  = d->tcf_action,
+       };
        struct tcf_t t;
 
-       opt.index = d->tcf_index;
-       opt.refcnt = d->tcf_refcnt - ref;
-       opt.bindcnt = d->tcf_bindcnt - bind;
-       opt.action = d->tcf_action;
        NLA_PUT(skb, TCA_DEF_PARMS, sizeof(opt), &opt);
        NLA_PUT_STRING(skb, TCA_DEF_DATA, d->tcfd_defdata);
        t.install = jiffies_to_clock_t(jiffies - d->tcf_tm.install);

diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 4ab916b8074be28daea9fe9f329b4b3b460132c7..1df16d8155ef3c431ba6aa4cefe15cf0c0f15fb7 100644 (file)
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -147,13 +147,14 @@ static inline int tcf_skbedit_dump(struct sk_buff *skb, struct tc_action *a,
 {
        unsigned char *b = skb_tail_pointer(skb);
        struct tcf_skbedit *d = a->priv;
-       struct tc_skbedit opt;
+       struct tc_skbedit opt = {
+               .index   = d->tcf_index,
+               .refcnt  = d->tcf_refcnt - ref,
+               .bindcnt = d->tcf_bindcnt - bind,
+               .action  = d->tcf_action,
+       };
        struct tcf_t t;
 
-       opt.index = d->tcf_index;
-       opt.refcnt = d->tcf_refcnt - ref;
-       opt.bindcnt = d->tcf_bindcnt - bind;
-       opt.action = d->tcf_action;
        NLA_PUT(skb, TCA_SKBEDIT_PARMS, sizeof(opt), &opt);
        if (d->flags & SKBEDIT_F_PRIORITY)
                NLA_PUT(skb, TCA_SKBEDIT_PRIORITY, sizeof(d->priority),