net sched: fix some kernel memory leaks

We leak at least 32bits of kernel memory to user land in tc dump,
because we dont init all fields (capab ?) of the dumped structure.

Use C99 initializers so that holes and non explicit fields are zeroed.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index 8406c66549909c763a6b2ae3d7594ea5aeceb361..c2ed90a4c0b428a984c7329e1af0f8d3957a0ae4 100644 (file)
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -152,21 +152,24 @@ static int tcf_gact(struct sk_buff *skb, struct tc_action *a, struct tcf_result
 static int tcf_gact_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
        unsigned char *b = skb_tail_pointer(skb);
-       struct tc_gact opt;
        struct tcf_gact *gact = a->priv;
+       struct tc_gact opt = {
+               .index   = gact->tcf_index,
+               .refcnt  = gact->tcf_refcnt - ref,
+               .bindcnt = gact->tcf_bindcnt - bind,
+               .action  = gact->tcf_action,
+       };
        struct tcf_t t;
 
-       opt.index = gact->tcf_index;
-       opt.refcnt = gact->tcf_refcnt - ref;
-       opt.bindcnt = gact->tcf_bindcnt - bind;
-       opt.action = gact->tcf_action;
        NLA_PUT(skb, TCA_GACT_PARMS, sizeof(opt), &opt);
 #ifdef CONFIG_GACT_PROB
        if (gact->tcfg_ptype) {
-               struct tc_gact_p p_opt;
-               p_opt.paction = gact->tcfg_paction;
-               p_opt.pval = gact->tcfg_pval;
-               p_opt.ptype = gact->tcfg_ptype;
+               struct tc_gact_p p_opt = {
+                       .paction = gact->tcfg_paction,
+                       .pval    = gact->tcfg_pval,
+                       .ptype   = gact->tcfg_ptype,
+               };
+
                NLA_PUT(skb, TCA_GACT_PROB, sizeof(p_opt), &p_opt);
        }
 #endif

diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 11f195af2da0732aaf362380928e298f7f35a199..0c311be9282798ea6b27d1109f482bfdb20c7dac 100644 (file)
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -219,15 +219,16 @@ static int tcf_mirred_dump(struct sk_buff *skb, struct tc_action *a, int bind, i
 {
        unsigned char *b = skb_tail_pointer(skb);
        struct tcf_mirred *m = a->priv;
-       struct tc_mirred opt;
+       struct tc_mirred opt = {
+               .index   = m->tcf_index,
+               .action  = m->tcf_action,
+               .refcnt  = m->tcf_refcnt - ref,
+               .bindcnt = m->tcf_bindcnt - bind,
+               .eaction = m->tcfm_eaction,
+               .ifindex = m->tcfm_ifindex,
+       };
        struct tcf_t t;
 
-       opt.index = m->tcf_index;
-       opt.action = m->tcf_action;
-       opt.refcnt = m->tcf_refcnt - ref;
-       opt.bindcnt = m->tcf_bindcnt - bind;
-       opt.eaction = m->tcfm_eaction;
-       opt.ifindex = m->tcfm_ifindex;
        NLA_PUT(skb, TCA_MIRRED_PARMS, sizeof(opt), &opt);
        t.install = jiffies_to_clock_t(jiffies - m->tcf_tm.install);
        t.lastuse = jiffies_to_clock_t(jiffies - m->tcf_tm.lastuse);

diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 509a2d53a99d483980d33ab4b71460d209cac0dc..186eb837e600da750dd3347f96f033478d131b76 100644 (file)
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -272,19 +272,19 @@ static int tcf_nat_dump(struct sk_buff *skb, struct tc_action *a,
 {
        unsigned char *b = skb_tail_pointer(skb);
        struct tcf_nat *p = a->priv;
-       struct tc_nat opt;
+       struct tc_nat opt = {
+               .old_addr = p->old_addr,
+               .new_addr = p->new_addr,
+               .mask     = p->mask,
+               .flags    = p->flags,
+
+               .index    = p->tcf_index,
+               .action   = p->tcf_action,
+               .refcnt   = p->tcf_refcnt - ref,
+               .bindcnt  = p->tcf_bindcnt - bind,
+       };
        struct tcf_t t;
 
-       opt.old_addr = p->old_addr;
-       opt.new_addr = p->new_addr;
-       opt.mask = p->mask;
-       opt.flags = p->flags;
-
-       opt.index = p->tcf_index;
-       opt.action = p->tcf_action;
-       opt.refcnt = p->tcf_refcnt - ref;
-       opt.bindcnt = p->tcf_bindcnt - bind;
-
        NLA_PUT(skb, TCA_NAT_PARMS, sizeof(opt), &opt);
        t.install = jiffies_to_clock_t(jiffies - p->tcf_tm.install);
        t.lastuse = jiffies_to_clock_t(jiffies - p->tcf_tm.lastuse);

diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 4a1d640b0cf16d842a26e3de807df2d937752cc8..97e84f3ee77563fb14aa7b8e0faf2db476a81501 100644 (file)
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -164,13 +164,14 @@ static inline int tcf_simp_dump(struct sk_buff *skb, struct tc_action *a,
 {
        unsigned char *b = skb_tail_pointer(skb);
        struct tcf_defact *d = a->priv;
-       struct tc_defact opt;
+       struct tc_defact opt = {
+               .index   = d->tcf_index,
+               .refcnt  = d->tcf_refcnt - ref,
+               .bindcnt = d->tcf_bindcnt - bind,
+               .action  = d->tcf_action,
+       };
        struct tcf_t t;
 
-       opt.index = d->tcf_index;
-       opt.refcnt = d->tcf_refcnt - ref;
-       opt.bindcnt = d->tcf_bindcnt - bind;
-       opt.action = d->tcf_action;
        NLA_PUT(skb, TCA_DEF_PARMS, sizeof(opt), &opt);
        NLA_PUT_STRING(skb, TCA_DEF_DATA, d->tcfd_defdata);
        t.install = jiffies_to_clock_t(jiffies - d->tcf_tm.install);

diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index e9607fe55b58006af76880c8e5364a16c3cebdbd..66cbf4eb8855452477ec0f459d69cd6db2559ce7 100644 (file)
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -159,13 +159,14 @@ static inline int tcf_skbedit_dump(struct sk_buff *skb, struct tc_action *a,
 {
        unsigned char *b = skb_tail_pointer(skb);
        struct tcf_skbedit *d = a->priv;
-       struct tc_skbedit opt;
+       struct tc_skbedit opt = {
+               .index   = d->tcf_index,
+               .refcnt  = d->tcf_refcnt - ref,
+               .bindcnt = d->tcf_bindcnt - bind,
+               .action  = d->tcf_action,
+       };
        struct tcf_t t;
 
-       opt.index = d->tcf_index;
-       opt.refcnt = d->tcf_refcnt - ref;
-       opt.bindcnt = d->tcf_bindcnt - bind;
-       opt.action = d->tcf_action;
        NLA_PUT(skb, TCA_SKBEDIT_PARMS, sizeof(opt), &opt);
        if (d->flags & SKBEDIT_F_PRIORITY)
                NLA_PUT(skb, TCA_SKBEDIT_PRIORITY, sizeof(d->priority),