Re: [PATCH 1/1 net-next] net: bridge: netfilter: use vzalloc() instead of vmalloc() for counterstmp

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sun, Nov 08, 2015 at 08:52:50PM +0000, Loganaden Velvindron wrote:
> On Sun, Nov 8, 2015 at 8:41 PM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Fri, Oct 30, 2015 at 05:33:03AM -0700, Loganaden Velvindron wrote:
> >> counterstmp is not cleared before it is used in get_counters(). it might be
> >> leaked partially when it is sent to userland later on.
> >
> > get_counters() is memcpy'ing the old counter to the counterstmp area
> > and updating it.
> >
> > Where is there leak?
> >
> 
> In this case, none, due to correct memcpy parameters in get_counters().
> 
> However, as this is exposed later on to userland through:
> 
>         if (copy_to_user(user, counterstmp,
>            nentries * sizeof(struct ebt_counter)))
> 
> zero'ing counterstmp malloc'ed memory, looks like a good idea.

We allocate room for nentries, then we get_counters() those nentries
that memcpy that area, and we copy back to user nentries.

Where is the problem?