* [PATCH] netfilter: conntrack: Use memset_startat() to zero struct nf_conn
@ 2021-11-18 20:31 Kees Cook
2021-11-30 21:49 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Kees Cook @ 2021-11-18 20:31 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: Kees Cook, Jozsef Kadlecsik, Florian Westphal, David S. Miller,
Jakub Kicinski, linux-kernel, netfilter-devel, coreteam, netdev,
linux-hardening
In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memset(), avoid intentionally writing across
neighboring fields.
Use memset_startat() to avoid confusing memset() about writing beyond
the target struct member.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
net/netfilter/nf_conntrack_core.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 770a63103c7a..cdfb63509501 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1562,9 +1562,7 @@ __nf_conntrack_alloc(struct net *net,
ct->status = 0;
ct->timeout = 0;
write_pnet(&ct->ct_net, net);
- memset(&ct->__nfct_init_offset, 0,
- offsetof(struct nf_conn, proto) -
- offsetof(struct nf_conn, __nfct_init_offset));
+ memset_after(ct, 0, __nfct_init_offset);
nf_ct_zone_add(ct, zone);
--
2.30.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] netfilter: conntrack: Use memset_startat() to zero struct nf_conn
2021-11-18 20:31 [PATCH] netfilter: conntrack: Use memset_startat() to zero struct nf_conn Kees Cook
@ 2021-11-30 21:49 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2021-11-30 21:49 UTC (permalink / raw)
To: Kees Cook
Cc: Jozsef Kadlecsik, Florian Westphal, David S. Miller,
Jakub Kicinski, linux-kernel, netfilter-devel, coreteam, netdev,
linux-hardening
On Thu, Nov 18, 2021 at 12:31:13PM -0800, Kees Cook wrote:
> In preparation for FORTIFY_SOURCE performing compile-time and run-time
> field bounds checking for memset(), avoid intentionally writing across
> neighboring fields.
>
> Use memset_startat() to avoid confusing memset() about writing beyond
> the target struct member.
Applied to nf-next, thanks
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-11-30 21:50 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-11-18 20:31 [PATCH] netfilter: conntrack: Use memset_startat() to zero struct nf_conn Kees Cook
2021-11-30 21:49 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).