* [PATCH]: libnetfilter_log: Uninitialized values in libnetfilter_log.c
@ 2014-01-31 10:39 Ivan Homoliak
2014-01-31 11:12 ` Pablo Neira Ayuso
2014-02-03 9:54 ` Fwd: " Ivan Homoliak
0 siblings, 2 replies; 4+ messages in thread
From: Ivan Homoliak @ 2014-01-31 10:39 UTC (permalink / raw)
To: netfilter-devel
[-- Attachment #1: Type: text/plain, Size: 2219 bytes --]
Unitialized values in libnetfilter.log.c which were discovered by
valgrind and ulogd.
Signed-off-by: Ivan Homoliak <xhomol11@gmail.com>
---
Valgrinds output:
==13821== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
==13821== at 0x3E93AF6E83: __sendto_nocancel (in /usr/lib64/libc-2.17.so)
==13821== by 0x5433E81: nfnl_send (libnfnetlink.c:391)
==13821== by 0x5435C0E: nfnl_query (libnfnetlink.c:1569)
==13821== by 0x522E4E6: __build_send_cfg_msg (libnetfilter_log.c:143)
==13821== by 0x522E87E: nflog_bind_group (libnetfilter_log.c:413)
==13821== by 0x5029F3B: start (ulogd_inppkt_NFLOG.c:573)
==13821== by 0x403E5D: create_stack_start_instances (ulogd.c:918)
==13821== by 0x4041B4: create_stack (ulogd.c:1010)
==13821== by 0x4078D6: config_parse_file (conffile.c:225)
==13821== by 0x404411: parse_conffile (ulogd.c:1088)
==13821== by 0x405478: main (ulogd.c:1573)
==13821== Address 0x7feffff69 is on thread 1's stack
==13821== Uninitialised value was created by a stack allocation
==13821== at 0x522E45B: __build_send_cfg_msg (libnetfilter_log.c:129)
==13821==
==13821== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
==13821== at 0x3E93AF6E83: __sendto_nocancel (in /usr/lib64/libc-2.17.so)
==13821== by 0x5433E81: nfnl_send (libnfnetlink.c:391)
==13821== by 0x5435C0E: nfnl_query (libnfnetlink.c:1569)
==13821== by 0x522E9A0: nflog_set_mode (libnetfilter_log.c:481)
==13821== by 0x5029FA2: start (ulogd_inppkt_NFLOG.c:581)
==13821== by 0x403E5D: create_stack_start_instances (ulogd.c:918)
==13821== by 0x4041B4: create_stack (ulogd.c:1010)
==13821== by 0x4078D6: config_parse_file (conffile.c:225)
==13821== by 0x404411: parse_conffile (ulogd.c:1088)
==13821== by 0x405478: main (ulogd.c:1573)
==13821== Address 0x7feffff9d is on thread 1's stack
==13821== Uninitialised value was created by a stack allocation
==13821== at 0x50293D0: ??? (in /usr/lib/ulogd/ulogd_inppkt_NFLOG.so)
Version: libnetfilter_log-1.0.1
File: libnetfilter_log.c
GCC: 4.8.2 20131212 (Red Hat 4.8.2-7)
OS: Fedora release 19 (Schrödinger's Cat)
Kernel: 3.12.5-200.fc19.x86_64
[-- Attachment #2: libnetfilter_log.c.patch --]
[-- Type: text/x-patch, Size: 2164 bytes --]
--- ./src/libnetfilter_log.c 2010-11-04 00:19:45.000000000 +0100
+++ ../../libnetfilter_log-1.0.1/src/libnetfilter_log.c 2014-01-03 10:48:34.592783388 +0100
@@ -133,6 +133,8 @@ __build_send_cfg_msg(struct nflog_handle
struct nlmsghdr nmh;
} u;
struct nfulnl_msg_config_cmd cmd;
+
+ memset(&u, 0, sizeof(u)); //ihomoliak
nfnl_fill_hdr(h->nfnlssh, &u.nmh, 0, pf, groupnum,
NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
@@ -469,12 +471,14 @@ int nflog_set_mode(struct nflog_g_handle
struct nlmsghdr nmh;
} u;
struct nfulnl_msg_config_mode params;
-
+ memset(&u, 0, sizeof(u)); //ihomoliak
+
nfnl_fill_hdr(gh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, gh->id,
NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
params.copy_range = htonl(range); /* copy_range is short */
params.copy_mode = mode;
+ params._pad = (u_int8_t) 0;
nfnl_addattr_l(&u.nmh, sizeof(u), NFULA_CFG_MODE, ¶ms,
sizeof(params));
@@ -500,6 +504,8 @@ int nflog_set_timeout(struct nflog_g_han
struct nlmsghdr nmh;
} u;
+ memset(&u, 0, sizeof(u)); //ihomoliak
+
nfnl_fill_hdr(gh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, gh->id,
NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
@@ -525,6 +531,8 @@ int nflog_set_qthresh(struct nflog_g_han
struct nlmsghdr nmh;
} u;
+ memset(&u, 0, sizeof(u)); //ihomoliak
+
nfnl_fill_hdr(gh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, gh->id,
NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
@@ -553,8 +561,10 @@ int nflog_set_nlbufsiz(struct nflog_g_ha
char buf[NFNL_HEADER_LEN+NFA_LENGTH(sizeof(u_int32_t))];
struct nlmsghdr nmh;
} u;
- int status;
+ int status = 0; //ihomoliak
+ memset(&u, 0, sizeof(u)); //ihomoliak
+
nfnl_fill_hdr(gh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, gh->id,
NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
@@ -588,6 +598,8 @@ int nflog_set_flags(struct nflog_g_handl
struct nlmsghdr nmh;
} u;
+ memset(&u, 0, sizeof(u)); //ihomoliak
+
nfnl_fill_hdr(gh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, gh->id,
NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH]: libnetfilter_log: Uninitialized values in libnetfilter_log.c
2014-01-31 10:39 [PATCH]: libnetfilter_log: Uninitialized values in libnetfilter_log.c Ivan Homoliak
@ 2014-01-31 11:12 ` Pablo Neira Ayuso
2014-02-03 9:54 ` Fwd: " Ivan Homoliak
1 sibling, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2014-01-31 11:12 UTC (permalink / raw)
To: Ivan Homoliak; +Cc: netfilter-devel
On Fri, Jan 31, 2014 at 11:39:09AM +0100, Ivan Homoliak wrote:
> Unitialized values in libnetfilter.log.c which were discovered by
> valgrind and ulogd.
>
> Signed-off-by: Ivan Homoliak <xhomol11@gmail.com>
> ---
>
> Valgrinds output:
>
> ==13821== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
> ==13821== at 0x3E93AF6E83: __sendto_nocancel (in /usr/lib64/libc-2.17.so)
> ==13821== by 0x5433E81: nfnl_send (libnfnetlink.c:391)
> ==13821== by 0x5435C0E: nfnl_query (libnfnetlink.c:1569)
> ==13821== by 0x522E4E6: __build_send_cfg_msg (libnetfilter_log.c:143)
> ==13821== by 0x522E87E: nflog_bind_group (libnetfilter_log.c:413)
> ==13821== by 0x5029F3B: start (ulogd_inppkt_NFLOG.c:573)
> ==13821== by 0x403E5D: create_stack_start_instances (ulogd.c:918)
> ==13821== by 0x4041B4: create_stack (ulogd.c:1010)
> ==13821== by 0x4078D6: config_parse_file (conffile.c:225)
> ==13821== by 0x404411: parse_conffile (ulogd.c:1088)
> ==13821== by 0x405478: main (ulogd.c:1573)
> ==13821== Address 0x7feffff69 is on thread 1's stack
> ==13821== Uninitialised value was created by a stack allocation
> ==13821== at 0x522E45B: __build_send_cfg_msg (libnetfilter_log.c:129)
> ==13821==
> ==13821== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
> ==13821== at 0x3E93AF6E83: __sendto_nocancel (in /usr/lib64/libc-2.17.so)
> ==13821== by 0x5433E81: nfnl_send (libnfnetlink.c:391)
> ==13821== by 0x5435C0E: nfnl_query (libnfnetlink.c:1569)
> ==13821== by 0x522E9A0: nflog_set_mode (libnetfilter_log.c:481)
> ==13821== by 0x5029FA2: start (ulogd_inppkt_NFLOG.c:581)
> ==13821== by 0x403E5D: create_stack_start_instances (ulogd.c:918)
> ==13821== by 0x4041B4: create_stack (ulogd.c:1010)
> ==13821== by 0x4078D6: config_parse_file (conffile.c:225)
> ==13821== by 0x404411: parse_conffile (ulogd.c:1088)
> ==13821== by 0x405478: main (ulogd.c:1573)
> ==13821== Address 0x7feffff9d is on thread 1's stack
> ==13821== Uninitialised value was created by a stack allocation
> ==13821== at 0x50293D0: ??? (in /usr/lib/ulogd/ulogd_inppkt_NFLOG.so)
>
>
> Version: libnetfilter_log-1.0.1
> File: libnetfilter_log.c
> GCC: 4.8.2 20131212 (Red Hat 4.8.2-7)
> OS: Fedora release 19 (Schrödinger's Cat)
> Kernel: 3.12.5-200.fc19.x86_64
> --- ./src/libnetfilter_log.c 2010-11-04 00:19:45.000000000 +0100
> +++ ../../libnetfilter_log-1.0.1/src/libnetfilter_log.c 2014-01-03 10:48:34.592783388 +0100
> @@ -133,6 +133,8 @@ __build_send_cfg_msg(struct nflog_handle
> struct nlmsghdr nmh;
> } u;
> struct nfulnl_msg_config_cmd cmd;
> +
> + memset(&u, 0, sizeof(u)); //ihomoliak
Could you remove the comment on the right side?
While at it, please, don't convert tabs to spaces.
Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
* Fwd: [PATCH]: libnetfilter_log: Uninitialized values in libnetfilter_log.c
2014-01-31 10:39 [PATCH]: libnetfilter_log: Uninitialized values in libnetfilter_log.c Ivan Homoliak
2014-01-31 11:12 ` Pablo Neira Ayuso
@ 2014-02-03 9:54 ` Ivan Homoliak
2014-02-03 11:26 ` Pablo Neira Ayuso
1 sibling, 1 reply; 4+ messages in thread
From: Ivan Homoliak @ 2014-02-03 9:54 UTC (permalink / raw)
To: netfilter-devel
[-- Attachment #1: Type: text/plain, Size: 2221 bytes --]
Uninitialized values in libnetfilter.log.c which were discovered by
valgrind and ulogd.
Signed-off-by: Ivan Homoliak <xhomol11@gmail.com>
---
Valgrinds output:
==13821== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
==13821== at 0x3E93AF6E83: __sendto_nocancel (in /usr/lib64/libc-2.17.so)
==13821== by 0x5433E81: nfnl_send (libnfnetlink.c:391)
==13821== by 0x5435C0E: nfnl_query (libnfnetlink.c:1569)
==13821== by 0x522E4E6: __build_send_cfg_msg (libnetfilter_log.c:143)
==13821== by 0x522E87E: nflog_bind_group (libnetfilter_log.c:413)
==13821== by 0x5029F3B: start (ulogd_inppkt_NFLOG.c:573)
==13821== by 0x403E5D: create_stack_start_instances (ulogd.c:918)
==13821== by 0x4041B4: create_stack (ulogd.c:1010)
==13821== by 0x4078D6: config_parse_file (conffile.c:225)
==13821== by 0x404411: parse_conffile (ulogd.c:1088)
==13821== by 0x405478: main (ulogd.c:1573)
==13821== Address 0x7feffff69 is on thread 1's stack
==13821== Uninitialised value was created by a stack allocation
==13821== at 0x522E45B: __build_send_cfg_msg (libnetfilter_log.c:129)
==13821==
==13821== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
==13821== at 0x3E93AF6E83: __sendto_nocancel (in /usr/lib64/libc-2.17.so)
==13821== by 0x5433E81: nfnl_send (libnfnetlink.c:391)
==13821== by 0x5435C0E: nfnl_query (libnfnetlink.c:1569)
==13821== by 0x522E9A0: nflog_set_mode (libnetfilter_log.c:481)
==13821== by 0x5029FA2: start (ulogd_inppkt_NFLOG.c:581)
==13821== by 0x403E5D: create_stack_start_instances (ulogd.c:918)
==13821== by 0x4041B4: create_stack (ulogd.c:1010)
==13821== by 0x4078D6: config_parse_file (conffile.c:225)
==13821== by 0x404411: parse_conffile (ulogd.c:1088)
==13821== by 0x405478: main (ulogd.c:1573)
==13821== Address 0x7feffff9d is on thread 1's stack
==13821== Uninitialised value was created by a stack allocation
==13821== at 0x50293D0: ??? (in /usr/lib/ulogd/ulogd_inppkt_NFLOG.so)
Version: libnetfilter_log-1.0.1
File: libnetfilter_log.c
GCC: 4.8.2 20131212 (Red Hat 4.8.2-7)
OS: Fedora release 19 (Schrödinger's Cat)
Kernel: 3.12.5-200.fc19.x86_64
[-- Attachment #2: libnetfilter_log.patch --]
[-- Type: text/x-patch, Size: 2017 bytes --]
--- a/src/libnetfilter_log.c 2010-11-04 00:19:45.000000000 +0100
+++ b/src/libnetfilter_log.c 2014-01-03 10:48:34.592783388 +0100
@@ -133,6 +133,8 @@ __build_send_cfg_msg(struct nflog_handle
struct nlmsghdr nmh;
} u;
struct nfulnl_msg_config_cmd cmd;
+
+ memset(&u, 0, sizeof(u));
nfnl_fill_hdr(h->nfnlssh, &u.nmh, 0, pf, groupnum,
NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
@@ -469,12 +471,14 @@ int nflog_set_mode(struct nflog_g_handle
struct nlmsghdr nmh;
} u;
struct nfulnl_msg_config_mode params;
-
+ memset(&u, 0, sizeof(u));
+
nfnl_fill_hdr(gh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, gh->id,
NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
params.copy_range = htonl(range); /* copy_range is short */
params.copy_mode = mode;
+ params._pad = (u_int8_t) 0;
nfnl_addattr_l(&u.nmh, sizeof(u), NFULA_CFG_MODE, ¶ms,
sizeof(params));
@@ -500,6 +504,8 @@ int nflog_set_timeout(struct nflog_g_han
struct nlmsghdr nmh;
} u;
+ memset(&u, 0, sizeof(u));
+
nfnl_fill_hdr(gh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, gh->id,
NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
@@ -525,6 +531,8 @@ int nflog_set_qthresh(struct nflog_g_han
struct nlmsghdr nmh;
} u;
+ memset(&u, 0, sizeof(u));
+
nfnl_fill_hdr(gh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, gh->id,
NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
@@ -553,8 +561,10 @@ int nflog_set_nlbufsiz(struct nflog_g_ha
char buf[NFNL_HEADER_LEN+NFA_LENGTH(sizeof(u_int32_t))];
struct nlmsghdr nmh;
} u;
- int status;
+ int status = 0;
+ memset(&u, 0, sizeof(u));
+
nfnl_fill_hdr(gh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, gh->id,
NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
@@ -588,6 +598,8 @@ int nflog_set_flags(struct nflog_g_handl
struct nlmsghdr nmh;
} u;
+ memset(&u, 0, sizeof(u));
+
nfnl_fill_hdr(gh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, gh->id,
NFULNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Fwd: [PATCH]: libnetfilter_log: Uninitialized values in libnetfilter_log.c
2014-02-03 9:54 ` Fwd: " Ivan Homoliak
@ 2014-02-03 11:26 ` Pablo Neira Ayuso
0 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2014-02-03 11:26 UTC (permalink / raw)
To: Ivan Homoliak; +Cc: netfilter-devel
[-- Attachment #1: Type: text/plain, Size: 1548 bytes --]
Hi Ivan,
On Mon, Feb 03, 2014 at 10:54:23AM +0100, Ivan Homoliak wrote:
> Uninitialized values in libnetfilter.log.c which were discovered by
> valgrind and ulogd.
>
> Signed-off-by: Ivan Homoliak <xhomol11@gmail.com>
> ---
>
> Valgrinds output:
>
[...]
> ==13821== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
> ==13821== at 0x3E93AF6E83: __sendto_nocancel (in /usr/lib64/libc-2.17.so)
> ==13821== by 0x5433E81: nfnl_send (libnfnetlink.c:391)
> ==13821== by 0x5435C0E: nfnl_query (libnfnetlink.c:1569)
> ==13821== by 0x522E9A0: nflog_set_mode (libnetfilter_log.c:481)
> ==13821== by 0x5029FA2: start (ulogd_inppkt_NFLOG.c:581)
> ==13821== by 0x403E5D: create_stack_start_instances (ulogd.c:918)
> ==13821== by 0x4041B4: create_stack (ulogd.c:1010)
> ==13821== by 0x4078D6: config_parse_file (conffile.c:225)
> ==13821== by 0x404411: parse_conffile (ulogd.c:1088)
> ==13821== by 0x405478: main (ulogd.c:1573)
> ==13821== Address 0x7feffff9d is on thread 1's stack
> ==13821== Uninitialised value was created by a stack allocation
> ==13821== at 0x50293D0: ??? (in /usr/lib/ulogd/ulogd_inppkt_NFLOG.so)
I found some time to looking into this. I think this patch for
*libnfnetlink* should fix this for all the libraries. Better do this
in a generic way so we skip similar reports in other libnetfilter_*
libraries. Valgrind does not report any warning anymore here.
If you can give a try to this libnfnetlink patch to confirm you see no
more valgrind warnings, I'd appreciate. Thanks.
[-- Attachment #2: 0001-libnfnetlink-initialize-attribute-padding-to-resolve.patch --]
[-- Type: text/x-diff, Size: 1496 bytes --]
>From 7633f0c1679988ad18e4de9afc8a277510298139 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 3 Feb 2014 12:09:29 +0100
Subject: [PATCH] libnfnetlink: initialize attribute padding to resolve
valgrind warnings
==12195== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
==12195== at 0x51209C3: __sendto_nocancel (syscall-template.S:81)
==12195== by 0x53E4D12: nfnl_send (libnfnetlink.c:391)
==12195== by 0x53E6952: nfnl_query (libnfnetlink.c:1569)
==12195== by 0x4E344AF: __build_send_cfg_msg.isra.1 (libnetfilter_log.c:143)
==12195== by 0x4E34710: nflog_bind_group (libnetfilter_log.c:413)
==12195== by 0x400CB1: main (nfulnl_test.c:77)
==12195== Address 0x7fefff3e9 is on thread 1's stack
This patch sets to zero the padding that is included to align the
attribute payload.
Reported-by: Ivan Homoliak <xhomol11@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
src/libnfnetlink.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/libnfnetlink.c b/src/libnfnetlink.c
index 4b2bcd0..398b7d7 100644
--- a/src/libnfnetlink.c
+++ b/src/libnfnetlink.c
@@ -809,6 +809,7 @@ int nfnl_addattr_l(struct nlmsghdr *n, int maxlen, int type, const void *data,
nfa->nfa_type = type;
nfa->nfa_len = len;
memcpy(NFA_DATA(nfa), data, alen);
+ memset((uint8_t *)nfa + nfa->nfa_len, 0, NFA_ALIGN(alen) - alen);
n->nlmsg_len = (NLMSG_ALIGN(n->nlmsg_len) + NFA_ALIGN(len));
return 0;
}
--
1.7.10.4
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-02-03 11:27 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-01-31 10:39 [PATCH]: libnetfilter_log: Uninitialized values in libnetfilter_log.c Ivan Homoliak
2014-01-31 11:12 ` Pablo Neira Ayuso
2014-02-03 9:54 ` Fwd: " Ivan Homoliak
2014-02-03 11:26 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).