On Fri 2022-03-25 16:05:12, Greg Kroah-Hartman wrote:
> From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
>
> commit 4c905f6740a365464e91467aa50916555b28213d upstream.
>
> Initialize registers to avoid stack leak into userspace.
For that, memset() is better, due to padding. There is no padding in
the struct AFAICT, still memset would be better for robustness.
> --- a/net/netfilter/nf_tables_core.c
> +++ b/net/netfilter/nf_tables_core.c
> @@ -162,7 +162,7 @@ nft_do_chain(struct nft_pktinfo *pkt, vo
> struct nft_rule *const *rules;
> const struct nft_rule *rule;
> const struct nft_expr *expr, *last;
> - struct nft_regs regs;
> + struct nft_regs regs = {};
> unsigned int stackptr = 0;
> struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE];
> bool genbit = READ_ONCE(net->nft.gencursor);
>
Best regards,
Pavel
--
People of Russia, stop Putin before his war on Ukraine escalates.
Attachment:
signature.asc
Description: PGP signature
