The babel protocol code was initialising objects returned from the slab
allocator by assigning to each of the struct members individually, but
wasn't touching the NODE member while doing so. This leads to warnings on
debug builds since commit:
baac7009063d ("List expensive check.")
To fix this, introduce an sl_allocz() variant of the slab allocator which
will zero out the memory before returning it, and switch all the babel call
sites to use this version. The overhead for doing this should be negligible
for small objects, and in the case of babel, the largest object being
allocated was being zeroed anyway, so we can drop the memset in
babel_read_tlv().
slab *sl_new(pool *, unsigned size);
void *sl_alloc(slab *);
+void *sl_allocz(slab *);
void sl_free(slab *, void *);
/*
return o->data;
}
+void *
+sl_allocz(slab *s)
+{
+ void *obj = sl_alloc(s);
+ memset(obj, 0, s->size);
+ return obj;
+}
+
void
sl_free(slab *s, void *oo)
{
goto okay;
}
+/**
+ * sl_allocz - allocate an object from Slab and zero it
+ * @s: slab
+ *
+ * sl_allocz() allocates space for a single object from the
+ * Slab and returns a pointer to the object after zeroing out
+ * the object memory.
+ */
+void *
+sl_allocz(slab *s)
+{
+ void *obj = sl_alloc(s);
+ memset(obj, 0, s->data_size);
+ return obj;
+}
+
/**
* sl_free - return a free object back to a Slab
* @s: slab
if (s)
return s;
- s = sl_alloc(p->source_slab);
+ s = sl_allocz(p->source_slab);
s->router_id = router_id;
s->expires = current_time() + BABEL_GARBAGE_INTERVAL;
s->seqno = 0;
if (r)
return r;
- r = sl_alloc(p->route_slab);
- memset(r, 0, sizeof(*r));
+ r = sl_allocz(p->route_slab);
r->e = e;
r->neigh = nbr;
}
/* No entries found */
- sr = sl_alloc(p->seqno_slab);
+ sr = sl_allocz(p->seqno_slab);
found:
sr->router_id = router_id;
return PARSE_ERROR;
state->current_tlv_endpos = tlv_data[hdr->type].min_length;
- memset(msg, 0, sizeof(*msg));
int res = tlv_data[hdr->type].read_tlv(hdr, msg, state);
if (res != PARSE_SUCCESS)
struct babel_msg_node *msgn = sl_alloc(p->msg_slab);
list queue;
- msgn->msg = *msg;
+ *msgn = (struct babel_msg_node) { .msg = *msg };
init_list(&queue);
add_tail(&queue, NODE msgn);
babel_write_queue(ifa, &queue);
{
struct babel_proto *p = ifa->proto;
struct babel_msg_node *msgn = sl_alloc(p->msg_slab);
- msgn->msg = *msg;
+
+ *msgn = (struct babel_msg_node) { .msg = *msg };
add_tail(&ifa->msg_queue, NODE msgn);
babel_kick_queue(ifa);
}
break;
}
- msg = sl_alloc(p->msg_slab);
+ msg = sl_allocz(p->msg_slab);
res = babel_read_tlv(tlv, &msg->msg, &state);
if (res == PARSE_SUCCESS)
{