netfilter: nf_conntrack_expect: zero at allocation time

There are occasional LLM hints wrt. leaking uninitialized data to
userspace via ctnetlink.  Just zero at allocation time,
expectations are not frequently used these days.

Intentionally keeps _init as-is because we could theoretically
support re-init, so add the missing exp->dir there.

Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 38630c5e006f0814dc775ea7d92d244f9dc90d66..7ae68d60586a23a62599d6b77ef1458758e29113 100644 (file)
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -306,7 +306,7 @@ struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)
 {
        struct nf_conntrack_expect *new;
 
-       new = kmem_cache_alloc(nf_ct_expect_cachep, GFP_ATOMIC);
+       new = kmem_cache_zalloc(nf_ct_expect_cachep, GFP_ATOMIC);
        if (!new)
                return NULL;
 
@@ -391,6 +391,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
 #if IS_ENABLED(CONFIG_NF_NAT)
        memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
        memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
+       exp->dir = 0;
 #endif
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_init);

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 4217715d42dc24486514125a25f590d6a80066a6..31cbb1b55b9e6c8ed3a582363e68d763f22ec296 100644 (file)
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3549,8 +3549,6 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
        if (cda[CTA_EXPECT_FLAGS]) {
                exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));
                exp->flags &= ~NF_CT_EXPECT_USERSPACE;
-       } else {
-               exp->flags = 0;
        }
        if (cda[CTA_EXPECT_FN]) {
                const char *name = nla_data(cda[CTA_EXPECT_FN]);
@@ -3562,8 +3560,7 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
                        goto err_out;
                }
                exp->expectfn = expfn->expectfn;
-       } else
-               exp->expectfn = NULL;
+       }
 
        exp->class = class;
        exp->master = ct;
@@ -3583,12 +3580,6 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
                                                 exp, nf_ct_l3num(ct));
                if (err < 0)
                        goto err_out;
-#if IS_ENABLED(CONFIG_NF_NAT)
-       } else {
-               memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
-               memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
-               exp->dir = 0;
-#endif
        }
        return exp;
 err_out: