Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 16 Jun 2020 10:42:39 +0200
From:   Simon Horman <simon.horman@netronome.com>
To:     Xidong Wang <wangxidong_97@163.com>
Cc:     Pravin B Shelar <pshelar@ovn.org>,
        "David S . Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>, netdev@vger.kernel.org,
        dev@openvswitch.org, linux-kernel@vger.kernel.org
Subject: Re: [ovs-dev] [PATCH 1/1] openvswitch: fix infoleak in conntrack
Message-ID: <20200616084237.GA28981@netronome.com>
References: <1592273581-31338-1-git-send-email-wangxidong_97@163.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <1592273581-31338-1-git-send-email-wangxidong_97@163.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, Jun 15, 2020 at 07:13:01PM -0700, Xidong Wang wrote:
> From: xidongwang <wangxidong_97@163.com>
> 
> The stack object “zone_limit” has 3 members. In function
> ovs_ct_limit_get_default_limit(), the member "count" is
> not initialized and sent out via “nla_put_nohdr”.

Hi Xidong,

thanks for your patch.

It appears that the patch is a fix. So I think that subject should be
targeted at the net tree and thus the subject should include
"[PATCH net]". (The other option being to target the net-next tree
in which case the subject should include "[PATCH net-next]".)

Also, as a fix it would be useful to include a fixes tag that references
the patch that introduced the problem. This is to facilitate backporting
to -stable branches of released kernels. In this case the following seems
appropriate.

Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")

> Signed-off-by: xidongwang <wangxidong_97@163.com>
> ---
>  net/openvswitch/conntrack.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
> index 4340f25..1b7820a 100644
> --- a/net/openvswitch/conntrack.c
> +++ b/net/openvswitch/conntrack.c
> @@ -2020,6 +2020,7 @@ static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info,
>  {
>  	struct ovs_zone_limit zone_limit;
>  	int err;

There should be a blank line here.

> +	memset(&zone_limit, 0, sizeof(zone_limit));

Moreover, initializing the entire structure to zero only to overwrite
most of its fields immediately below seems a bit inefficient.

Perhaps it would be better to just initialise count.

>  	zone_limit.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE;
>  	zone_limit.limit = info->default_limit;
	zone_limit.count = 0;

> -- 
> 2.7.4
> 
> _______________________________________________
> dev mailing list
> dev@openvswitch.org
> https://mail.openvswitch.org/mailman/listinfo/ovs-dev