Re: [PATCH net-next-2.6] net_sched: sch_mqprio: dont leak kernel memory

On Thu, Jan 27, 2011 at 2:04 PM, Joe Perches [off-list ref] wrote:

On Wed, 2011-01-26 at 11:55 -0800, David Miller wrote:

quoted

From: Joe Perches <joe@perches.com>
Date: Wed, 26 Jan 2011 09:43:43 -0800

quoted

On Wed, 2011-01-26 at 18:21 +0100, Eric Dumazet wrote:

quoted

mqprio_dump() should make sure all fields of struct tc_mqprio_qopt are
initialized.
Signed-off-by: Eric Dumazet <redacted>
CC: John Fastabend <redacted>
---
 net/sched/sch_mqprio.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index fbc6f53..effd4ee 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c

@@ -215,7 +215,7 @@ static int mqprio_dump(struct Qdisc *sch, struct sk_buff *skb)

   struct net_device *dev = qdisc_dev(sch);
   struct mqprio_sched *priv = qdisc_priv(sch);
   unsigned char *b = skb_tail_pointer(skb);
-  struct tc_mqprio_qopt opt;
+  struct tc_mqprio_qopt opt = { 0 };

I think the best style to use memset so that any
possible struct padding is guaranteed to be zeroed.

Such padding does not exist, and we won't add such padding since this is
a user visible data structure and thus whose layout is cast in stone.

/* MQPRIO */
#define TC_QOPT_BITMASK 15
#define TC_QOPT_MAX_QUEUE 16

struct tc_mqprio_qopt {
__u8 num_tc; // 1
__u8 prio_tc_map[TC_QOPT_BITMASK + 1]; // 16
__u8 hw; // 1
__u16 count[TC_QOPT_MAX_QUEUE]; // 32
__u16 offset[TC_QOPT_MAX_QUEUE]; //32
};

I believe this struct needs to be declared __packed.

It could otherwise be 24 bytes not 22.
Or if char array declarations have a different
alignment requirement, could be any size.

The total size is 1 + 16 + 1 + 32 + 32 = 82.

How do you get 24 or 22?

memset is better than {0}.

-- 
Regards,
Changli Gao(xiaosuo@gmail.com)