Re: [PATCH net v2] net: zero-initialize tc skb extension on allocation

On Tue, May 25, 2021 at 6:22 AM Vlad Buslov [off-list ref] wrote:

Function skb_ext_add() doesn't initialize created skb extension with any
value and leaves it up to the user. However, since extension of type
TC_SKB_EXT originally contained only single value tc_skb_ext->chain its
users used to just assign the chain value without setting whole extension
memory to zero first. This assumption changed when TC_SKB_EXT extension was
extended with additional fields but not all users were updated to
initialize the new fields which leads to use of uninitialized memory
afterwards. UBSAN log:

Hm, I thought the memset() in __skb_ext_alloc() does the job, clearly
I was wrong.

[...]

Fix the issue by providing new function tc_skb_ext_alloc() that allocates
tc skb extension and initializes its memory to 0 before returning it to the
caller. Change all existing users to use new API instead of calling
skb_ext_add() directly.

Just a note: struct tc_skb_ext is currently only 8-byte long, so memset()
it should not be a problem for performance.

Fixes: 038ebb1a713d ("net/sched: act_ct: fix miss set mru for ovs after defrag in act_ct")
Fixes: d29334c15d33 ("net/sched: act_api: fix miss set post_ct for ovs after do conntrack in act_ct")
Signed-off-by: Vlad Buslov <redacted>

Acked-by: Cong Wang <redacted>

Thanks.