Commit 8238b218 authored by David S. Miller's avatar David S. Miller
Browse files

[NET]: Do not memcmp() over pad bytes of struct flowi. 



They are not necessarily initialized to zero by the compiler,
for example when using run-time initializers of automatic
on-stack variables.

Noticed by Eric Dumazet and Patrick McHardy.

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 42b6785e

net/decnet/dn_route.c

+8 −3
Original line number Diff line number Diff line
@@ -267,9 +267,14 @@ static void dn_dst_link_failure(struct sk_buff *skb) 


static inline int compare_keys(struct flowi *fl1, struct flowi *fl2)

{

	return memcmp(&fl1->nl_u.dn_u, &fl2->nl_u.dn_u, sizeof(fl1->nl_u.dn_u)) == 0 &&

		fl1->oif == fl2->oif &&

		fl1->iif == fl2->iif;

	return ((fl1->nl_u.dn_u.daddr ^ fl2->nl_u.dn_u.daddr) |

		(fl1->nl_u.dn_u.saddr ^ fl2->nl_u.dn_u.saddr) |

#ifdef CONFIG_IP_ROUTE_FWMARK

		(fl1->nl_u.dn_u.fwmark ^ fl2->nl_u.dn_u.fwmark) |

#endif

		(fl1->nl_u.dn_u.scope ^ fl2->nl_u.dn_u.scope) |

		(fl1->oif ^ fl2->oif) |

		(fl1->iif ^ fl2->iif)) == 0;

}



static int dn_insert_route(struct dn_route *rt, unsigned hash, struct dn_route **rp)

net/ipv4/route.c

+9 −3
Original line number Diff line number Diff line
@@ -566,9 +566,15 @@ static inline u32 rt_score(struct rtable *rt) 


static inline int compare_keys(struct flowi *fl1, struct flowi *fl2)

{

	return memcmp(&fl1->nl_u.ip4_u, &fl2->nl_u.ip4_u, sizeof(fl1->nl_u.ip4_u)) == 0 &&

	       fl1->oif     == fl2->oif &&

	       fl1->iif     == fl2->iif;

	return ((fl1->nl_u.ip4_u.daddr ^ fl2->nl_u.ip4_u.daddr) |

		(fl1->nl_u.ip4_u.saddr ^ fl2->nl_u.ip4_u.saddr) |

#ifdef CONFIG_IP_ROUTE_FWMARK

		(fl1->nl_u.ip4_u.fwmark ^ fl2->nl_u.ip4_u.fwmark) |

#endif

		(*(u16 *)&fl1->nl_u.ip4_u.tos ^

		 *(u16 *)&fl2->nl_u.ip4_u.tos) |

		(fl1->oif ^ fl2->oif) |

		(fl1->iif ^ fl2->iif)) == 0;

}



#ifdef CONFIG_IP_ROUTE_MULTIPATH_CACHED