diff mbox series

[Openvpn-devel,v2] sitnl: clear inet_address_t locals with CLEAR()

Message ID 20261110112059.30832-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v2] sitnl: clear inet_address_t locals with CLEAR() |

Commit Message

Gert Doering Nov. 10, 2026, 11:20 a.m. UTC 
  From: Razvan Cojocaru <razvanc@mailbox.org>

The inet_address_t locals were initialized with "= { 0 }", which only
initializes the first union member, the 4 byte ipv4. GCC 15 and later
no longer clear the rest of the union for this, so the IPv6 addresses
of these locals keep up to 12 bytes of stack garbage when the caller
passes no address.

net_route_v6_del() then sends a garbage RTA_GATEWAY for routes without
a gateway, and the kernel refuses to delete them. net_route_v6_best_gw()
looks up a garbage destination when asked for the default route.

Clear the whole union with CLEAR() instead. The other inet_address_t
locals are cleared the same way, so none relies on the partial
initialization.

Latent since c6542257 ("introduce sitnl: Simplified Interface To
NetLink").

Change-Id: I5c52cc5c3aaad21d1c22f36f6451235302ea6c4f
Signed-off-by: Razvan Cojocaru <razvanc@mailbox.org>
Acked-by: Antonio Quartulli <antonio@mandelbit.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2163
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2163
This mail reflects revision 2 of this Change.

Acked-by according to Gerrit (reflected above):
Antonio Quartulli <antonio@mandelbit.com>
diff mbox series

Patch

diff --git a/src/openvpn/networking_sitnl.c b/src/openvpn/networking_sitnl.c
index 97ff7bd..eafb9f7 100644
--- a/src/openvpn/networking_sitnl.c
+++ b/src/openvpn/networking_sitnl.c
@@ -612,10 +612,12 @@ 
 net_route_v6_best_gw(openvpn_net_ctx_t *ctx, const struct in6_addr *dst, struct in6_addr *best_gw,
                      char *best_iface)
 {
-    inet_address_t dst_v6 = { 0 };
+    inet_address_t dst_v6;
     char buf[INET6_ADDRSTRLEN];
     int ret;
 
+    CLEAR(dst_v6);
+
     if (dst)
     {
         dst_v6.ipv6 = *dst;
@@ -640,10 +642,12 @@ 
 net_route_v4_best_gw(openvpn_net_ctx_t *ctx, const in_addr_t *dst, in_addr_t *best_gw,
                      char *best_iface)
 {
-    inet_address_t dst_v4 = { 0 };
+    inet_address_t dst_v4;
     char buf[INET_ADDRSTRLEN];
     int ret;
 
+    CLEAR(dst_v4);
+
     if (dst)
     {
         dst_v4.ipv4 = htonl(*dst);
@@ -1040,9 +1044,11 @@ 
 int
 net_addr_v4_add(const openvpn_net_ctx_t *ctx, const char *iface, const in_addr_t *addr, int prefixlen)
 {
-    inet_address_t addr_v4 = { 0 };
+    inet_address_t addr_v4;
     char buf[INET_ADDRSTRLEN];
 
+    CLEAR(addr_v4);
+
     if (!addr)
     {
         return -EINVAL;
@@ -1060,9 +1066,11 @@ 
 net_addr_v6_add(const openvpn_net_ctx_t *ctx, const char *iface, const struct in6_addr *addr,
                 int prefixlen)
 {
-    inet_address_t addr_v6 = { 0 };
+    inet_address_t addr_v6;
     char buf[INET6_ADDRSTRLEN];
 
+    CLEAR(addr_v6);
+
     if (!addr)
     {
         return -EINVAL;
@@ -1079,9 +1087,11 @@ 
 int
 net_addr_v4_del(const openvpn_net_ctx_t *ctx, const char *iface, const in_addr_t *addr, int prefixlen)
 {
-    inet_address_t addr_v4 = { 0 };
+    inet_address_t addr_v4;
     char buf[INET_ADDRSTRLEN];
 
+    CLEAR(addr_v4);
+
     if (!addr)
     {
         return -EINVAL;
@@ -1099,9 +1109,11 @@ 
 net_addr_v6_del(const openvpn_net_ctx_t *ctx, const char *iface, const struct in6_addr *addr,
                 int prefixlen)
 {
-    inet_address_t addr_v6 = { 0 };
+    inet_address_t addr_v6;
     char buf[INET6_ADDRSTRLEN];
 
+    CLEAR(addr_v6);
+
     if (!addr)
     {
         return -EINVAL;
@@ -1119,11 +1131,14 @@ 
 net_addr_ptp_v4_add(const openvpn_net_ctx_t *ctx, const char *iface, const in_addr_t *local,
                     const in_addr_t *remote)
 {
-    inet_address_t local_v4 = { 0 };
-    inet_address_t remote_v4 = { 0 };
+    inet_address_t local_v4;
+    inet_address_t remote_v4;
     char buf1[INET_ADDRSTRLEN];
     char buf2[INET_ADDRSTRLEN];
 
+    CLEAR(local_v4);
+    CLEAR(remote_v4);
+
     if (!local)
     {
         return -EINVAL;
@@ -1147,9 +1162,10 @@ 
 net_addr_ptp_v4_del(const openvpn_net_ctx_t *ctx, const char *iface, const in_addr_t *local,
                     const in_addr_t *remote)
 {
-    inet_address_t local_v4 = { 0 };
+    inet_address_t local_v4;
     char buf[INET6_ADDRSTRLEN];
 
+    CLEAR(local_v4);
 
     if (!local)
     {
@@ -1227,11 +1243,14 @@ 
 net_route_v6_add(const openvpn_net_ctx_t *ctx, const struct in6_addr *dst, int prefixlen,
                  const struct in6_addr *gw, const char *iface, uint32_t table, int metric)
 {
-    inet_address_t dst_v6 = { 0 };
-    inet_address_t gw_v6 = { 0 };
+    inet_address_t dst_v6;
+    inet_address_t gw_v6;
     char dst_str[INET6_ADDRSTRLEN];
     char gw_str[INET6_ADDRSTRLEN];
 
+    CLEAR(dst_v6);
+    CLEAR(gw_v6);
+
     if (dst)
     {
         dst_v6.ipv6 = *dst;
@@ -1278,11 +1297,14 @@ 
 net_route_v4_del(const openvpn_net_ctx_t *ctx, const in_addr_t *dst, int prefixlen, const in_addr_t *gw,
                  const char *iface, uint32_t table, int metric)
 {
-    inet_address_t dst_v4 = { 0 };
-    inet_address_t gw_v4 = { 0 };
+    inet_address_t dst_v4;
+    inet_address_t gw_v4;
     char dst_str[INET_ADDRSTRLEN];
     char gw_str[INET_ADDRSTRLEN];
 
+    CLEAR(dst_v4);
+    CLEAR(gw_v4);
+
     if (dst)
     {
         dst_v4.ipv4 = htonl(*dst);
@@ -1304,11 +1326,14 @@ 
 net_route_v6_del(const openvpn_net_ctx_t *ctx, const struct in6_addr *dst, int prefixlen,
                  const struct in6_addr *gw, const char *iface, uint32_t table, int metric)
 {
-    inet_address_t dst_v6 = { 0 };
-    inet_address_t gw_v6 = { 0 };
+    inet_address_t dst_v6;
+    inet_address_t gw_v6;
     char dst_str[INET6_ADDRSTRLEN];
     char gw_str[INET6_ADDRSTRLEN];
 
+    CLEAR(dst_v6);
+    CLEAR(gw_v6);
+
     if (dst)
     {
         dst_v6.ipv6 = *dst;