[Drbd-dev] netlink transmit padding contains uninitialized bytes

David Butterfield dab21774 at gmail.com
Mon Jul 1 00:58:34 CEST 2019


Valgrind reported uninitialized bytes being sent to a system call when transmitting a netlink
response generated using drbd_msg_sprintf_info() (formatting opener_info()).  (Valgrind catches
this when the emulated kernel transmit function makes a real system call to do the transmit.)

When sending a text reply over netlink, the string is formatted directly into an skb area which
is reserved "big enough", then gets "trimmed" back down after the length of the string is known.
The "trim" is to an "aligned" size, possibly leaving up to three "alignment padding" bytes in
the skb data after the end of the string. 

Those "alignment padding" bytes were never initialized after the skb space was allocated,
leading to a complaint from valgrind when the uninitialized bytes were passed to a system call
for transmission over the netlink.  

The change below initializes any "alignment padding" bytes to zero, and makes the valgrind
complaint go away.  (It could be rewritten to use fewer CPU cycles!)
    
diff --git a/drbd/drbd_nl.c b/drbd/drbd_nl.c
index 7c4f3654..6a66528e 100644
--- a/drbd/drbd_nl.c
+++ b/drbd/drbd_nl.c
@@ -163,6 +163,12 @@ static int drbd_msg_sprintf_info(struct sk_buff *skb, const char *fmt, ...)

        /* maybe: retry with larger reserve, if truncated */
        txt->nla_len = nla_attr_size(len+1);
+   
+       /* avoid transmitting uninitialized bytes */
+       ++len;
+       while (len < NLA_ALIGN(len))
+               *((char *)nla_data(txt) + len++) = '\0';
+
        nlmsg_trim(skb, (char*)txt + NLA_ALIGN(txt->nla_len));
        nla_nest_end(skb, nla);


More information about the drbd-dev mailing list