git: d91be0f1211b - main - netlink: Zero-initialize mbuf messages

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=d91be0f1211b0196a0087cdfa237a6a0d2a43b65

commit d91be0f1211b0196a0087cdfa237a6a0d2a43b65
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2023-01-17 14:36:54 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2023-01-17 14:36:54 +0000

    netlink: Zero-initialize mbuf messages
    
    Some users of nlmsg_reserve_object() and nlmsg_reserve_data() are not
    careful to fully initialize pad and reserved fields, allowing
    uninitialized bytes to leak to userspace.  For example, dump_nhgrp()
    doesn't set nhm->resvd = 0.
    
    Meanwhile, nlmsg_get_ns_buf() and nlmsg_get_ns_lbuf() zero-initialize
    the buffer, so nlmsg_get_ns_mbuf() is inconsistent.  Let's just make
    them all behave the same here.
    
    Reported by:    KMSAN
    Reviewed by:    melifaro
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D38098
---
 sys/netlink/netlink_message_writer.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sys/netlink/netlink_message_writer.c b/sys/netlink/netlink_message_writer.c
index 37414703c6f6..6573394eb881 100644
--- a/sys/netlink/netlink_message_writer.c
+++ b/sys/netlink/netlink_message_writer.c
@@ -215,6 +215,7 @@ nlmsg_get_ns_mbuf(struct nl_writer *nw, int size, bool waitok)
 	nw->malloc_flag = mflag;
 	nw->num_messages = 0;
 	nw->enomem = false;
+	memset(nw->data, 0, size);
         NL_LOG(LOG_DEBUG2, "alloc mbuf %p req_len %d alloc_len %d data_ptr %p",
             m, size, nw->alloc_len, nw->data);
         return (true);