[Devel] [PATCH RHEL7 COMMIT] netfilter: nft_fib_ipv4: initialize *dest to zero

[Vasily Averin]

The commit is pushed to "branch-rh7-3.10.0-1160.11.1.vz7.172.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1160.11.1.vz7.172.12
------>
commit 2f58ff85d1278516c32f66fc1c562b326499d0bb
Author: Liping Zhang <zlpnobody at gmail.com>
Date:   Fri Feb 5 14:31:51 2021 +0300

    netfilter: nft_fib_ipv4: initialize *dest to zero
    
    Otherwise, if fib lookup fail, *dest will be filled with garbage value,
    so reverse path filtering will not work properly:
     # nft add rule x prerouting fib saddr oif eq 0 drop
    
    Fixes: f6d0cbcf09c5 ("netfilter: nf_tables: add fib expression")
    Signed-off-by: Liping Zhang <zlpnobody at gmail.com>
    Acked-by: Florian Westphal <fw at strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
    
    https://jira.sw.ru/browse/PSBM-125002
    (cherry picked from commit e0ffdbc78d84e1da090f03ab62da3def0e65159e)
    Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
---
 net/ipv4/netfilter/nft_fib_ipv4.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c
index 976a73b..1c82b94a 100644
--- a/net/ipv4/netfilter/nft_fib_ipv4.c
+++ b/net/ipv4/netfilter/nft_fib_ipv4.c
@@ -122,6 +122,8 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
 		fl4.saddr = get_saddr(iph->daddr);
 	}
 
+	*dest = 0;
+
 	if (fib_lookup(nft_net(pkt), &fl4, &res))
 		return;