netlink: Zero-initialize mbuf messages

[markj]

Summary

Some users of nlmsg_reserve_object() and nlmsg_reserve_data() are not
careful to fully initialize pad and reserved fields, allowing
uninitialized bytes to leak to userspace. For example, dump_nhgrp()
doesn't set nhm->resvd = 0.

Meanwhile, nlmsg_get_ns_buf() and nlmsg_get_ns_lbuf() zero-initialize
the buffer, so nlmsg_get_ns_mbuf() is inconsistent. Let's just make
them all behave the same here.

Reported by: KMSAN

Test Plan

netlink regression tests

[melifaro]

Thank you for working on that! It was on my list for quite some time. I was concerned a bit about performance & was thinking of measuring the different approaches. Anyway, let's make it safe first and work on improvements later.
Thank you again for addressing the security issue.

[markj]

In D38098#865466, @melifaro wrote:

Thank you for working on that! It was on my list for quite some time. I was concerned a bit about performance & was thinking of measuring the different approaches. Anyway, let's make it safe first and work on improvements later.

One other approach might be to instead make nlmsg_reserve_object() and nlmsg_reserve_data() zero the buffer area. I suspect the overhead of zeroing is pretty close to negligible in either case though?

[melifaro]

In D38098#865469, @markj wrote:

In D38098#865466, @melifaro wrote:

Thank you for working on that! It was on my list for quite some time. I was concerned a bit about performance & was thinking of measuring the different approaches. Anyway, let's make it safe first and work on improvements later.

One other approach might be to instead make nlmsg_reserve_object() and nlmsg_reserve_data() zero the buffer area. I suspect the overhead of zeroing is pretty close to negligible in either case though?

Yep. Re overhead - it depends. Full-view dump is hundreds of megabytes, mainly consisting of the attributes (which don't require zeroing). Anyway, it shouldn't be a _huge_ difference and can be addressed later.