ipfilter: Plug ip_htable kernel information leak

[cy]

Summary

ipf_htable_stats_get() constructs an iphtstat_t on the stack and only
initializes select fields before copying the entire structure to
userland. The trailing padding array iphs_pad[16] is never initialized,
so ~128 bytes of uninitialized kernel stack memory can be leaked to user
space on each call. This is a classic information disclosure
vulnerability that can reveal pointers and other sensitive data.

We fix this by zeroing out the data structure prior to use.

Reported by: Ilja Van Sprundel <[e-mail]>
MFC after: 1 day

[markj]

If you haven't tried testing ipf with the GENERIC-KMSAN kernel config, I suggest it: it'll automatically catch bugs of this kind. kmsan.9 has some details.

[cy]

In D53275#1217300, @markj wrote:

If you haven't tried testing ipf with the GENERIC-KMSAN kernel config, I suggest it: it'll automatically catch bugs of this kind. kmsan.9 has some details.

I'm half way through creating patches. The reviews I've submitted have been fixed to build. I'll build a KMSAN kernel for the testbed and try the patches I do have here this afternoon.