mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-10 02:29:01 +00:00
Code Issues Releases Wiki Activity
linux-stable/net/rds
History
Eric Dumazet 30ffa967ad rds: do not leak kernel memory to user land 
[ Upstream commit eb80ca476e ]

syzbot/KMSAN reported an uninit-value in put_cmsg(), originating
from rds_cmsg_recv().

Simply clear the structure, since we have holes there, or since
rx_traces might be smaller than RDS_MSG_RX_DGRAM_TRACE_MAX.

BUG: KMSAN: uninit-value in copy_to_user include/linux/uaccess.h:184 [inline]
BUG: KMSAN: uninit-value in put_cmsg+0x600/0x870 net/core/scm.c:242
CPU: 0 PID: 4459 Comm: syz-executor582 Not tainted 4.16.0+ #87
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:53
 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
 kmsan_internal_check_memory+0x135/0x1e0 mm/kmsan/kmsan.c:1157
 kmsan_copy_to_user+0x69/0x160 mm/kmsan/kmsan.c:1199
 copy_to_user include/linux/uaccess.h:184 [inline]
 put_cmsg+0x600/0x870 net/core/scm.c:242
 rds_cmsg_recv net/rds/recv.c:570 [inline]
 rds_recvmsg+0x2db5/0x3170 net/rds/recv.c:657
 sock_recvmsg_nosec net/socket.c:803 [inline]
 sock_recvmsg+0x1d0/0x230 net/socket.c:810
 ___sys_recvmsg+0x3fb/0x810 net/socket.c:2205
 __sys_recvmsg net/socket.c:2250 [inline]
 SYSC_recvmsg+0x298/0x3c0 net/socket.c:2262
 SyS_recvmsg+0x54/0x80 net/socket.c:2257
 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x3d/0xa2

Fixes: 3289025aed ("RDS: add receive message trace used by application")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Cc: linux-rdma <linux-rdma@vger.kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-19 10:20:25 +02:00
..
af_rds.c RDS: validate the requested traces user input against max supported 2017-01-06 22:14:26 -05:00
bind.c rds; Reset rs->rs_bound_addr in rds_add_bound() failure path 2018-04-12 12:32:12 +02:00
cong.c RDS: split out connection specific state from rds_connection to rds_conn_path 2016-06-14 23:50:41 -07:00
connection.c rds: tcp: correctly sequence cleanup on netns deletion. 2018-02-25 11:07:50 +01:00
ib.c RDS: IB: Fix null pointer issue 2018-04-26 11:02:17 +02:00
ib.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ib_cm.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-03-15 11:59:10 -07:00
ib_fmr.c rds: ib: unmap the scatter/gather list when error 2017-03-13 23:20:05 -07:00
ib_frmr.c RDS: IB: split the mr registration and invalidation path 2017-01-02 14:02:47 -08:00
ib_mr.h rds: ib: add the static type to the function 2017-03-13 23:20:05 -07:00
ib_rdma.c net, rds: convert rds_ib_device.refcount from atomic_t to refcount_t 2017-07-04 22:35:17 +01:00
ib_recv.c rds: ib: Fix NULL pointer dereference in debug code 2017-11-10 14:54:47 +09:00
ib_ring.c
ib_send.c rds: Fix inaccurate accounting of unsignaled wrs 2017-10-26 17:35:57 +09:00
ib_stats.c RDS: IB: add few useful cache stasts 2017-01-02 14:02:51 -08:00
ib_sysctl.c
info.c
info.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig RDS: Drop stale iWARP RDMA transport 2016-03-02 14:13:17 -05:00
loop.c RDS: TCP: Hooks to set up a single connection path 2016-07-01 16:45:17 -04:00
loop.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
message.c net, rds: convert rds_message.m_refcount from atomic_t to refcount_t 2017-07-04 22:35:18 +01:00
page.c rds: remove dead code 2016-12-26 21:35:39 -05:00
rdma.c RDS: null pointer dereference in rds_atomic_free_op 2018-01-17 09:45:21 +01:00
rdma_transport.c RDS: RDMA: start rdma listening after init 2017-01-02 14:02:45 -08:00
rdma_transport.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rds.h rds: tcp: correctly sequence cleanup on netns deletion. 2018-02-25 11:07:50 +01:00
rds_single_path.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
recv.c rds: do not leak kernel memory to user land 2018-05-19 10:20:25 +02:00
send.c rds: MP-RDS may use an invalid c_path 2018-04-19 08:56:15 +02:00
stats.c
sysctl.c net: rds: fix coding style issues 2016-06-18 21:34:09 -07:00
tcp.c rds: tcp: atomically purge entries from rds_tcp_conn_list during netns delete 2018-02-25 11:07:51 +01:00
tcp.h rds: tcp: atomically purge entries from rds_tcp_conn_list during netns delete 2018-02-25 11:07:51 +01:00
tcp_connect.c rds: cancel send/recv work before queuing connection shutdown 2017-07-16 19:07:35 -07:00
tcp_listen.c rds: tcp: use sock_create_lite() to create the accept socket 2017-07-08 11:16:16 +01:00
tcp_recv.c RDS: add receive message trace used by application 2017-01-02 14:02:59 -08:00
tcp_send.c rds: cancel send/recv work before queuing connection shutdown 2017-07-16 19:07:35 -07:00
tcp_stats.c
threads.c rds: cancel send/recv work before queuing connection shutdown 2017-07-16 19:07:35 -07:00
transport.c rds: remove unnecessary returned value check 2017-03-03 09:51:22 -08:00