Eric Dumazet eb80ca476e rds: do not leak kernel memory to user land ...

syzbot/KMSAN reported an uninit-value in put_cmsg(), originating
from rds_cmsg_recv().

Simply clear the structure, since we have holes there, or since
rx_traces might be smaller than RDS_MSG_RX_DGRAM_TRACE_MAX.

BUG: KMSAN: uninit-value in copy_to_user include/linux/uaccess.h:184 [inline]
BUG: KMSAN: uninit-value in put_cmsg+0x600/0x870 net/core/scm.c:242
CPU: 0 PID: 4459 Comm: syz-executor582 Not tainted 4.16.0+ #87
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:53
 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
 kmsan_internal_check_memory+0x135/0x1e0 mm/kmsan/kmsan.c:1157
 kmsan_copy_to_user+0x69/0x160 mm/kmsan/kmsan.c:1199
 copy_to_user include/linux/uaccess.h:184 [inline]
 put_cmsg+0x600/0x870 net/core/scm.c:242
 rds_cmsg_recv net/rds/recv.c:570 [inline]
 rds_recvmsg+0x2db5/0x3170 net/rds/recv.c:657
 sock_recvmsg_nosec net/socket.c:803 [inline]
 sock_recvmsg+0x1d0/0x230 net/socket.c:810
 ___sys_recvmsg+0x3fb/0x810 net/socket.c:2205
 __sys_recvmsg net/socket.c:2250 [inline]
 SYSC_recvmsg+0x298/0x3c0 net/socket.c:2262
 SyS_recvmsg+0x54/0x80 net/socket.c:2257
 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x3d/0xa2

Fixes: 3289025aedc0 ("RDS: add receive message trace used by application")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Cc: linux-rdma <linux-rdma@vger.kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

2018-05-03 11:26:14 -04:00

..

af_rds.c

rds: use list structure to track information for zerocopy completion notification

2018-03-07 18:05:57 -05:00

bind.c

rds; Reset rs->rs_bound_addr in rds_add_bound() failure path

2017-12-27 13:37:27 -05:00

cong.c

rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management

2018-02-08 15:23:52 -05:00

connection.c

net: rds: drop VLA in rds_walk_conn_path_info()

2018-03-12 15:07:00 -04:00

ib_cm.c

rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp

2018-04-25 14:34:08 -04:00

ib_fmr.c

net/rds/ib_fmr.c: use kmalloc_array_node()

2017-11-15 18:21:02 -08:00

ib_frmr.c

RDS: IB: split the mr registration and invalidation path

2017-01-02 14:02:47 -08:00

ib_mr.h

rds: ib: add the static type to the function

2017-03-13 23:20:05 -07:00

ib_rdma.c

RDS: IB: Initialize max_items based on underlying device attributes

2017-10-05 21:16:33 -07:00

ib_recv.c

rds: ib: Fix NULL pointer dereference in debug code

2017-11-10 14:54:47 +09:00

ib_ring.c

…

ib_send.c

rds: Fix inaccurate accounting of unsignaled wrs

2017-10-26 17:35:57 +09:00

ib_stats.c

RDS: IB: add few useful cache stasts

2017-01-02 14:02:51 -08:00

ib_sysctl.c

…

ib.c

net: rds: drop VLA in rds_for_each_conn_info()

2018-03-12 15:06:59 -04:00

ib.h

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-11-04 09:26:51 +09:00

info.c

rds: fix an integer overflow test in rds_info_getsockopt()

2015-08-03 15:20:16 -07:00

info.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

Kconfig

RDS: Drop stale iWARP RDMA transport

2016-03-02 14:13:17 -05:00

loop.c

RDS: TCP: Hooks to set up a single connection path

2016-07-01 16:45:17 -04:00

loop.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

message.c

rds: remove redundant variable 'sg_off'

2018-03-12 11:12:38 -04:00

page.c

rds: remove dead code

2016-12-26 21:35:39 -05:00

rdma_transport.c

RDS: RDMA: start rdma listening after init

2017-01-02 14:02:45 -08:00

rdma_transport.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

rdma.c

RDS: null pointer dereference in rds_atomic_free_op

2018-01-04 14:19:26 -05:00

rds_single_path.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

rds.h

net: rds: drop VLA in rds_for_each_conn_info()

2018-03-12 15:06:59 -04:00

recv.c

rds: do not leak kernel memory to user land

2018-05-03 11:26:14 -04:00

send.c

rds: MP-RDS may use an invalid c_path

2018-04-11 10:24:01 -04:00

stats.c

…

sysctl.c

net: rds: fix coding style issues

2016-06-18 21:34:09 -07:00

tcp_connect.c

rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management

2018-02-08 15:23:52 -05:00

tcp_listen.c

rds: Incorrect reference counting in TCP socket creation

2018-03-02 09:40:27 -05:00

tcp_recv.c

rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management

2018-02-08 15:23:52 -05:00

tcp_send.c

rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management

2018-02-08 15:23:52 -05:00

tcp_stats.c

…

tcp.c

net: Drop pernet_operations::async

2018-03-27 13:18:09 -04:00

tcp.h

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-01-23 13:51:56 -05:00

threads.c

rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management

2018-02-08 15:23:52 -05:00

transport.c

rds: remove unnecessary returned value check

2017-03-03 09:51:22 -08:00