Peilin Ye 2b9c45b6dc rds: Prevent kernel-infoleak in rds_notify_queue_get()
commit bbc8a99e952226c585ac17477a85ef1194501762 upstream.

rds_notify_queue_get() is potentially copying uninitialized kernel stack
memory to userspace since the compiler may leave a 4-byte hole at the end
of `cmsg`.

In 2016 we tried to fix this issue by doing `= { 0 };` on `cmsg`, which
unfortunately does not always initialize that 4-byte hole. Fix it by using
memset() instead.

Cc: stable@vger.kernel.org
Fixes: f037590fff30 ("rds: fix a leak of kernel memory")
Fixes: bdbe6fbc6a2f ("RDS: recv.c")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-21 11:01:49 +02:00
..
2019-05-08 07:19:07 +02:00
2019-12-05 15:35:12 +01:00
2019-09-16 08:19:32 +02:00
2019-06-22 08:17:22 +02:00
2016-10-20 11:23:08 -04:00
2020-05-20 08:15:39 +02:00
2020-07-22 09:10:48 +02:00
2019-03-23 13:19:44 +01:00
2019-11-28 18:28:28 +01:00
2019-01-09 16:16:41 +01:00