iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net
History
Eric Dumazet eb80ca476e rds: do not leak kernel memory to user land 
syzbot/KMSAN reported an uninit-value in put_cmsg(), originating
from rds_cmsg_recv().

Simply clear the structure, since we have holes there, or since
rx_traces might be smaller than RDS_MSG_RX_DGRAM_TRACE_MAX.

BUG: KMSAN: uninit-value in copy_to_user include/linux/uaccess.h:184 [inline]
BUG: KMSAN: uninit-value in put_cmsg+0x600/0x870 net/core/scm.c:242
CPU: 0 PID: 4459 Comm: syz-executor582 Not tainted 4.16.0+ #87
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x185/0x1d0 lib/dump_stack.c:53
 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
 kmsan_internal_check_memory+0x135/0x1e0 mm/kmsan/kmsan.c:1157
 kmsan_copy_to_user+0x69/0x160 mm/kmsan/kmsan.c:1199
 copy_to_user include/linux/uaccess.h:184 [inline]
 put_cmsg+0x600/0x870 net/core/scm.c:242
 rds_cmsg_recv net/rds/recv.c:570 [inline]
 rds_recvmsg+0x2db5/0x3170 net/rds/recv.c:657
 sock_recvmsg_nosec net/socket.c:803 [inline]
 sock_recvmsg+0x1d0/0x230 net/socket.c:810
 ___sys_recvmsg+0x3fb/0x810 net/socket.c:2205
 __sys_recvmsg net/socket.c:2250 [inline]
 SYSC_recvmsg+0x298/0x3c0 net/socket.c:2262
 SyS_recvmsg+0x54/0x80 net/socket.c:2257
 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x3d/0xa2

Fixes: 3289025aedc0 ("RDS: add receive message trace used by application")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Cc: linux-rdma <linux-rdma@vger.kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-03 11:26:14 -04:00
..
6lowpan
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
9p
net/9p/client.c: fix potential refcnt problem of trans module
2018-04-05 21:36:23 -07:00
802
treewide: setup_timer() -> timer_setup()
2017-11-21 15:57:07 -08:00
8021q
vlan: also check phy_driver ts_info for vlan's real device
2018-04-01 20:53:50 -04:00
appletalk
net: Use octal not symbolic permissions
2018-03-26 12:07:48 -04:00
atm
net: Use octal not symbolic permissions
2018-03-26 12:07:48 -04:00
ax25
net: Use octal not symbolic permissions
2018-03-26 12:07:48 -04:00
batman-adv
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-04-01 19:49:34 -04:00
bluetooth
Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
2018-04-08 17:19:15 -04:00
bpf
bpf: fix null pointer deref in bpf_prog_test_run_xdp
2018-02-01 07:43:56 -08:00
bridge
bridge: check iface upper dev when setting master via ioctl
2018-04-29 21:08:02 -04:00
caif
net: caif: fix spelling mistake "UKNOWN" -> "UNKNOWN"
2018-04-19 13:37:10 -04:00
can
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00
ceph
The big ticket items are:
2018-04-10 12:25:30 -07:00
core
ethtool: fix a potential missing-check bug
2018-05-01 14:18:47 -04:00
dcb
…
dccp
dccp: initialize ireq->ir_mark
2018-04-07 22:32:31 -04:00
decnet
net: Use octal not symbolic permissions
2018-03-26 12:07:48 -04:00
dns_resolver
KEYS: DNS: limit the length of option strings
2018-04-17 15:17:41 -04:00
dsa
net: dsa: Discard frames from unused ports
2018-04-08 10:34:49 -04:00
ethernet
…
hsr
…
ieee802154
inet: frags: fix ip6frag_low_thresh boundary
2018-04-04 12:04:59 -04:00
ife
net: sched: ife: check on metadata length
2018-04-22 21:12:00 -04:00
ipv4
ipv4: fix fnhe usage by non-cached routes
2018-05-02 22:52:35 -04:00
ipv6
ipv6: Revert "ipv6: Allow non-gateway ECMP for IPv6"
2018-05-02 16:33:02 -04:00
iucv
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-03-23 11:31:58 -04:00
kcm
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00
key
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00
l2tp
l2tp: check sockaddr length in pppol2tp_connect()
2018-04-23 21:10:43 -04:00
l3mdev
…
lapb
treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts
2017-11-21 16:35:54 -08:00
llc
llc: fix NULL pointer deref for SOCK_ZAPPED
2018-04-22 14:56:22 -04:00
mac80211
We have a fair number of patches, but many of them are from the
2018-03-29 16:23:26 -04:00
mac802154
net/mac802154: disambiguate mac80215 vs mac802154 trace events
2018-03-28 22:55:18 +02:00
mpls
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00
ncsi
net/ncsi: check for null return from call to nla_nest_start
2018-03-27 10:38:26 -04:00
netfilter
netfilter: xt_connmark: do not cast xt_connmark_tginfo1 to xt_connmark_tginfo2
2018-04-19 16:19:28 +02:00
netlabel
netlabel: If PF_INET6, check sk_buff ip header version
2018-02-14 14:01:41 -05:00
netlink
netlink: fix uninit-value in netlink_sendmsg
2018-04-07 22:32:31 -04:00
netrom
net: Use octal not symbolic permissions
2018-03-26 12:07:48 -04:00
nfc
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-02-19 18:46:11 -05:00
nsh
openvswitch: enable NSH support
2017-11-08 16:12:33 +09:00
openvswitch
ovs: Remove rtnl_lock() from ovs_exit_net()
2018-03-29 13:47:54 -04:00
packet
packet: fix bitfield update race
2018-04-24 13:17:08 -04:00
phonet
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00
psample
MAINTAINERS: Update Yotam's E-mail
2017-11-01 12:19:03 +09:00
qrtr
net: qrtr: add MODULE_ALIAS_NETPROTO macro
2018-04-17 09:58:00 -04:00
rds
rds: do not leak kernel memory to user land
2018-05-03 11:26:14 -04:00
rfkill
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
rose
net: Use octal not symbolic permissions
2018-03-26 12:07:48 -04:00
rxrpc
rxrpc: Fix undefined packet handling
2018-04-04 11:04:08 -04:00
sched
net_sched: fq: take care of throttled flows before reuse
2018-05-02 16:37:38 -04:00
sctp
sctp: fix the issue that the cookie-ack with auth can't get processed
2018-05-02 11:15:33 -04:00
smc
net/smc: restrict non-blocking connect finish
2018-05-02 13:27:19 -04:00
strparser
strparser: Do not call mod_delayed_work with a timeout of LONG_MAX
2018-04-22 21:09:16 -04:00
sunrpc
rpc_pipefs: fix double-dput()
2018-04-15 23:49:27 -04:00
switchdev
net: bridge: Add/del switchdev object on host join/leave
2017-11-10 13:41:40 +09:00
tipc
tipc: fix bug in function tipc_nl_node_dump_monitor
2018-04-27 11:03:56 -04:00
tls
net/tls: Don't recursively call push_record during tls_write_space callbacks
2018-05-01 18:57:52 -04:00
unix
af_unix: remove redundant lockdep class
2018-04-04 11:13:40 -04:00
vmw_vsock
VSOCK: make af_vsock.ko removable again
2018-04-17 09:44:30 -04:00
wimax
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
wireless
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2018-03-31 23:33:04 -04:00
x25
net: Use octal not symbolic permissions
2018-03-26 12:07:48 -04:00
xfrm
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-04-01 19:49:34 -04:00
compat.c
net: support compat 64-bit time in {s,g}etsockopt
2018-04-27 19:46:06 -04:00
Kconfig
Staging/IIO patches for 4.16-rc1
2018-02-01 09:51:57 -08:00
Makefile
ipx: move Novell IPX protocol support into staging
2017-11-28 13:55:00 +01:00
socket.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2018-04-05 11:56:35 -07:00
sysctl_net.c
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00