• Eric Dumazet's avatar
    rds: do not leak kernel memory to user land · eb80ca47
    Eric Dumazet authored
    syzbot/KMSAN reported an uninit-value in put_cmsg(), originating
    from rds_cmsg_recv().
    
    Simply clear the structure, since we have holes there, or since
    rx_traces might be smaller than RDS_MSG_RX_DGRAM_TRACE_MAX.
    
    BUG: KMSAN: uninit-value in copy_to_user include/linux/uaccess.h:184 [inline]
    BUG: KMSAN: uninit-value in put_cmsg+0x600/0x870 net/core/scm.c:242
    CPU: 0 PID: 4459 Comm: syz-executor582 Not tainted 4.16.0+ #87
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
     __dump_stack lib/dump_stack.c:17 [inline]
     dump_stack+0x185/0x1d0 lib/dump_stack.c:53
     kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067
     kmsan_internal_check_memory+0x135/0x1e0 mm/kmsan/kmsan.c:1157
     kmsan_copy_to_user+0x69/0x160 mm/kmsan/kmsan.c:1199
     copy_to_user include/linux/uaccess.h:184 [inline]
     put_cmsg+0x600/0x870 net/core/scm.c:242
     rds_cmsg_recv net/rds/recv.c:570 [inline]
     rds_recvmsg+0x2db5/0x3170 net/rds/recv.c:657
     sock_recvmsg_nosec net/socket.c:803 [inline]
     sock_recvmsg+0x1d0/0x230 net/socket.c:810
     ___sys_recvmsg+0x3fb/0x810 net/socket.c:2205
     __sys_recvmsg net/socket.c:2250 [inline]
     SYSC_recvmsg+0x298/0x3c0 net/socket.c:2262
     SyS_recvmsg+0x54/0x80 net/socket.c:2257
     do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287
     entry_SYSCALL_64_after_hwframe+0x3d/0xa2
    
    Fixes: 3289025a ("RDS: add receive message trace used by application")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Cc: Santosh Shilimkar <santosh.shilimkar@oracle.com>
    Cc: linux-rdma <linux-rdma@vger.kernel.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    eb80ca47
recv.c 21.7 KB