From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+6d532fa8f9463da290bc@syzkaller.appspotmail.com,
Leon Romanovsky <leonro@nvidia.com>,
Jason Gunthorpe <jgg@nvidia.com>
Subject: [PATCH 5.10 08/43] RDMA/core: Dont infoleak GRH fields
Date: Mon, 10 Jan 2022 08:23:05 +0100 [thread overview]
Message-ID: <20220110071817.631453319@linuxfoundation.org> (raw)
In-Reply-To: <20220110071817.337619922@linuxfoundation.org>
From: Leon Romanovsky <leonro@nvidia.com>
commit b35a0f4dd544eaa6162b6d2f13a2557a121ae5fd upstream.
If dst->is_global field is not set, the GRH fields are not cleared
and the following infoleak is reported.
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33
instrument_copy_to_user include/linux/instrumented.h:121 [inline]
_copy_to_user+0x1c9/0x270 lib/usercopy.c:33
copy_to_user include/linux/uaccess.h:209 [inline]
ucma_init_qp_attr+0x8c7/0xb10 drivers/infiniband/core/ucma.c:1242
ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732
vfs_write+0x8ce/0x2030 fs/read_write.c:588
ksys_write+0x28b/0x510 fs/read_write.c:643
__do_sys_write fs/read_write.c:655 [inline]
__se_sys_write fs/read_write.c:652 [inline]
__ia32_sys_write+0xdb/0x120 fs/read_write.c:652
do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline]
__do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180
do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205
do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248
entry_SYSENTER_compat_after_hwframe+0x4d/0x5c
Local variable resp created at:
ucma_init_qp_attr+0xa4/0xb10 drivers/infiniband/core/ucma.c:1214
ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732
Bytes 40-59 of 144 are uninitialized
Memory access of size 144 starts at ffff888167523b00
Data copied to user address 0000000020000100
CPU: 1 PID: 25910 Comm: syz-executor.1 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
=====================================================
Fixes: 4ba66093bdc6 ("IB/core: Check for global flag when using ah_attr")
Link: https://lore.kernel.org/r/0e9dd51f93410b7b2f4f5562f52befc878b71afa.1641298868.git.leonro@nvidia.com
Reported-by: syzbot+6d532fa8f9463da290bc@syzkaller.appspotmail.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/uverbs_marshall.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/core/uverbs_marshall.c
+++ b/drivers/infiniband/core/uverbs_marshall.c
@@ -66,7 +66,7 @@ void ib_copy_ah_attr_to_user(struct ib_d
struct rdma_ah_attr *src = ah_attr;
struct rdma_ah_attr conv_ah;
- memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved));
+ memset(&dst->grh, 0, sizeof(dst->grh));
if ((ah_attr->type == RDMA_AH_ATTR_TYPE_OPA) &&
(rdma_ah_get_dlid(ah_attr) > be16_to_cpu(IB_LID_PERMISSIVE)) &&
next prev parent reply other threads:[~2022-01-10 7:44 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-10 7:22 [PATCH 5.10 00/43] 5.10.91-rc1 review Greg Kroah-Hartman
2022-01-10 7:22 ` [PATCH 5.10 01/43] f2fs: quota: fix potential deadlock Greg Kroah-Hartman
2022-01-10 7:22 ` [PATCH 5.10 02/43] selftests: x86: fix [-Wstringop-overread] warn in test_process_vm_readv() Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 03/43] tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 04/43] tracing: Tag trace_percpu_buffer as a percpu pointer Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 05/43] ieee802154: atusb: fix uninit value in atusb_set_extended_addr Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 06/43] i40e: Fix to not show opcode msg on unsuccessful VF MAC change Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 07/43] iavf: Fix limit of total number of queues to active queues of VF Greg Kroah-Hartman
2022-01-10 7:23 ` Greg Kroah-Hartman [this message]
2022-01-10 7:23 ` [PATCH 5.10 09/43] netrom: fix copying in user data in nr_setsockopt Greg Kroah-Hartman
2022-01-10 10:07 ` Pavel Machek
2022-01-10 10:14 ` Dan Carpenter
2022-01-10 7:23 ` [PATCH 5.10 10/43] RDMA/uverbs: Check for null return of kmalloc_array Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 11/43] mac80211: initialize variable have_higher_than_11mbit Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 12/43] sfc: The RX page_ring is optional Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 13/43] i40e: fix use-after-free in i40e_sync_filters_subtask() Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 14/43] i40e: Fix for displaying message regarding NVM version Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 15/43] i40e: Fix incorrect netdevs real number of RX/TX queues Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 16/43] ftrace/samples: Add missing prototypes direct functions Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 17/43] ipv4: Check attribute length for RTA_GATEWAY in multipath route Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 18/43] ipv4: Check attribute length for RTA_FLOW " Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 19/43] ipv6: Check attribute length for RTA_GATEWAY " Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 20/43] ipv6: Check attribute length for RTA_GATEWAY when deleting " Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 21/43] lwtunnel: Validate RTA_ENCAP_TYPE attribute length Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 22/43] batman-adv: mcast: dont send link-local multicast to mcast routers Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 23/43] sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 24/43] net: ena: Fix undefined state when tx request id is out of bounds Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 25/43] net: ena: Fix error handling when calculating max IO queues number Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 26/43] xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 27/43] power: supply: core: Break capacity loop Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 28/43] power: reset: ltc2952: Fix use of floating point literals Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 29/43] rndis_host: support Hytera digital radios Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 30/43] phonet: refcount leak in pep_sock_accep Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 31/43] power: bq25890: Enable continuous conversion for ADC at charging Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 32/43] ipv6: Continue processing multipath route even if gateway attribute is invalid Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 33/43] ipv6: Do cleanup if attribute validation fails in multipath route Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 34/43] usb: mtu3: fix interval value for intr and isoc Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 35/43] scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 36/43] ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 37/43] net: udp: fix alignment problem in udp4_seq_show() Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 38/43] atlantic: Fix buff_ring OOB in aq_ring_rx_clean Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 39/43] mISDN: change function names to avoid conflicts Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 40/43] drm/amd/display: Added power down for DCN10 Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 41/43] ipv6: raw: check passed optlen before reading Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 42/43] ARM: dts: gpio-ranges property is now required Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 5.10 43/43] Input: zinitix - make sure the IRQ is allocated before it gets enabled Greg Kroah-Hartman
2022-01-10 11:49 ` [PATCH 5.10 00/43] 5.10.91-rc1 review Jon Hunter
2022-01-10 19:10 ` Fox Chen
2022-01-10 19:50 ` Florian Fainelli
2022-01-10 22:56 ` Shuah Khan
2022-01-10 23:50 ` Guenter Roeck
2022-01-11 3:34 ` Samuel Zou
2022-01-11 5:26 ` Naresh Kamboju
2022-01-11 12:37 ` Sudip Mukherjee
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220110071817.631453319@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jgg@nvidia.com \
--cc=leonro@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+6d532fa8f9463da290bc@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.