All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Jason Gunthorpe <jgg@nvidia.com>
Cc: Haimin Zhang <tcs.kernel@gmail.com>,
	Wenpeng Liang <liangwenpeng@huawei.com>,
	Leon Romanovsky <leon@kernel.org>,
	Weihang Li <liweihang@huawei.com>,
	YueHaibing <yuehaibing@huawei.com>,
	Xiaofei Tan <tanxiaofei@huawei.com>,
	Dasaratharaman Chandramouli 
	<dasaratharaman.chandramouli@intel.com>,
	Doug Ledford <dledford@redhat.com>,
	Sean Hefty <sean.hefty@intel.com>,
	Don Hiatt <don.hiatt@intel.com>, Ira Weiny <ira.weiny@intel.com>,
	linux-rdma@vger.kernel.org, security@kernel.org,
	Greg KH <gregkh@linuxfoundation.org>
Subject: Re: [PATCH v2] RDMA/ucma: RDMA/ucma: fix a kernel-infoleak in ucma_init_qp_attr()
Date: Sat, 5 Feb 2022 12:11:45 +0300	[thread overview]
Message-ID: <20220205091145.GM1978@kadam> (raw)
In-Reply-To: <20220204235559.GA2794860@nvidia.com>

On Fri, Feb 04, 2022 at 07:55:59PM -0400, Jason Gunthorpe wrote:
> On Fri, Feb 04, 2022 at 01:00:36PM +0300, Dan Carpenter wrote:
> > From: Haimin Zhang <tcs.kernel@gmail.com>
> > 
> > The ib_copy_ah_attr_to_user() function only initializes "resp.grh" if
> > the "resp.is_global" flag is set.  Unfortunately, this data is copied to
> > the user and copying uninitialized stack data to the user is an
> > information leak.  Zero out the whole "resp" struct to be safe.
> 
> Hasn't this already been fixed, and more comprehensively too?
> 
> commit b35a0f4dd544eaa6162b6d2f13a2557a121ae5fd
> Author: Leon Romanovsky <leon@kernel.org>
> Date:   Tue Jan 4 14:21:52 2022 +0200
> 
>     RDMA/core: Don't infoleak GRH fields
>     
>     If dst->is_global field is not set, the GRH fields are not cleared
>     and the following infoleak is reported.
> 
> Jason

That does fix the bug.  It's unfortunate that Haimin Zhang doesn't get
the reported by tag on this.  That was my screw up.  Sorry.

regards,
dan carpenter


      reply	other threads:[~2022-02-05  9:13 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-02-04 10:00 [PATCH v2] RDMA/ucma: RDMA/ucma: fix a kernel-infoleak in ucma_init_qp_attr() Dan Carpenter
2022-02-04 23:55 ` Jason Gunthorpe
2022-02-05  9:11   ` Dan Carpenter [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220205091145.GM1978@kadam \
    --to=dan.carpenter@oracle.com \
    --cc=dasaratharaman.chandramouli@intel.com \
    --cc=dledford@redhat.com \
    --cc=don.hiatt@intel.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=ira.weiny@intel.com \
    --cc=jgg@nvidia.com \
    --cc=leon@kernel.org \
    --cc=liangwenpeng@huawei.com \
    --cc=linux-rdma@vger.kernel.org \
    --cc=liweihang@huawei.com \
    --cc=sean.hefty@intel.com \
    --cc=security@kernel.org \
    --cc=tanxiaofei@huawei.com \
    --cc=tcs.kernel@gmail.com \
    --cc=yuehaibing@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.