* [Linux-kernel-mentees] [PATCH] infiniband: Fix uninit-value in ucma_connect()
@ 2020-07-25 19:48 Peilin Ye
2020-07-25 22:02 ` [Linux-kernel-mentees] [PATCH] infiniband: Prevent uninit-value in ucma_accept() Peilin Ye
0 siblings, 1 reply; 4+ messages in thread
From: Peilin Ye @ 2020-07-25 19:48 UTC (permalink / raw)
To: Doug Ledford, Jason Gunthorpe
Cc: Leon Romanovsky, linux-rdma, syzkaller-bugs, linux-kernel,
linux-kernel-mentees, Peilin Ye
ucma_connect() is reading uninitialized memory when `in_len` is less than
`offsetof(struct rdma_ucm_connect, ece)`. Fix it.
Reported-and-tested-by: syzbot+7446526858b83c8828b2@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=2c85ca2b1aedb22ed1029383751e36cee3f7d047
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
---
drivers/infiniband/core/ucma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 5b87eee8ccc8..a591fdccdce0 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1079,7 +1079,7 @@ static ssize_t ucma_connect(struct ucma_file *file, const char __user *inbuf,
{
struct rdma_conn_param conn_param;
struct rdma_ucm_ece ece = {};
- struct rdma_ucm_connect cmd;
+ struct rdma_ucm_connect cmd = {};
struct ucma_context *ctx;
size_t in_size;
int ret;
--
2.25.1
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [Linux-kernel-mentees] [PATCH] infiniband: Prevent uninit-value in ucma_accept()
2020-07-25 19:48 [Linux-kernel-mentees] [PATCH] infiniband: Fix uninit-value in ucma_connect() Peilin Ye
@ 2020-07-25 22:02 ` Peilin Ye
2020-07-26 2:27 ` [Linux-kernel-mentees] [PATCH v2] " Peilin Ye
0 siblings, 1 reply; 4+ messages in thread
From: Peilin Ye @ 2020-07-25 22:02 UTC (permalink / raw)
To: Doug Ledford, Jason Gunthorpe
Cc: Leon Romanovsky, linux-rdma, syzkaller-bugs, linux-kernel,
linux-kernel-mentees, Peilin Ye
ucma_accept() is reading uninitialized memory when `in_len` is
less than `offsetof(struct rdma_ucm_accept, ece)`. Fix it.
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
---
drivers/infiniband/core/ucma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index a591fdccdce0..842d297903c0 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1134,7 +1134,7 @@ static ssize_t ucma_listen(struct ucma_file *file, const char __user *inbuf,
static ssize_t ucma_accept(struct ucma_file *file, const char __user *inbuf,
int in_len, int out_len)
{
- struct rdma_ucm_accept cmd;
+ struct rdma_ucm_accept cmd = {};
struct rdma_conn_param conn_param;
struct rdma_ucm_ece ece = {};
struct ucma_context *ctx;
--
2.25.1
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [Linux-kernel-mentees] [PATCH v2] infiniband: Prevent uninit-value in ucma_accept()
2020-07-25 22:02 ` [Linux-kernel-mentees] [PATCH] infiniband: Prevent uninit-value in ucma_accept() Peilin Ye
@ 2020-07-26 2:27 ` Peilin Ye
2020-07-27 14:58 ` Jason Gunthorpe
0 siblings, 1 reply; 4+ messages in thread
From: Peilin Ye @ 2020-07-26 2:27 UTC (permalink / raw)
To: Doug Ledford, Jason Gunthorpe
Cc: Leon Romanovsky, linux-rdma, syzkaller-bugs, linux-kernel,
linux-kernel-mentees, Peilin Ye
ucma_accept() is reading uninitialized memory when `in_len` is
less than `offsetof(struct rdma_ucm_accept, ece)`. Fix it.
Reported-and-tested-by: syzbot+086ab5ca9eafd2379aa6@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=0bce3bb68cb383fce92f78444e3ef77c764b60ad
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
---
Change in v2:
- syzbot has reported this bug as "KMSAN: uninit-value in xa_load".
Add "Reported-and-tested-by:" and "Link:" tags for it.
drivers/infiniband/core/ucma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index a591fdccdce0..842d297903c0 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1134,7 +1134,7 @@ static ssize_t ucma_listen(struct ucma_file *file, const char __user *inbuf,
static ssize_t ucma_accept(struct ucma_file *file, const char __user *inbuf,
int in_len, int out_len)
{
- struct rdma_ucm_accept cmd;
+ struct rdma_ucm_accept cmd = {};
struct rdma_conn_param conn_param;
struct rdma_ucm_ece ece = {};
struct ucma_context *ctx;
--
2.25.1
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [Linux-kernel-mentees] [PATCH v2] infiniband: Prevent uninit-value in ucma_accept()
2020-07-26 2:27 ` [Linux-kernel-mentees] [PATCH v2] " Peilin Ye
@ 2020-07-27 14:58 ` Jason Gunthorpe
0 siblings, 0 replies; 4+ messages in thread
From: Jason Gunthorpe @ 2020-07-27 14:58 UTC (permalink / raw)
To: Peilin Ye
Cc: Leon Romanovsky, linux-rdma, syzkaller-bugs, linux-kernel,
Doug Ledford, linux-kernel-mentees
On Sat, Jul 25, 2020 at 10:27:16PM -0400, Peilin Ye wrote:
> ucma_accept() is reading uninitialized memory when `in_len` is
> less than `offsetof(struct rdma_ucm_accept, ece)`. Fix it.
>
> Reported-and-tested-by: syzbot+086ab5ca9eafd2379aa6@syzkaller.appspotmail.com
> Link: https://syzkaller.appspot.com/bug?id=0bce3bb68cb383fce92f78444e3ef77c764b60ad
> Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
> ---
> Change in v2:
> - syzbot has reported this bug as "KMSAN: uninit-value in xa_load".
> Add "Reported-and-tested-by:" and "Link:" tags for it.
>
> drivers/infiniband/core/ucma.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Already fixed:
https://lore.kernel.org/r/0-v1-d5b86dab17dc+28c25-ucma_syz_min_jgg@nvidia.com
Jason
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-07-27 14:59 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-25 19:48 [Linux-kernel-mentees] [PATCH] infiniband: Fix uninit-value in ucma_connect() Peilin Ye
2020-07-25 22:02 ` [Linux-kernel-mentees] [PATCH] infiniband: Prevent uninit-value in ucma_accept() Peilin Ye
2020-07-26 2:27 ` [Linux-kernel-mentees] [PATCH v2] " Peilin Ye
2020-07-27 14:58 ` Jason Gunthorpe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).