From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 30033C43331 for ; Wed, 1 Apr 2020 16:48:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C6B532063A for ; Wed, 1 Apr 2020 16:48:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759701; bh=HDBfyDI3oU4l6pCi6L0fG4nqaOCEBqvamVW1rdWlQQ4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=NfHexyaQNH/CjDQbWuJMlWO9eONpb2d0ZpCUljLqAHIx13OOSxmfKRP1cYJfGc2Li /0JRUSRv2fS5FWcwbjiaq9aY75Ng/kavO7mD3Kaxsr2QKzOP5t4AeAU32ZmbWLvwBc JhscG6/hTOSfsHGJ5ofGSmoS+IfcQA7ooARoK0/c= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389305AbgDAQsU (ORCPT ); Wed, 1 Apr 2020 12:48:20 -0400 Received: from mail.kernel.org ([198.145.29.99]:48768 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390024AbgDAQrG (ORCPT ); Wed, 1 Apr 2020 12:47:06 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 05C2420705; Wed, 1 Apr 2020 16:47:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759625; bh=HDBfyDI3oU4l6pCi6L0fG4nqaOCEBqvamVW1rdWlQQ4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kbeDJkFl8auA/6XUm4fa6nGsOSqLNOADuezHhPZfwl5krStoQtR2kngJ1UR+QgLBy FXMMluXD+/md92+2st1LfUPrrMwMewBYsmgrIaz/uL2cyP3xSykL8ovK4SJaoK6QZu jzvsnyFcqbb3flzxC8Rb5GF/gI4rpO96IrghB8bQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Maciej=20=C5=BBenczykowski?= , John Stultz , Alexander Potapenko , Alistair Delva , Daniel Borkmann , Yonghong Song Subject: [PATCH 4.14 139/148] bpf: Explicitly memset the bpf_attr structure Date: Wed, 1 Apr 2020 18:18:51 +0200 Message-Id: <20200401161605.547925593@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161552.245876366@linuxfoundation.org> References: <20200401161552.245876366@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Greg Kroah-Hartman commit 8096f229421f7b22433775e928d506f0342e5907 upstream. For the bpf syscall, we are relying on the compiler to properly zero out the bpf_attr union that we copy userspace data into. Unfortunately that doesn't always work properly, padding and other oddities might not be correctly zeroed, and in some tests odd things have been found when the stack is pre-initialized to other values. Fix this by explicitly memsetting the structure to 0 before using it. Reported-by: Maciej Żenczykowski Reported-by: John Stultz Reported-by: Alexander Potapenko Reported-by: Alistair Delva Signed-off-by: Greg Kroah-Hartman Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://android-review.googlesource.com/c/kernel/common/+/1235490 Link: https://lore.kernel.org/bpf/20200320094813.GA421650@kroah.com Signed-off-by: Greg Kroah-Hartman --- kernel/bpf/syscall.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1474,7 +1474,7 @@ static int bpf_obj_get_info_by_fd(const SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, size) { - union bpf_attr attr = {}; + union bpf_attr attr; int err; if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN)) @@ -1486,6 +1486,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf size = min_t(u32, size, sizeof(attr)); /* copy attributes from user space, may be less than sizeof(bpf_attr) */ + memset(&attr, 0, sizeof(attr)); if (copy_from_user(&attr, uattr, size) != 0) return -EFAULT;