Eric Dumazet eb80ca476e rds: do not leak kernel memory to user land ... syzbot/KMSAN reported an uninit-value in put_cmsg(), originating from rds_cmsg_recv(). Simply clear the structure, since we have holes there, or since rx_traces might be smaller than RDS_MSG_RX_DGRAM_TRACE_MAX. BUG: KMSAN: uninit-value in copy_to_user include/linux/uaccess.h:184 [inline] BUG: KMSAN: uninit-value in put_cmsg+0x600/0x870 net/core/scm.c:242 CPU: 0 PID: 4459 Comm: syz-executor582 Not tainted 4.16.0+ #87 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x185/0x1d0 lib/dump_stack.c:53 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067 kmsan_internal_check_memory+0x135/0x1e0 mm/kmsan/kmsan.c:1157 kmsan_copy_to_user+0x69/0x160 mm/kmsan/kmsan.c:1199 copy_to_user include/linux/uaccess.h:184 [inline] put_cmsg+0x600/0x870 net/core/scm.c:242 rds_cmsg_recv net/rds/recv.c:570 [inline] rds_recvmsg+0x2db5/0x3170 net/rds/recv.c:657 sock_recvmsg_nosec net/socket.c:803 [inline] sock_recvmsg+0x1d0/0x230 net/socket.c:810 ___sys_recvmsg+0x3fb/0x810 net/socket.c:2205 __sys_recvmsg net/socket.c:2250 [inline] SYSC_recvmsg+0x298/0x3c0 net/socket.c:2262 SyS_recvmsg+0x54/0x80 net/socket.c:2257 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 Fixes: 3289025aed ("RDS: add receive message trace used by application") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: Santosh Shilimkar <santosh.shilimkar@oracle.com> Cc: linux-rdma <linux-rdma@vger.kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-05-03 11:26:14 -04:00
..
af_rds.c	rds: use list structure to track information for zerocopy completion notification	2018-03-07 18:05:57 -05:00
bind.c
cong.c	rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management	2018-02-08 15:23:52 -05:00
connection.c	net: rds: drop VLA in rds_walk_conn_path_info()	2018-03-12 15:07:00 -04:00
ib_cm.c	rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp	2018-04-25 14:34:08 -04:00
ib_fmr.c
ib_frmr.c
ib_mr.h
ib_rdma.c
ib_recv.c
ib_ring.c
ib_send.c
ib_stats.c
ib_sysctl.c
ib.c	net: rds: drop VLA in rds_for_each_conn_info()	2018-03-12 15:06:59 -04:00
ib.h
info.c
info.h
Kconfig
loop.c
loop.h
Makefile
message.c	rds: remove redundant variable 'sg_off'	2018-03-12 11:12:38 -04:00
page.c
rdma_transport.c
rdma_transport.h
rdma.c
rds_single_path.h
rds.h	net: rds: drop VLA in rds_for_each_conn_info()	2018-03-12 15:06:59 -04:00
recv.c	rds: do not leak kernel memory to user land	2018-05-03 11:26:14 -04:00
send.c	rds: MP-RDS may use an invalid c_path	2018-04-11 10:24:01 -04:00
stats.c
sysctl.c
tcp_connect.c	rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management	2018-02-08 15:23:52 -05:00
tcp_listen.c	rds: Incorrect reference counting in TCP socket creation	2018-03-02 09:40:27 -05:00
tcp_recv.c	rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management	2018-02-08 15:23:52 -05:00
tcp_send.c	rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management	2018-02-08 15:23:52 -05:00
tcp_stats.c
tcp.c	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00
tcp.h
threads.c	rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management	2018-02-08 15:23:52 -05:00
transport.c