rds: Prevent kernel-infoleak in rds_notify_queue_get()
authorPeilin Ye <yepeilin.cs@gmail.com>
Thu, 30 Jul 2020 19:20:26 +0000 (15:20 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 5 Aug 2020 07:59:44 +0000 (09:59 +0200)
commit2ec69499b7589d8701eb7563d11a4efffd6252bc
tree4690ea5c3dc2268f6b3947c8cbd7d35e8c118b66
parent6a9428427da1775ae79baa8414fdb31db546a384
rds: Prevent kernel-infoleak in rds_notify_queue_get()

commit bbc8a99e952226c585ac17477a85ef1194501762 upstream.

rds_notify_queue_get() is potentially copying uninitialized kernel stack
memory to userspace since the compiler may leave a 4-byte hole at the end
of `cmsg`.

In 2016 we tried to fix this issue by doing `= { 0 };` on `cmsg`, which
unfortunately does not always initialize that 4-byte hole. Fix it by using
memset() instead.

Cc: stable@vger.kernel.org
Fixes: f037590fff30 ("rds: fix a leak of kernel memory")
Fixes: bdbe6fbc6a2f ("RDS: recv.c")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/rds/recv.c