rds: Prevent kernel-infoleak in rds_notify_queue_get()
authorPeilin Ye <yepeilin.cs@gmail.com>
Thu, 30 Jul 2020 19:20:26 +0000 (15:20 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 21 Aug 2020 09:01:49 +0000 (11:01 +0200)
commit2b9c45b6dc95dc2920c2d0abec219dcb22f49bb0
treeeca6982937b60832c0f641faf0be539b9c67067d
parent1231b93ef951229930f27f6e86ec3673e853178a
rds: Prevent kernel-infoleak in rds_notify_queue_get()

commit bbc8a99e952226c585ac17477a85ef1194501762 upstream.

rds_notify_queue_get() is potentially copying uninitialized kernel stack
memory to userspace since the compiler may leave a 4-byte hole at the end
of `cmsg`.

In 2016 we tried to fix this issue by doing `= { 0 };` on `cmsg`, which
unfortunately does not always initialize that 4-byte hole. Fix it by using
memset() instead.

Cc: stable@vger.kernel.org
Fixes: f037590fff30 ("rds: fix a leak of kernel memory")
Fixes: bdbe6fbc6a2f ("RDS: recv.c")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/rds/recv.c