[PATCH] infiniband: core: fix information leak to userland

All of lore.kernel.org
 help / color / mirror / Atom feed

From: Vasiliy Kulikov <segooon@gmail.com>
To: kernel-janitors-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Cc: Roland Dreier <rolandd-FYB4Gu1CFyUAvxtiuMwx3w@public.gmane.org>,
	Sean Hefty <sean.hefty-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>,
	Hal Rosenstock
	<hal.rosenstock-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>,
	Alex Chiang <achiang-VXdhtT5mjnY@public.gmane.org>,
	Andi Kleen <ak-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>,
	Greg Kroah-Hartman <gregkh-l3A5Bk7waGM@public.gmane.org>,
	Julia Lawall <julia-dAYI7NvHqcQ@public.gmane.org>,
	linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: [PATCH] infiniband: core: fix information leak to userland
Date: Sat, 06 Nov 2010 14:41:20 +0000	[thread overview]
Message-ID: <1289054481-18145-1-git-send-email-segooon@gmail.com> (raw)

Structure ib_uverbs_qp_attr is copied to userland with allmost all
fields uninitialized (140 bytes on x86).  It leads to leaking of
contents of kernel stack memory.

Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
---
 Compile tested.

 drivers/infiniband/core/ucm.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index 08f948d..ccfa4f9 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -622,7 +622,7 @@ static ssize_t ib_ucm_init_qp_attr(struct ib_ucm_file *file,
 	if (IS_ERR(ctx))
 		return PTR_ERR(ctx);
 
-	resp.qp_attr_mask = 0;
+	memset(&resp, 0, sizeof(resp));
 	memset(&qp_attr, 0, sizeof qp_attr);
 	qp_attr.qp_state = cmd.qp_state;
 	result = ib_cm_init_qp_attr(ctx->cm_id, &qp_attr, &resp.qp_attr_mask);
-- 
1.7.0.4

WARNING: multiple messages have this Message-ID (diff)

From: Vasiliy Kulikov <segooon-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: kernel-janitors-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Cc: Roland Dreier <rolandd-FYB4Gu1CFyUAvxtiuMwx3w@public.gmane.org>,
	Sean Hefty <sean.hefty-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>,
	Hal Rosenstock
	<hal.rosenstock-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>,
	Alex Chiang <achiang-VXdhtT5mjnY@public.gmane.org>,
	Andi Kleen <ak-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>,
	Greg Kroah-Hartman <gregkh-l3A5Bk7waGM@public.gmane.org>,
	Julia Lawall <julia-dAYI7NvHqcQ@public.gmane.org>,
	linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: [PATCH] infiniband: core: fix information leak to userland
Date: Sat,  6 Nov 2010 17:41:20 +0300	[thread overview]
Message-ID: <1289054481-18145-1-git-send-email-segooon@gmail.com> (raw)

Structure ib_uverbs_qp_attr is copied to userland with allmost all
fields uninitialized (140 bytes on x86).  It leads to leaking of
contents of kernel stack memory.

Signed-off-by: Vasiliy Kulikov <segooon-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
---
 Compile tested.

 drivers/infiniband/core/ucm.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index 08f948d..ccfa4f9 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -622,7 +622,7 @@ static ssize_t ib_ucm_init_qp_attr(struct ib_ucm_file *file,
 	if (IS_ERR(ctx))
 		return PTR_ERR(ctx);
 
-	resp.qp_attr_mask = 0;
+	memset(&resp, 0, sizeof(resp));
 	memset(&qp_attr, 0, sizeof qp_attr);
 	qp_attr.qp_state = cmd.qp_state;
 	result = ib_cm_init_qp_attr(ctx->cm_id, &qp_attr, &resp.qp_attr_mask);
-- 
1.7.0.4

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

WARNING: multiple messages have this Message-ID (diff)

From: Vasiliy Kulikov <segooon@gmail.com>
To: kernel-janitors@vger.kernel.org
Cc: Roland Dreier <rolandd@cisco.com>,
	Sean Hefty <sean.hefty@intel.com>,
	Hal Rosenstock <hal.rosenstock@gmail.com>,
	Alex Chiang <achiang@hp.com>, Andi Kleen <ak@linux.intel.com>,
	Greg Kroah-Hartman <gregkh@suse.de>, Julia Lawall <julia@diku.dk>,
	linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] infiniband: core: fix information leak to userland
Date: Sat,  6 Nov 2010 17:41:20 +0300	[thread overview]
Message-ID: <1289054481-18145-1-git-send-email-segooon@gmail.com> (raw)

Structure ib_uverbs_qp_attr is copied to userland with allmost all
fields uninitialized (140 bytes on x86).  It leads to leaking of
contents of kernel stack memory.

Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
---
 Compile tested.

 drivers/infiniband/core/ucm.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index 08f948d..ccfa4f9 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -622,7 +622,7 @@ static ssize_t ib_ucm_init_qp_attr(struct ib_ucm_file *file,
 	if (IS_ERR(ctx))
 		return PTR_ERR(ctx);
 
-	resp.qp_attr_mask = 0;
+	memset(&resp, 0, sizeof(resp));
 	memset(&qp_attr, 0, sizeof qp_attr);
 	qp_attr.qp_state = cmd.qp_state;
 	result = ib_cm_init_qp_attr(ctx->cm_id, &qp_attr, &resp.qp_attr_mask);
-- 
1.7.0.4

next             reply	other threads:[~2010-11-06 14:41 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-11-06 14:41 Vasiliy Kulikov [this message]
2010-11-06 14:41 ` [PATCH] infiniband: core: fix information leak to userland Vasiliy Kulikov
2010-11-06 14:41 ` Vasiliy Kulikov
     [not found] ` <1289054481-18145-1-git-send-email-segooon-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2010-11-11  0:01   ` Roland Dreier
2010-11-11  0:01     ` Roland Dreier
2010-11-11  0:01     ` Roland Dreier
     [not found]     ` <ada39r8ohiz.fsf-FYB4Gu1CFyUAvxtiuMwx3w@public.gmane.org>
2010-11-11  0:39       ` Hefty, Sean
2010-11-11  0:39         ` Hefty, Sean
2010-11-11  0:39         ` Hefty, Sean
2010-11-12 18:08       ` Vasiliy Kulikov
2010-11-12 18:08         ` Vasiliy Kulikov
2010-11-12 18:08         ` Vasiliy Kulikov
2010-11-12 18:28         ` Hefty, Sean
2010-11-12 18:28           ` Hefty, Sean
2010-11-12 18:28           ` Hefty, Sean
     [not found]           ` <CF9C39F99A89134C9CF9C4CCB68B8DDF25B85224A6-osO9UTpF0USkrb+BlOpmy7fspsVTdybXVpNB7YpNyf8@public.gmane.org>
2010-11-14  9:22             ` [PATCH v2] infiniband: core: fix information leak to userspace Vasiliy Kulikov
2010-11-14  9:22               ` Vasiliy Kulikov
2010-11-14  9:22               ` Vasiliy Kulikov
2010-12-02  0:33               ` Roland Dreier
2010-12-02  0:33                 ` Roland Dreier
2010-12-02  0:33                 ` Roland Dreier

find likely ancestor, descendant, or conflicting patches for this message:
( dfblob:08f948d dfblob:ccfa4f9 dfblob:08f948d dfblob:ccfa4f9
dfblob:08f948d dfblob:ccfa4f9 )
 OR (
bs:"[PATCH] infiniband: core: fix information leak to userland" )
	(help)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1289054481-18145-1-git-send-email-segooon@gmail.com \
    --to=segooon@gmail.com \
    --cc=achiang-VXdhtT5mjnY@public.gmane.org \
    --cc=ak-VuQAYsv1563Yd54FQh9/CA@public.gmane.org \
    --cc=gregkh-l3A5Bk7waGM@public.gmane.org \
    --cc=hal.rosenstock-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \
    --cc=julia-dAYI7NvHqcQ@public.gmane.org \
    --cc=kernel-janitors-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=rolandd-FYB4Gu1CFyUAvxtiuMwx3w@public.gmane.org \
    --cc=sean.hefty-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.