* Re: [patch] RDMA/cxgb4: info leak in c4iw_alloc_ucontext() [not found] <20140328082428.GH25192@mwanda> @ 2014-03-28 10:27 ` Yann Droneaud [not found] ` <1396002468.3297.63.camel-bi+AKbBUZKY6gyzm1THtWbp2dZbC/Bob@public.gmane.org> 0 siblings, 1 reply; 4+ messages in thread From: Yann Droneaud @ 2014-03-28 10:27 UTC (permalink / raw) To: Dan Carpenter Cc: Steve Wise, Roland Dreier, Sean Hefty, Hal Rosenstock, linux-rdma, kernel-janitors, netdev, davem, roland, dm, leedom, santosh, kumaras, nirranjan, hariprasad, Steve Wise Hi, Le vendredi 28 mars 2014 à 11:24 +0300, Dan Carpenter a écrit : > The c4iw_alloc_ucontext_resp struct has a 4 byte hole after the last > member and we should clear it before passing it to the user. > > Fixes: 05eb23893c2c ('cxgb4/iw_cxgb4: Doorbell Drop Avoidance Bug Fixes') > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > It's not the proper fix for this issue: an explicit padding has to be added (and initialized), see "Re: [PATCH net-next 2/2] cxgb4/iw_cxgb4: Doorbell Drop Avoidance Bug Fixes" http://marc.info/?i=1395848977.3297.15.camel@localhost.localdomain In its current form, the c4iw_alloc_ucontext_resp structure does not require padding on i386, so a 32bits userspace program using this structure against a x86_64 kernel will make the kernel do a buffer overflow in userspace, likely on stack, as answer of a GET_CONTEXT request: #include <infiniband/verbs.h> #include <infiniband/kern-abi.h> #define IBV_INIT_CMD_RESP(cmd, size, opcode, out, outsize) \ do { \ (cmd)->command = IB_USER_VERBS_CMD_##opcode; \ (cmd)->in_words = (size) / 4; \ (cmd)->out_words = (outsize) / 4; \ (cmd)->response = (out); \ } while (0) struct c4iw_alloc_ucontext_resp { struct ibv_get_context_resp ibv_resp; __u64 status_page_key; __u32 status_page_size; }; struct ibv_context *alloc_context(struct ibv_device *ibdev, int cmd_fd) { struct ibv_get_context cmd; struct c4iw_alloc_ucontext_resp resp; ssize_t sret; ... IBV_INIT_CMD_RESP(&cmd, sizeof(cmd), GET_CONTEXT, &resp, sizeof(resp)); ... sret = write(context->cmd_fd, &cmd, sizeof(cmd)); if (sret != sizeof(cmd)) { int err = errno; fprintf(stderr, "GET_CONTEXT failed: %d (%s)\n", err, strerror(err)); ... } ... } Unfortunately, it's not the only structure which has this problem. I'm currently preparing a report on this issue for this driver (cxgb4) and another. > diff --git a/drivers/infiniband/hw/cxgb4/provider.c b/drivers/infiniband/hw/cxgb4/provider.c > index e36d2a2..a72aaa7 100644 > --- a/drivers/infiniband/hw/cxgb4/provider.c > +++ b/drivers/infiniband/hw/cxgb4/provider.c > @@ -107,7 +107,7 @@ static struct ib_ucontext *c4iw_alloc_ucontext(struct ib_device *ibdev, > struct c4iw_ucontext *context; > struct c4iw_dev *rhp = to_c4iw_dev(ibdev); > static int warned; > - struct c4iw_alloc_ucontext_resp uresp; > + struct c4iw_alloc_ucontext_resp uresp = {}; > int ret = 0; > struct c4iw_mm_entry *mm = NULL; > Regards. -- Yann Droneaud OPTEYA ^ permalink raw reply [flat|nested] 4+ messages in thread
[parent not found: <1396002468.3297.63.camel-bi+AKbBUZKY6gyzm1THtWbp2dZbC/Bob@public.gmane.org>]
* RE: [patch] RDMA/cxgb4: info leak in c4iw_alloc_ucontext() [not found] ` <1396002468.3297.63.camel-bi+AKbBUZKY6gyzm1THtWbp2dZbC/Bob@public.gmane.org> @ 2014-03-28 10:58 ` David Laight 2014-05-02 23:56 ` Dan Carpenter 1 sibling, 0 replies; 4+ messages in thread From: David Laight @ 2014-03-28 10:58 UTC (permalink / raw) To: 'Yann Droneaud', Dan Carpenter Cc: Steve Wise, Roland Dreier, Sean Hefty, Hal Rosenstock, linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, kernel-janitors-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org, roland-BHEL68pLQRGGvPXPguhicg@public.gmane.org, dm-ut6Up61K2wZBDgjK7y7TUQ@public.gmane.org, leedom-ut6Up61K2wZBDgjK7y7TUQ@public.gmane.org, santosh-ut6Up61K2wZBDgjK7y7TUQ@public.gmane.org, kumaras-ut6Up61K2wZBDgjK7y7TUQ@public.gmane.org, nirranjan-ut6Up61K2wZBDgjK7y7TUQ@public.gmane.org, hariprasad-ut6Up61K2wZBDgjK7y7TUQ@public.gmane.org, Steve Wise From: Yann Droneaud > Hi, > > Le vendredi 28 mars 2014 11:24 +0300, Dan Carpenter a crit : > > The c4iw_alloc_ucontext_resp struct has a 4 byte hole after the last > > member and we should clear it before passing it to the user. > > > > Fixes: 05eb23893c2c ('cxgb4/iw_cxgb4: Doorbell Drop Avoidance Bug Fixes') > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > > > It's not the proper fix for this issue: an explicit padding has to be > added (and initialized), see "Re: [PATCH net-next 2/2] cxgb4/iw_cxgb4: > Doorbell Drop Avoidance Bug Fixes" > http://marc.info/?i=1395848977.3297.15.camel@localhost.localdomain > > In its current form, the c4iw_alloc_ucontext_resp structure does not > require padding on i386, so a 32bits userspace program using this > structure against a x86_64 kernel will make the kernel do a buffer > overflow in userspace, likely on stack, as answer of a GET_CONTEXT > request: ... > struct c4iw_alloc_ucontext_resp { > struct ibv_get_context_resp ibv_resp; > __u64 status_page_key; > __u32 status_page_size; > }; Or add __attribute__((aligned(4))) to the 64bit fields. And maybe a compile time assert on the length of the structure. Since it is part of an ABI it must not change David ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [patch] RDMA/cxgb4: info leak in c4iw_alloc_ucontext() [not found] ` <1396002468.3297.63.camel-bi+AKbBUZKY6gyzm1THtWbp2dZbC/Bob@public.gmane.org> 2014-03-28 10:58 ` David Laight @ 2014-05-02 23:56 ` Dan Carpenter 2014-05-04 21:46 ` Yann Droneaud 1 sibling, 1 reply; 4+ messages in thread From: Dan Carpenter @ 2014-05-02 23:56 UTC (permalink / raw) To: Yann Droneaud Cc: Steve Wise, Roland Dreier, Sean Hefty, Hal Rosenstock, linux-rdma-u79uwXL29TY76Z2rM5mHXA, kernel-janitors-u79uwXL29TY76Z2rM5mHXA, netdev-u79uwXL29TY76Z2rM5mHXA, davem-fT/PcQaiUtIeIZ0/mPfg9Q, roland-BHEL68pLQRGGvPXPguhicg, dm-ut6Up61K2wZBDgjK7y7TUQ, leedom-ut6Up61K2wZBDgjK7y7TUQ, santosh-ut6Up61K2wZBDgjK7y7TUQ, kumaras-ut6Up61K2wZBDgjK7y7TUQ, nirranjan-ut6Up61K2wZBDgjK7y7TUQ, hariprasad-ut6Up61K2wZBDgjK7y7TUQ, Steve Wise On Fri, Mar 28, 2014 at 11:27:48AM +0100, Yann Droneaud wrote: > Unfortunately, it's not the only structure which has this problem. I'm > currently preparing a report on this issue for this driver (cxgb4) and > another. > This information leak is still present in linux-next. These days we count those things as security vulnerabilities with CVEs and everything. When is it likely to get fixed? regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [patch] RDMA/cxgb4: info leak in c4iw_alloc_ucontext() 2014-05-02 23:56 ` Dan Carpenter @ 2014-05-04 21:46 ` Yann Droneaud 0 siblings, 0 replies; 4+ messages in thread From: Yann Droneaud @ 2014-05-04 21:46 UTC (permalink / raw) To: Dan Carpenter Cc: Steve Wise, Roland Dreier, Sean Hefty, Hal Rosenstock, linux-rdma, kernel-janitors, netdev, davem, roland, dm, leedom, santosh, kumaras, nirranjan, hariprasad, Steve Wise Hi, Le samedi 03 mai 2014 à 02:56 +0300, Dan Carpenter a écrit : > On Fri, Mar 28, 2014 at 11:27:48AM +0100, Yann Droneaud wrote: > > Unfortunately, it's not the only structure which has this problem. I'm > > currently preparing a report on this issue for this driver (cxgb4) and > > another. > > > > This information leak is still present in linux-next. These days we > count those things as security vulnerabilities with CVEs and everything. > > When is it likely to get fixed? > Thanks for the reminder. The patches were waiting for some times in my patch queue, I failed to provide them earlier. BTW, I've taken time during the week end to complete them. They should be available on linux-rdma@vger.kernel.org. See http://marc.info/?i=cover.1399216475.git.ydroneaud@opteya.com Regards. -- Yann Droneaud OPTEYA -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-05-04 21:46 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20140328082428.GH25192@mwanda>
2014-03-28 10:27 ` [patch] RDMA/cxgb4: info leak in c4iw_alloc_ucontext() Yann Droneaud
[not found] ` <1396002468.3297.63.camel-bi+AKbBUZKY6gyzm1THtWbp2dZbC/Bob@public.gmane.org>
2014-03-28 10:58 ` David Laight
2014-05-02 23:56 ` Dan Carpenter
2014-05-04 21:46 ` Yann Droneaud
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).