From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 12924C43331 for ; Wed, 1 Apr 2020 16:28:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A902520BED for ; Wed, 1 Apr 2020 16:28:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758492; bh=aJXSF9To3DwzTZCXEL3zhettvEbM0elzyPobBAlreHg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=h2eqozCKjlsBvJ6CuZdt2r4fhDQ6A6QMMzQbiss4A1A1BTw6Av5u8Ypzlbp1CzeRl mY2efMdqeet1cbGAeAAgBBWXZTrLs2qCTYwzMTFA6ncGjVRn77x47OX2tdmJMJfFBw dRUW4ck5feclPPBrL9AyqGO5kXvCOlZMeYr537Ho= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388083AbgDAQ2L (ORCPT ); Wed, 1 Apr 2020 12:28:11 -0400 Received: from mail.kernel.org ([198.145.29.99]:53364 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388078AbgDAQ2J (ORCPT ); Wed, 1 Apr 2020 12:28:09 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5E18520857; Wed, 1 Apr 2020 16:28:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758488; bh=aJXSF9To3DwzTZCXEL3zhettvEbM0elzyPobBAlreHg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=P0rgyp3QGgi8agRxn8SwcZG3FBENKRKtymQ9/yWR6wo8VkyAaMWSD0QzZ9OQQ5yns PJ8eWhPBX7qkENupSonsf8bEusEdjHadAV5hFQitYd5CWwRoCP9s4pImrii/uaYOXC 3vHh61gTFnO6wd6xJk+5JtBWjyuxnFNgjgtJboH4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Maciej=20=C5=BBenczykowski?= , John Stultz , Alexander Potapenko , Alistair Delva , Daniel Borkmann , Yonghong Song Subject: [PATCH 4.19 105/116] bpf: Explicitly memset the bpf_attr structure Date: Wed, 1 Apr 2020 18:18:01 +0200 Message-Id: <20200401161555.630698707@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161542.669484650@linuxfoundation.org> References: <20200401161542.669484650@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Greg Kroah-Hartman commit 8096f229421f7b22433775e928d506f0342e5907 upstream. For the bpf syscall, we are relying on the compiler to properly zero out the bpf_attr union that we copy userspace data into. Unfortunately that doesn't always work properly, padding and other oddities might not be correctly zeroed, and in some tests odd things have been found when the stack is pre-initialized to other values. Fix this by explicitly memsetting the structure to 0 before using it. Reported-by: Maciej Żenczykowski Reported-by: John Stultz Reported-by: Alexander Potapenko Reported-by: Alistair Delva Signed-off-by: Greg Kroah-Hartman Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://android-review.googlesource.com/c/kernel/common/+/1235490 Link: https://lore.kernel.org/bpf/20200320094813.GA421650@kroah.com Signed-off-by: Greg Kroah-Hartman --- kernel/bpf/syscall.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -2372,7 +2372,7 @@ out: SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, size) { - union bpf_attr attr = {}; + union bpf_attr attr; int err; if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN)) @@ -2384,6 +2384,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf size = min_t(u32, size, sizeof(attr)); /* copy attributes from user space, may be less than sizeof(bpf_attr) */ + memset(&attr, 0, sizeof(attr)); if (copy_from_user(&attr, uattr, size) != 0) return -EFAULT;