Peilin Ye d634bc2bd9 rds: Prevent kernel-infoleak in rds_notify_queue_get() ...

commit bbc8a99e95 upstream.

rds_notify_queue_get() is potentially copying uninitialized kernel stack
memory to userspace since the compiler may leave a 4-byte hole at the end
of `cmsg`.

In 2016 we tried to fix this issue by doing `= { 0 };` on `cmsg`, which
unfortunately does not always initialize that 4-byte hole. Fix it by using
memset() instead.

Cc: stable@vger.kernel.org
Fixes: f037590fff ("rds: fix a leak of kernel memory")
Fixes: bdbe6fbc6a ("RDS: recv.c")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-05-16 08:44:05 +09:00

..

af_rds.c

RDS: Add support for SO_TIMESTAMP for incoming messages

2016-03-02 14:13:17 -05:00

bind.c

rds: fix refcount bug in rds_sock_addref

2023-05-15 11:23:46 +09:00

cong.c

RDS: split out connection specific state from rds_connection to rds_conn_path

2016-06-14 23:50:41 -07:00

connection.c

RDS: TCP: Enable multipath RDS for TCP

2016-07-15 11:36:58 -07:00

ib_cm.c

rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp

2023-05-15 09:13:01 +09:00

ib_fmr.c

net: rds: exchange of 8K and 1M pool

2023-05-15 12:36:06 +09:00

ib_frmr.c

RDS: IB: fix 'passing zero to ERR_PTR()' warning

2023-05-12 17:26:57 +09:00

ib_mr.h

RDS: IB: Support Fastreg MR (FRMR) memory registration mode

2016-03-02 14:13:19 -05:00

ib_rdma.c

net: rds: fix memory leak in rds_ib_flush_mr_pool

2023-05-15 13:40:49 +09:00

ib_recv.c

RDS: TCP: make receive path use the rds_conn_path

2016-07-01 16:45:17 -04:00

ib_ring.c

RDS/IW+IB: Set recv ring low water mark to 1/2 full.

2009-04-09 17:21:14 -07:00

ib_send.c

RDS: RDMA: Fix the composite message user notification

2017-10-08 10:26:02 +02:00

ib_stats.c

net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'

2023-05-15 16:46:43 +09:00

ib_sysctl.c

net: Convert uses of typedef ctl_table to struct ctl_table

2013-06-13 02:36:09 -07:00

ib.c

net/rds: Fix error handling in rds_ib_add_one()

2023-05-15 14:41:34 +09:00

ib.h

RDS: add __printf format attribute to error reporting functions

2016-08-08 16:16:21 -07:00

info.c

rds: fix an integer overflow test in rds_info_getsockopt()

2015-08-03 15:20:16 -07:00

info.h

RDS: Info and stats

2009-02-26 23:39:25 -08:00

Kconfig

RDS: Drop stale iWARP RDMA transport

2016-03-02 14:13:17 -05:00

loop.c

rds: avoid unenecessary cong_update in loop transport

2023-05-12 16:29:45 +09:00

loop.h

RDS: loopback

2009-02-26 23:39:26 -08:00

Makefile

rds: debug messages are enabled by default

2016-10-29 15:55:57 -04:00

message.c

RDS: TCP: Enable multipath RDS for TCP

2016-07-15 11:36:58 -07:00

page.c

RDS: memory allocated must be align to 8

2016-04-07 16:58:27 -04:00

rdma_transport.c

RDS: split out connection specific state from rds_connection to rds_conn_path

2016-06-14 23:50:41 -07:00

rdma_transport.h

RDS: Drop stale iWARP RDMA transport

2016-03-02 14:13:17 -05:00

rdma.c

RDS: null pointer dereference in rds_atomic_free_op

2018-01-17 09:38:53 +01:00

rds_single_path.h

RDS: split out connection specific state from rds_connection to rds_conn_path

2016-06-14 23:50:41 -07:00

rds.h

rds: avoid unenecessary cong_update in loop transport

2023-05-12 16:29:45 +09:00

recv.c

rds: Prevent kernel-infoleak in rds_notify_queue_get()

2023-05-16 08:44:05 +09:00

send.c

rds: MP-RDS may use an invalid c_path

2018-04-20 08:21:07 +02:00

stats.c

net/rds: zero last byte for strncpy

2013-03-08 00:35:44 -05:00

sysctl.c

net: rds: fix coding style issues

2016-06-18 21:34:09 -07:00

tcp_connect.c

RDS: TCP: Enable multipath RDS for TCP

2016-07-15 11:36:58 -07:00

tcp_listen.c

rds: tcp: Sequence teardown of listen and acceptor sockets to avoid races

2017-12-14 09:28:20 +01:00

tcp_recv.c

RDS: TCP: make receive path use the rds_conn_path

2016-07-01 16:45:17 -04:00

tcp_send.c

RDS: TCP: Enable multipath RDS for TCP

2016-07-15 11:36:58 -07:00

tcp_stats.c

net: rds: fix const array syntax

2011-07-01 16:16:19 -07:00

tcp.c

net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock().

2023-05-15 12:22:33 +09:00

tcp.h

rds: tcp: atomically purge entries from rds_tcp_conn_list during netns delete

2018-02-25 11:05:43 +01:00

threads.c

RDS: TCP: Enable multipath RDS for TCP

2016-07-15 11:36:58 -07:00

transport.c

net: rds: fix coding style issues

2016-06-18 21:34:09 -07:00