[Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

Andy Shevchenko andy.shevchenko at gmail.com
Fri Jul 31 06:29:27 UTC 2020


On Friday, July 31, 2020, Greg Kroah-Hartman <gregkh at linuxfoundation.org>
wrote:

> On Fri, Jul 31, 2020 at 07:33:06AM +0200, Greg Kroah-Hartman wrote:
> > On Fri, Jul 31, 2020 at 07:53:01AM +0300, Leon Romanovsky wrote:
> > > On Thu, Jul 30, 2020 at 03:20:26PM -0400, Peilin Ye wrote:
> > > > rds_notify_queue_get() is potentially copying uninitialized kernel
> stack
> > > > memory to userspace since the compiler may leave a 4-byte hole at
> the end
> > > > of `cmsg`.
> > > >
> > > > In 2016 we tried to fix this issue by doing `= { 0 };` on `cmsg`,
> which
> > > > unfortunately does not always initialize that 4-byte hole. Fix it by
> using
> > > > memset() instead.
> > >
> > > Of course, this is the difference between "{ 0 }" and "{}"
> initializations.
> >
> > Really?  Neither will handle structures with holes in it, try it and
> > see.


{} is a GCC extension, but I never thought it works differently.



>
> And if true, where in the C spec does it say that?
>
> thanks,
>
> greg k-h
>


-- 
With Best Regards,
Andy Shevchenko
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/linux-kernel-mentees/attachments/20200731/3f6aa43d/attachment.html>


More information about the Linux-kernel-mentees mailing list