mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-29 22:14:41 +08:00
e5b0d06d9b
`struct vmci_event_qp` allocated by qp_notify_peer() contains padding,
which may carry uninitialized data to the userspace, as observed by
KMSAN:
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user ./include/linux/instrumented.h:121
instrument_copy_to_user ./include/linux/instrumented.h:121
_copy_to_user+0x5f/0xb0 lib/usercopy.c:33
copy_to_user ./include/linux/uaccess.h:169
vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:431
vmci_host_unlocked_ioctl+0x33d/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:925
vfs_ioctl fs/ioctl.c:51
...
Uninit was stored to memory at:
kmemdup+0x74/0xb0 mm/util.c:131
dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:271
vmci_datagram_dispatch+0x4f8/0xfc0 drivers/misc/vmw_vmci/vmci_datagram.c:339
qp_notify_peer+0x19a/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1479
qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662
qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750
vmci_qp_broker_alloc+0x96/0xd0 drivers/misc/vmw_vmci/vmci_queue_pair.c:1940
vmci_host_do_alloc_queuepair drivers/misc/vmw_vmci/vmci_host.c:488
vmci_host_unlocked_ioctl+0x24fd/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:927
...
Local variable ev created at:
qp_notify_peer+0x54/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1456
qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662
qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750
Bytes 28-31 of 48 are uninitialized
Memory access of size 48 starts at ffff888035155e00
Data copied to user address 0000000020000100
Use memset() to prevent the infoleaks.
Also speculatively fix qp_notify_peer_local(), which may suffer from the
same problem.
Reported-by: syzbot+39be4da489ed2493ba25@syzkaller.appspotmail.com
Cc: stable <stable@kernel.org>
Fixes:
|
||
---|---|---|
.. | ||
altera-stapl | ||
bcm-vk | ||
c2port | ||
cardreader | ||
cb710 | ||
cxl | ||
echo | ||
eeprom | ||
genwqe | ||
habanalabs | ||
ibmasm | ||
lis3lv02d | ||
lkdtm | ||
mchp_pci1xxxx | ||
mei | ||
ocxl | ||
pvpanic | ||
sgi-gru | ||
sgi-xp | ||
ti-st | ||
uacce | ||
vmw_vmci | ||
ad525x_dpot-i2c.c | ||
ad525x_dpot-spi.c | ||
ad525x_dpot.c | ||
ad525x_dpot.h | ||
apds990x.c | ||
apds9802als.c | ||
atmel-ssc.c | ||
bh1770glc.c | ||
cs5535-mfgpt.c | ||
ds1682.c | ||
dummy-irq.c | ||
dw-xdata-pcie.c | ||
enclosure.c | ||
fastrpc.c | ||
gehc-achc.c | ||
hi6421v600-irq.c | ||
hisi_hikey_usb.c | ||
hmc6352.c | ||
hpilo.c | ||
hpilo.h | ||
ibmvmc.c | ||
ibmvmc.h | ||
ics932s401.c | ||
isl29003.c | ||
isl29020.c | ||
Kconfig | ||
kgdbts.c | ||
lattice-ecp3-config.c | ||
Makefile | ||
open-dice.c | ||
pch_phub.c | ||
pci_endpoint_test.c | ||
phantom.c | ||
qcom-coincell.c | ||
sram-exec.c | ||
sram.c | ||
sram.h | ||
tifm_7xx1.c | ||
tifm_core.c | ||
tsl2550.c | ||
vcpu_stall_detector.c | ||
vmw_balloon.c | ||
xilinx_sdfec.c |