Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-24 21:21:41 +00:00
Code Issues Packages Projects Releases Wiki Activity
f65a486821
linux/drivers/misc
History
Alexander Potapenko e5b0d06d9b misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() 
`struct vmci_event_qp` allocated by qp_notify_peer() contains padding,
which may carry uninitialized data to the userspace, as observed by
KMSAN:

  BUG: KMSAN: kernel-infoleak in instrument_copy_to_user ./include/linux/instrumented.h:121
   instrument_copy_to_user ./include/linux/instrumented.h:121
   _copy_to_user+0x5f/0xb0 lib/usercopy.c:33
   copy_to_user ./include/linux/uaccess.h:169
   vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:431
   vmci_host_unlocked_ioctl+0x33d/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:925
   vfs_ioctl fs/ioctl.c:51
  ...

  Uninit was stored to memory at:
   kmemdup+0x74/0xb0 mm/util.c:131
   dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:271
   vmci_datagram_dispatch+0x4f8/0xfc0 drivers/misc/vmw_vmci/vmci_datagram.c:339
   qp_notify_peer+0x19a/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1479
   qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662
   qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750
   vmci_qp_broker_alloc+0x96/0xd0 drivers/misc/vmw_vmci/vmci_queue_pair.c:1940
   vmci_host_do_alloc_queuepair drivers/misc/vmw_vmci/vmci_host.c:488
   vmci_host_unlocked_ioctl+0x24fd/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:927
  ...

  Local variable ev created at:
   qp_notify_peer+0x54/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1456
   qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662
   qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750

  Bytes 28-31 of 48 are uninitialized
  Memory access of size 48 starts at ffff888035155e00
  Data copied to user address 0000000020000100

Use memset() to prevent the infoleaks.

Also speculatively fix qp_notify_peer_local(), which may suffer from the
same problem.

Reported-by: syzbot+39be4da489ed2493ba25@syzkaller.appspotmail.com
Cc: stable <stable@kernel.org>
Fixes: 06164d2b72 ("VMCI: queue pairs implementation.")
Signed-off-by: Alexander Potapenko <glider@google.com>
Reviewed-by: Vishnu Dasa <vdasa@vmware.com>
Link: https://lore.kernel.org/r/20221104175849.2782567-1-glider@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-11-09 15:40:03 +01:00
..
altera-stapl misc: move from strlcpy with unused retval to strscpy 2022-09-01 16:29:42 +02:00
bcm-vk misc: bcm_vk: Remove usage of deprecated functions 2022-09-01 16:29:32 +02:00
c2port
cardreader Merge 5.19-rc6 into char-misc-next 2022-07-11 08:32:58 +02:00
cb710
cxl cxl: remove vma linked list walk 2022-09-26 19:46:20 -07:00
echo
eeprom Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
genwqe
habanalabs treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
ibmasm
lis3lv02d i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
lkdtm hardening updates for v6.1-rc1 2022-10-03 17:24:22 -07:00
mchp_pci1xxxx misc: microchip: pci1xxxx: Fix a memory leak in the error handling of gp_aux_bus_probe() 2022-09-22 16:54:35 +02:00
mei Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
ocxl misc: ocxl: fix possible refcount leak in afu_ioctl() 2022-09-01 16:29:50 +02:00
pvpanic misc/pvpanic: Convert regular spinlock into trylock on panic path 2022-04-29 16:54:59 +02:00
sgi-gru misc: sgi-gru: use explicitly signed char 2022-10-25 19:12:10 +02:00
sgi-xp drivers/misc/sgi-xp: Remove orphan declarations from drivers/misc/sgi-xp/xp.h 2022-09-24 14:57:19 +02:00
ti-st
uacce uacce: Handle parent device removal or parent driver module rmmod 2022-07-01 10:35:08 +02:00
vmw_vmci misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() 2022-11-09 15:40:03 +01:00
ad525x_dpot-i2c.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
ad525x_dpot-spi.c spi: make remove callback a void function 2022-02-09 13:00:45 +00:00
ad525x_dpot.c misc: ad525x_dpot: Make ad_dpot_remove() return void 2021-10-13 14:35:37 +02:00
ad525x_dpot.h misc: ad525x_dpot: Make ad_dpot_remove() return void 2021-10-13 14:35:37 +02:00
apds990x.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
apds9802als.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
atmel-ssc.c misc: update maintainer email address and description for atmel-ssc 2022-08-03 11:03:03 +02:00
bh1770glc.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
cs5535-mfgpt.c
ds1682.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
dummy-irq.c
dw-xdata-pcie.c
enclosure.c misc: enclosure: replace snprintf in show functions with sysfs_emit 2021-10-22 11:25:39 +02:00
fastrpc.c Merge 6.0-rc4 into char-misc-next 2022-09-05 07:53:56 +02:00
gehc-achc.c
hi6421v600-irq.c misc: hi6421-spmi-pmic: Use generic_handle_irq_safe(). 2022-03-02 22:28:50 +01:00
hisi_hikey_usb.c
hmc6352.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
hpilo.c
hpilo.h
ibmvmc.c ibmvmc: don't open-code file_inode() 2022-09-01 17:42:27 -04:00
ibmvmc.h
ics932s401.c Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
isl29003.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
isl29020.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
Kconfig misc: microchip: pci1xxxx: load auxiliary bus driver for the PIO function in the multi-function endpoint of pci1xxxx device. 2022-09-02 14:49:05 +02:00
kgdbts.c kgdbts: fix return value of __setup handler 2022-03-18 14:17:56 +01:00
lattice-ecp3-config.c spi: make remove callback a void function 2022-02-09 13:00:45 +00:00
Makefile misc: microchip: pci1xxxx: load auxiliary bus driver for the PIO function in the multi-function endpoint of pci1xxxx device. 2022-09-02 14:49:05 +02:00
open-dice.c misc: open-dice: Add driver to expose DICE data to userspace 2022-02-04 16:45:39 +01:00
pch_phub.c
pci_endpoint_test.c misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic 2022-09-09 10:24:12 +02:00
phantom.c
qcom-coincell.c
sram-exec.c treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_320.RULE 2022-06-10 14:51:36 +02:00
sram.c misc: sram: Add compatible string for Tegra234 SYSRAM 2021-12-08 15:16:05 +01:00
sram.h
tifm_7xx1.c
tifm_core.c
tsl2550.c i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
vcpu_stall_detector.c misc: Add a mechanism to detect stalls on guest vCPUs 2022-07-14 16:54:17 +02:00
vmw_balloon.c - The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe 2022-08-05 16:32:45 -07:00
xilinx_sdfec.c misc/xilinx_sdfec: Replace kmap() with kmap_local_page() 2022-09-09 10:22:36 +02:00