[v2] RDMA/ucma: RDMA/ucma: fix a kernel-infoleak in ucma_init_qp_attr()

Commit Message

Dan Carpenter Feb. 4, 2022, 10 a.m. UTC

From: Haimin Zhang <[e-mail]>

The ib_copy_ah_attr_to_user() function only initializes "resp.grh" if
the "resp.is_global" flag is set.  Unfortunately, this data is copied to
the user and copying uninitialized stack data to the user is an
information leak.  Zero out the whole "resp" struct to be safe.

As a clean up, zero out both "resp" and "qp_attr" in the initializers.

[ This patch has been highly edited from the original that Haimin Zhang
  sent, so if there are any complaints please blame Dan Carpenter and
  Leon Romanovsky ]

Fixes: 4ba66093bdc6 ("IB/core: Check for global flag when using ah_attr")
Reported-by: TCS Robot <[e-mail]>
Signed-off-by: Haimin Zhang <[e-mail]>
Signed-off-by: Dan Carpenter <[e-mail]>
---
v2: Style changes

 drivers/infiniband/core/ucma.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

Comments

Jason Gunthorpe Feb. 4, 2022, 11:55 p.m. UTC | #1

On Fri, Feb 04, 2022 at 01:00:36PM +0300, Dan Carpenter wrote:
> From: Haimin Zhang <[e-mail]>
> 
> The ib_copy_ah_attr_to_user() function only initializes "resp.grh" if
> the "resp.is_global" flag is set.  Unfortunately, this data is copied to
> the user and copying uninitialized stack data to the user is an
> information leak.  Zero out the whole "resp" struct to be safe.

Hasn't this already been fixed, and more comprehensively too?

commit b35a0f4dd544eaa6162b6d2f13a2557a121ae5fd
Author: Leon Romanovsky <[e-mail]>
Date:   Tue Jan 4 14:21:52 2022 +0200

    RDMA/core: Don't infoleak GRH fields
    
    If dst->is_global field is not set, the GRH fields are not cleared
    and the following infoleak is reported.

Jason

Dan Carpenter Feb. 5, 2022, 9:11 a.m. UTC | #2

On Fri, Feb 04, 2022 at 07:55:59PM -0400, Jason Gunthorpe wrote:
> On Fri, Feb 04, 2022 at 01:00:36PM +0300, Dan Carpenter wrote:
> > From: Haimin Zhang <[e-mail]>
> > 
> > The ib_copy_ah_attr_to_user() function only initializes "resp.grh" if
> > the "resp.is_global" flag is set.  Unfortunately, this data is copied to
> > the user and copying uninitialized stack data to the user is an
> > information leak.  Zero out the whole "resp" struct to be safe.
> 
> Hasn't this already been fixed, and more comprehensively too?
> 
> commit b35a0f4dd544eaa6162b6d2f13a2557a121ae5fd
> Author: Leon Romanovsky <[e-mail]>
> Date:   Tue Jan 4 14:21:52 2022 +0200
> 
>     RDMA/core: Don't infoleak GRH fields
>     
>     If dst->is_global field is not set, the GRH fields are not cleared
>     and the following infoleak is reported.
> 
> Jason

That does fix the bug.  It's unfortunate that Haimin Zhang doesn't get
the reported by tag on this.  That was my screw up.  Sorry.

regards,
dan carpenter

Patch

diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 9d6ac9dff39a..4b90ee14b015 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1214,9 +1214,9 @@  static ssize_t ucma_init_qp_attr(struct ucma_file *file,
 				 int in_len, int out_len)
 {
 	struct rdma_ucm_init_qp_attr cmd;
-	struct ib_uverbs_qp_attr resp;
+	struct ib_uverbs_qp_attr resp = {};
 	struct ucma_context *ctx;
-	struct ib_qp_attr qp_attr;
+	struct ib_qp_attr qp_attr = {};
 	int ret;
 
 	if (out_len < sizeof(resp))
@@ -1232,8 +1232,6 @@  static ssize_t ucma_init_qp_attr(struct ucma_file *file,
 	if (IS_ERR(ctx))
 		return PTR_ERR(ctx);
 
-	resp.qp_attr_mask = 0;
-	memset(&qp_attr, 0, sizeof qp_attr);
 	qp_attr.qp_state = cmd.qp_state;
 	mutex_lock(&ctx->mutex);
 	ret = rdma_init_qp_attr(ctx->cm_id, &qp_attr, &resp.qp_attr_mask);