4.14-stable patches

added patches:
	rds-prevent-kernel-infoleak-in-rds_notify_queue_get.patch

diff --git a/queue-4.14/rds-prevent-kernel-infoleak-in-rds_notify_queue_get.patch b/queue-4.14/rds-prevent-kernel-infoleak-in-rds_notify_queue_get.patch
new file mode 100644 (file)
index 0000000..ddbb34c
--- /dev/null
+++ b/queue-4.14/rds-prevent-kernel-infoleak-in-rds_notify_queue_get.patch
@@ -0,0 +1,47 @@
+From bbc8a99e952226c585ac17477a85ef1194501762 Mon Sep 17 00:00:00 2001
+From: Peilin Ye <yepeilin.cs@gmail.com>
+Date: Thu, 30 Jul 2020 15:20:26 -0400
+Subject: rds: Prevent kernel-infoleak in rds_notify_queue_get()
+
+From: Peilin Ye <yepeilin.cs@gmail.com>
+
+commit bbc8a99e952226c585ac17477a85ef1194501762 upstream.
+
+rds_notify_queue_get() is potentially copying uninitialized kernel stack
+memory to userspace since the compiler may leave a 4-byte hole at the end
+of `cmsg`.
+
+In 2016 we tried to fix this issue by doing `= { 0 };` on `cmsg`, which
+unfortunately does not always initialize that 4-byte hole. Fix it by using
+memset() instead.
+
+Cc: stable@vger.kernel.org
+Fixes: f037590fff30 ("rds: fix a leak of kernel memory")
+Fixes: bdbe6fbc6a2f ("RDS: recv.c")
+Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/rds/recv.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/rds/recv.c
++++ b/net/rds/recv.c
+@@ -453,12 +453,13 @@ static int rds_still_queued(struct rds_s
+ int rds_notify_queue_get(struct rds_sock *rs, struct msghdr *msghdr)
+ {
+       struct rds_notifier *notifier;
+-      struct rds_rdma_notify cmsg = { 0 }; /* fill holes with zero */
++      struct rds_rdma_notify cmsg;
+       unsigned int count = 0, max_messages = ~0U;
+       unsigned long flags;
+       LIST_HEAD(copy);
+       int err = 0;
+ 
++      memset(&cmsg, 0, sizeof(cmsg)); /* fill holes with zero */
+ 
+       /* put_cmsg copies to user space and thus may sleep. We can't do this
+        * with rs_lock held, so first grab as many notifications as we can stuff

diff --git a/queue-4.14/series b/queue-4.14/series
index 9fa780a45a1d81f13a733073420d63234f528fd5..933b40ec9b633f5bf7593a08a76059abdc045248 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -21,3 +21,4 @@ random32-remove-net_rand_state-from-the-latent-entropy-gcc-plugin.patch
 9p-trans_fd-fix-concurrency-del-of-req_list-in-p9_fd.patch
 x86-build-lto-fix-truncated-.bss-with-fdata-sections.patch
 x86-vmlinux.lds-page-align-end-of-.page_aligned-sect.patch
+rds-prevent-kernel-infoleak-in-rds_notify_queue_get.patch