net/smc: Prevent kernel-infoleak in __smc_diag_dump() (ce51f63e) · Commits · 戴 / test

__smc_diag_dump() is potentially copying uninitialized kernel stack memory into socket buffers, since the compiler may leave a 4-byte hole near the beginning of `struct smcd_diag_dmbinfo`. Fix it by initializing `dinfo` with memset(). Fixes: ("net/smc: add SMC-D diag support") Suggested-by:

Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:

Peilin Ye <yepeilin.cs@gmail.com> Signed-off-by:

Ursula Braun <ubraun@linux.ibm.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/smc/smc_diag.c

+9 −7

Original line number	Diff line number	Diff line
		@@ -170,13 +170,15 @@ static int __smc_diag_dump(struct sock sk, struct sk_buff skb,
		(req->diag_ext & (1 << (SMC_DIAG_DMBINFO - 1))) &&
		!list_empty(&smc->conn.lgr->list)) {
		struct smc_connection *conn = &smc->conn;
		struct smcd_diag_dmbinfo dinfo = {
		.linkid = ((u32 )conn->lgr->id),
		.peer_gid = conn->lgr->peer_gid,
		.my_gid = conn->lgr->smcd->local_gid,
		.token = conn->rmb_desc->token,
		.peer_token = conn->peer_token
		};
		struct smcd_diag_dmbinfo dinfo;

		memset(&dinfo, 0, sizeof(dinfo));

		dinfo.linkid = ((u32 )conn->lgr->id);
		dinfo.peer_gid = conn->lgr->peer_gid;
		dinfo.my_gid = conn->lgr->smcd->local_gid;
		dinfo.token = conn->rmb_desc->token;
		dinfo.peer_token = conn->peer_token;

		if (nla_put(skb, SMC_DIAG_DMBINFO, sizeof(dinfo), &dinfo) < 0)
		goto errout;

Admin message