Received: by 2002:a17:90a:1609:0:0:0:0 with SMTP id n9csp850302pja; Wed, 1 Apr 2020 09:49:34 -0700 (PDT) X-Google-Smtp-Source: APiQypIo+yUjzhzm1Cr8kf1VwLNZQFtjuhcZ5xNULzTymU47howjx/z3BZAi23lqK9awUnhtTJc9 X-Received: by 2002:aca:efd4:: with SMTP id n203mr3577794oih.159.1585759774676; Wed, 01 Apr 2020 09:49:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1585759774; cv=none; d=google.com; s=arc-20160816; b=sMj8+fxELCoMuz/kRlPomQivnAiYYr1xl9TP9dpN25KZi5WZnIr+tPr+xP53ViHlaA Wm2AXnMoSBJ7njhK5P5xrlP++a0iR7VvyamcUCJEjH0k44cYEdv5wC82vRAV1mzETp+C Vt1uaSLX6Q/1yyNf6zTx94WTVjmxE716imZzKp3KpQ3Ir1DIqGLTxSu1+KPbbBB2EpzU 9fzpu2O0eN9w6i3cxpPIRnTtkoLAC62btgoyuGo4FmCMHs7F6gFz2XVipa8rvwauDgQF uQmUcYx5bS4Yn02NxMb9AqLXiEd8KY5UsDxweDTzNO7USbrMYqzZ5OzOuIuhm/6j8O+w ZvLg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=ZT4j3/zvNzuYhAVe4ikBKhahdGU5UmM9ujCxw1cI4Do=; b=DRI0PQuBFWnbaqhMvP1//Aq4v9DpO8QpQ2vq81ItYu+h4xEZ8u9mHAknuYWTsn5ubH Glj+F7emMCCRqXo+9KucGv4q+CP6dQ6/9mixv9gbLvJLvrDSDOc4vUlJwgj2vCJVgdVj 4xfBQmOQiRva7PvivvZSXSiUzUSnUiVsVjl0jNDMliJkqt/WeECa1gyYiFvrQ76DfZZm 0PIbxJGgcAuJpOGa598xjHv5hTRBuKku5fscAXvndCuJb2y4yCzYn5nqsmaTJ6inGWcb wYn1csjZjlhoq0JaQ5u4eLwVBmkqTb9JdcUJ/c00lWqplLKkGqe81wn57YA9vYgAoorh bVSQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=kbeDJkFl; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id t2si984222otb.284.2020.04.01.09.49.21; Wed, 01 Apr 2020 09:49:34 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=kbeDJkFl; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389734AbgDAQsU (ORCPT + 99 others); Wed, 1 Apr 2020 12:48:20 -0400 Received: from mail.kernel.org ([198.145.29.99]:48768 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390024AbgDAQrG (ORCPT ); Wed, 1 Apr 2020 12:47:06 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 05C2420705; Wed, 1 Apr 2020 16:47:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759625; bh=HDBfyDI3oU4l6pCi6L0fG4nqaOCEBqvamVW1rdWlQQ4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kbeDJkFl8auA/6XUm4fa6nGsOSqLNOADuezHhPZfwl5krStoQtR2kngJ1UR+QgLBy FXMMluXD+/md92+2st1LfUPrrMwMewBYsmgrIaz/uL2cyP3xSykL8ovK4SJaoK6QZu jzvsnyFcqbb3flzxC8Rb5GF/gI4rpO96IrghB8bQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Maciej=20=C5=BBenczykowski?= , John Stultz , Alexander Potapenko , Alistair Delva , Daniel Borkmann , Yonghong Song Subject: [PATCH 4.14 139/148] bpf: Explicitly memset the bpf_attr structure Date: Wed, 1 Apr 2020 18:18:51 +0200 Message-Id: <20200401161605.547925593@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161552.245876366@linuxfoundation.org> References: <20200401161552.245876366@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Greg Kroah-Hartman commit 8096f229421f7b22433775e928d506f0342e5907 upstream. For the bpf syscall, we are relying on the compiler to properly zero out the bpf_attr union that we copy userspace data into. Unfortunately that doesn't always work properly, padding and other oddities might not be correctly zeroed, and in some tests odd things have been found when the stack is pre-initialized to other values. Fix this by explicitly memsetting the structure to 0 before using it. Reported-by: Maciej Żenczykowski Reported-by: John Stultz Reported-by: Alexander Potapenko Reported-by: Alistair Delva Signed-off-by: Greg Kroah-Hartman Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://android-review.googlesource.com/c/kernel/common/+/1235490 Link: https://lore.kernel.org/bpf/20200320094813.GA421650@kroah.com Signed-off-by: Greg Kroah-Hartman --- kernel/bpf/syscall.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1474,7 +1474,7 @@ static int bpf_obj_get_info_by_fd(const SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, size) { - union bpf_attr attr = {}; + union bpf_attr attr; int err; if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN)) @@ -1486,6 +1486,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf size = min_t(u32, size, sizeof(attr)); /* copy attributes from user space, may be less than sizeof(bpf_attr) */ + memset(&attr, 0, sizeof(attr)); if (copy_from_user(&attr, uattr, size) != 0) return -EFAULT;