Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-08-14 Thread Jason Gunthorpe
On Sat, Aug 08, 2020 at 03:57:33PM -0700, Jack Leadford wrote: > Hello! > > Thanks to Jason for getting this conversation back on track. > > Yes: in general, {} or a partial initializer /will/ zero padding bits. > > However, there is a bug in some versions of GCC where {} will /not/ zero >

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-08-09 Thread Leon Romanovsky
On Sat, Aug 08, 2020 at 03:57:33PM -0700, Jack Leadford wrote: > Hello! > > Thanks to Jason for getting this conversation back on track. > > Yes: in general, {} or a partial initializer /will/ zero padding bits. > > However, there is a bug in some versions of GCC where {} will /not/ zero > padding

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-08-08 Thread Jack Leadford
Hello! Thanks to Jason for getting this conversation back on track. Yes: in general, {} or a partial initializer /will/ zero padding bits. However, there is a bug in some versions of GCC where {} will /not/ zero padding bits; actually, Jason's test program in this mail

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-08-03 Thread Jason Gunthorpe
On Sun, Aug 02, 2020 at 03:45:40PM -0700, Joe Perches wrote: > On Sun, 2020-08-02 at 19:28 -0300, Jason Gunthorpe wrote: > > On Sun, Aug 02, 2020 at 03:23:58PM -0700, Joe Perches wrote: > > > On Sun, 2020-08-02 at 19:10 -0300, Jason Gunthorpe wrote: > > > > On Sat, Aug 01, 2020 at 08:38:33AM

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-08-03 Thread Dan Carpenter
Ah, thanks. We've had a bunch of discussions about these leaks but I wasn't aware of this. regards, dan carpenter

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-08-02 Thread Leon Romanovsky
On Sun, Aug 02, 2020 at 03:45:40PM -0700, Joe Perches wrote: > On Sun, 2020-08-02 at 19:28 -0300, Jason Gunthorpe wrote: > > On Sun, Aug 02, 2020 at 03:23:58PM -0700, Joe Perches wrote: > > > On Sun, 2020-08-02 at 19:10 -0300, Jason Gunthorpe wrote: > > > > On Sat, Aug 01, 2020 at 08:38:33AM

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-08-02 Thread Joe Perches
On Sun, 2020-08-02 at 19:28 -0300, Jason Gunthorpe wrote: > On Sun, Aug 02, 2020 at 03:23:58PM -0700, Joe Perches wrote: > > On Sun, 2020-08-02 at 19:10 -0300, Jason Gunthorpe wrote: > > > On Sat, Aug 01, 2020 at 08:38:33AM +0300, Leon Romanovsky wrote: > > > > > > > I'm using {} instead of {0}

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-08-02 Thread Jason Gunthorpe
On Sun, Aug 02, 2020 at 03:23:58PM -0700, Joe Perches wrote: > On Sun, 2020-08-02 at 19:10 -0300, Jason Gunthorpe wrote: > > On Sat, Aug 01, 2020 at 08:38:33AM +0300, Leon Romanovsky wrote: > > > > > I'm using {} instead of {0} because of this GCC bug. > > >

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-08-02 Thread Joe Perches
On Sun, 2020-08-02 at 19:10 -0300, Jason Gunthorpe wrote: > On Sat, Aug 01, 2020 at 08:38:33AM +0300, Leon Romanovsky wrote: > > > I'm using {} instead of {0} because of this GCC bug. > > https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53119 > > This is why the {} extension exists.. There is no

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-08-02 Thread Jason Gunthorpe
On Sat, Aug 01, 2020 at 08:38:33AM +0300, Leon Romanovsky wrote: > I'm using {} instead of {0} because of this GCC bug. > https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53119 This is why the {} extension exists.. Jason

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-08-01 Thread Jason Gunthorpe
On Sat, Aug 01, 2020 at 11:00:26AM +0300, Dan Carpenter wrote: > > Without an actual example where this doesn't work right it is hard to > > say anything more.. > > Here is the example that set off the recent patches: > > https://lkml.org/lkml/2020/7/27/199 Oh, that is something completely

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-08-01 Thread Dan Carpenter
On Fri, Jul 31, 2020 at 03:27:12PM -0300, Jason Gunthorpe wrote: > On Fri, Jul 31, 2020 at 07:19:24PM +0200, Greg Kroah-Hartman wrote: > > > > I tried for a bit and didn't find a way to get even old gcc 4.4 to not > > > initialize the holes. > > > > Odd, so it is just the "= {0};" that does not

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-31 Thread Leon Romanovsky
On Fri, Jul 31, 2020 at 07:19:24PM +0200, Greg Kroah-Hartman wrote: > On Fri, Jul 31, 2020 at 11:36:04AM -0300, Jason Gunthorpe wrote: > > On Fri, Jul 31, 2020 at 04:21:48PM +0200, Greg Kroah-Hartman wrote: > > > > > > The spec was updated in C11 to require zero'ing padding when doing > > > >

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-31 Thread David Miller
From: Peilin Ye Date: Thu, 30 Jul 2020 15:20:26 -0400 > rds_notify_queue_get() is potentially copying uninitialized kernel stack > memory to userspace since the compiler may leave a 4-byte hole at the end > of `cmsg`. > > In 2016 we tried to fix this issue by doing `= { 0 };` on `cmsg`, which >

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-31 Thread Jason Gunthorpe
On Fri, Jul 31, 2020 at 07:19:24PM +0200, Greg Kroah-Hartman wrote: > > I tried for a bit and didn't find a way to get even old gcc 4.4 to not > > initialize the holes. > > Odd, so it is just the "= {0};" that does not zero out the holes? Nope, it seems to work fine too. I tried a number of

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-31 Thread Greg Kroah-Hartman
On Fri, Jul 31, 2020 at 11:36:04AM -0300, Jason Gunthorpe wrote: > On Fri, Jul 31, 2020 at 04:21:48PM +0200, Greg Kroah-Hartman wrote: > > > > The spec was updated in C11 to require zero'ing padding when doing > > > partial initialization of aggregates (eg = {}) > > > > > > """if it is an

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-31 Thread Jason Gunthorpe
On Fri, Jul 31, 2020 at 04:21:48PM +0200, Greg Kroah-Hartman wrote: > > The spec was updated in C11 to require zero'ing padding when doing > > partial initialization of aggregates (eg = {}) > > > > """if it is an aggregate, every member is initialized (recursively) > > according to these rules,

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-31 Thread Greg Kroah-Hartman
On Fri, Jul 31, 2020 at 11:04:52AM -0300, Jason Gunthorpe wrote: > On Fri, Jul 31, 2020 at 07:33:33AM +0200, Greg Kroah-Hartman wrote: > > On Fri, Jul 31, 2020 at 07:33:06AM +0200, Greg Kroah-Hartman wrote: > > > On Fri, Jul 31, 2020 at 07:53:01AM +0300, Leon Romanovsky wrote: > > > > On Thu, Jul

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-31 Thread Jason Gunthorpe
On Fri, Jul 31, 2020 at 07:33:33AM +0200, Greg Kroah-Hartman wrote: > On Fri, Jul 31, 2020 at 07:33:06AM +0200, Greg Kroah-Hartman wrote: > > On Fri, Jul 31, 2020 at 07:53:01AM +0300, Leon Romanovsky wrote: > > > On Thu, Jul 30, 2020 at 03:20:26PM -0400, Peilin Ye wrote: > > > >

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-31 Thread Håkon Bugge
> On 31 Jul 2020, at 13:59, Greg Kroah-Hartman > wrote: > > On Fri, Jul 31, 2020 at 01:14:09PM +0200, Håkon Bugge wrote: >> >> >>> On 31 Jul 2020, at 11:59, Dan Carpenter wrote: >>> >>> On Fri, Jul 31, 2020 at 07:53:01AM +0300, Leon Romanovsky wrote: On Thu, Jul 30, 2020 at

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-31 Thread Greg Kroah-Hartman
On Fri, Jul 31, 2020 at 01:14:09PM +0200, Håkon Bugge wrote: > > > > On 31 Jul 2020, at 11:59, Dan Carpenter wrote: > > > > On Fri, Jul 31, 2020 at 07:53:01AM +0300, Leon Romanovsky wrote: > >> On Thu, Jul 30, 2020 at 03:20:26PM -0400, Peilin Ye wrote: > >>> rds_notify_queue_get() is

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-31 Thread Håkon Bugge
> On 31 Jul 2020, at 11:59, Dan Carpenter wrote: > > On Fri, Jul 31, 2020 at 07:53:01AM +0300, Leon Romanovsky wrote: >> On Thu, Jul 30, 2020 at 03:20:26PM -0400, Peilin Ye wrote: >>> rds_notify_queue_get() is potentially copying uninitialized kernel stack >>> memory to userspace since the

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-31 Thread Dan Carpenter
On Fri, Jul 31, 2020 at 07:53:01AM +0300, Leon Romanovsky wrote: > On Thu, Jul 30, 2020 at 03:20:26PM -0400, Peilin Ye wrote: > > rds_notify_queue_get() is potentially copying uninitialized kernel stack > > memory to userspace since the compiler may leave a 4-byte hole at the end > > of `cmsg`. >

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-31 Thread Andy Shevchenko
Sakari, JFYI. I remember during some reviews we have a discussion about {0} vs {} and surprisingly they are not an equivalent. On Fri, Jul 31, 2020 at 10:00 AM Leon Romanovsky wrote: > On Fri, Jul 31, 2020 at 09:29:27AM +0300, Andy Shevchenko wrote: > > On Friday, July 31, 2020, Greg

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-31 Thread Leon Romanovsky
On Fri, Jul 31, 2020 at 09:29:27AM +0300, Andy Shevchenko wrote: > On Friday, July 31, 2020, Greg Kroah-Hartman > wrote: > > > On Fri, Jul 31, 2020 at 07:33:06AM +0200, Greg Kroah-Hartman wrote: > > > On Fri, Jul 31, 2020 at 07:53:01AM +0300, Leon Romanovsky wrote: > > > > On Thu, Jul 30, 2020 at

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-30 Thread Greg Kroah-Hartman
On Fri, Jul 31, 2020 at 07:53:01AM +0300, Leon Romanovsky wrote: > On Thu, Jul 30, 2020 at 03:20:26PM -0400, Peilin Ye wrote: > > rds_notify_queue_get() is potentially copying uninitialized kernel stack > > memory to userspace since the compiler may leave a 4-byte hole at the end > > of `cmsg`. >

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-30 Thread Greg Kroah-Hartman
On Fri, Jul 31, 2020 at 07:33:06AM +0200, Greg Kroah-Hartman wrote: > On Fri, Jul 31, 2020 at 07:53:01AM +0300, Leon Romanovsky wrote: > > On Thu, Jul 30, 2020 at 03:20:26PM -0400, Peilin Ye wrote: > > > rds_notify_queue_get() is potentially copying uninitialized kernel stack > > > memory to

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-30 Thread Leon Romanovsky
On Thu, Jul 30, 2020 at 03:20:26PM -0400, Peilin Ye wrote: > rds_notify_queue_get() is potentially copying uninitialized kernel stack > memory to userspace since the compiler may leave a 4-byte hole at the end > of `cmsg`. > > In 2016 we tried to fix this issue by doing `= { 0 };` on `cmsg`, which

Re: [Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-30 Thread santosh.shilim...@oracle.com
On 7/30/20 12:20 PM, Peilin Ye wrote: rds_notify_queue_get() is potentially copying uninitialized kernel stack memory to userspace since the compiler may leave a 4-byte hole at the end of `cmsg`. In 2016 we tried to fix this issue by doing `= { 0 };` on `cmsg`, which unfortunately does not

[Linux-kernel-mentees] [PATCH net] rds: Prevent kernel-infoleak in rds_notify_queue_get()

2020-07-30 Thread Peilin Ye
rds_notify_queue_get() is potentially copying uninitialized kernel stack memory to userspace since the compiler may leave a 4-byte hole at the end of `cmsg`. In 2016 we tried to fix this issue by doing `= { 0 };` on `cmsg`, which unfortunately does not always initialize that 4-byte hole. Fix it