diff mbox series

[SRU,Mantic,1/1] accel/habanalabs: fix information leak in sec_attest_info()

Message ID 20240206213012.55794-2-bethany.jamison@canonical.com
State New
Headers show
Series CVE-2023-50431 | expand

Commit Message

Bethany Jamison Feb. 6, 2024, 9:30 p.m. UTC 
From: Xingyuan Mo <hdthky0@gmail.com>

This function may copy the pad0 field of struct hl_info_sec_attest to user
mode which has not been initialized, resulting in leakage of kernel heap
data to user mode. To prevent this, use kzalloc() to allocate and zero out
the buffer, which can also eliminate other uninitialized holes, if any.

Fixes: 0c88760f8f5e ("habanalabs/gaudi2: add secured attestation info uapi")
Signed-off-by: Xingyuan Mo <hdthky0@gmail.com>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
(cherry picked from commit a9f07790a4b2250f0140e9a61c7f842fd9b618c7)
CVE-2023-50431
Signed-off-by: Bethany Jamison <bethany.jamison@canonical.com>
---
 drivers/accel/habanalabs/common/habanalabs_ioctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/accel/habanalabs/common/habanalabs_ioctl.c b/drivers/accel/habanalabs/common/habanalabs_ioctl.c
index 6a45a92344e9b..a7f6c54c123ef 100644
--- a/drivers/accel/habanalabs/common/habanalabs_ioctl.c
+++ b/drivers/accel/habanalabs/common/habanalabs_ioctl.c
@@ -682,7 +682,7 @@  static int sec_attest_info(struct hl_fpriv *hpriv, struct hl_info_args *args)
 	if (!sec_attest_info)
 		return -ENOMEM;
 
-	info = kmalloc(sizeof(*info), GFP_KERNEL);
+	info = kzalloc(sizeof(*info), GFP_KERNEL);
 	if (!info) {
 		rc = -ENOMEM;
 		goto free_sec_attest_info;