Re: [PATCH] UserfaultFD: Fix stack corruption when zeroing uffd_msg

From: Andrea Arcangeli <aarcange@redhat.com>
To: Pavel Emelyanov <xemul@parallels.com>
Cc: Linux MM <linux-mm@kvack.org>
Subject: Re: [PATCH] UserfaultFD: Fix stack corruption when zeroing uffd_msg
Date: Fri, 8 May 2015 19:54:15 +0200	[thread overview]
Message-ID: <20150508175415.GB16508@redhat.com> (raw)
In-Reply-To: <554CC31F.9050509@parallels.com>

On Fri, May 08, 2015 at 05:07:27PM +0300, Pavel Emelyanov wrote:
> 
> Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
> 
> ---
> 
> diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
> index 026ef99..c89e96f 100644
> --- a/fs/userfaultfd.c
> +++ b/fs/userfaultfd.c
> @@ -134,7 +134,7 @@ static inline void msg_init(struct uffd_msg *msg)
>  	 * Must use memset to zero out the paddings or kernel data is
>  	 * leaked to userland.
>  	 */
> -	memset(&msg, 0, sizeof(struct uffd_msg));
> +	memset(msg, 0, sizeof(struct uffd_msg));

Applied (folded). The memset was originally inline in userfault_msg,
when I introduced msg_init the compiler didn't warn of the & that had
to be removed as it's now called as:

	msg_init(&msg);

All right thanks!

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>