[f2fs-dev] [PATCH] f2fs: fix leaking uninitialized memory in compressed clusters

[f2fs-dev] [PATCH] f2fs: fix leaking uninitialized memory in compressed clusters

[Eric Biggers]

From: Eric Biggers <ebiggers@google.com>

When the compressed data of a cluster doesn't end on a page boundary,
the remainder of the last page must be zeroed in order to avoid leaking
uninitialized memory to disk.

Fixes: 4c8ff7095bef ("f2fs: support data compression")
Signed-off-by: Eric Biggers <ebiggers@google.com>
---
 fs/f2fs/compress.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index d8a64be90a501..ef7dd04312fed 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -385,11 +385,15 @@ static int f2fs_compress_pages(struct compress_ctx *cc)
 	for (i = 0; i < COMPRESS_DATA_RESERVED_SIZE; i++)
 		cc->cbuf->reserved[i] = cpu_to_le32(0);
 
+	nr_cpages = DIV_ROUND_UP(cc->clen + COMPRESS_HEADER_SIZE, PAGE_SIZE);
+
+	/* zero out any unused part of the last page */
+	memset(&cc->cbuf->cdata[cc->clen], 0,
+	       (nr_cpages * PAGE_SIZE) - (cc->clen + COMPRESS_HEADER_SIZE));
+
 	vunmap(cc->cbuf);
 	vunmap(cc->rbuf);
 
-	nr_cpages = DIV_ROUND_UP(cc->clen + COMPRESS_HEADER_SIZE, PAGE_SIZE);
-
 	for (i = nr_cpages; i < cc->nr_cpages; i++) {
 		f2fs_put_compressed_page(cc->cpages[i]);
 		cc->cpages[i] = NULL;
-- 
2.25.1



_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

Re: [f2fs-dev] [PATCH] f2fs: fix leaking uninitialized memory in compressed clusters

[Chao Yu]

On 2020/2/21 12:50, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@google.com>
> 
> When the compressed data of a cluster doesn't end on a page boundary,
> the remainder of the last page must be zeroed in order to avoid leaking
> uninitialized memory to disk.
> 
> Fixes: 4c8ff7095bef ("f2fs: support data compression")
> Signed-off-by: Eric Biggers <ebiggers@google.com>

Reviewed-by: Chao Yu <yuchao0@huawei.com>

Thanks,


_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

Re: [f2fs-dev] [PATCH] f2fs: fix leaking uninitialized memory in compressed clusters

[Eric Biggers]

On Tue, Feb 25, 2020 at 04:53:02PM +0800, Chao Yu wrote:
> On 2020/2/21 12:50, Eric Biggers wrote:
> > From: Eric Biggers <ebiggers@google.com>
> > 
> > When the compressed data of a cluster doesn't end on a page boundary,
> > the remainder of the last page must be zeroed in order to avoid leaking
> > uninitialized memory to disk.
> > 
> > Fixes: 4c8ff7095bef ("f2fs: support data compression")
> > Signed-off-by: Eric Biggers <ebiggers@google.com>
> 
> Reviewed-by: Chao Yu <yuchao0@huawei.com>
> 

Jaegeuk, can you send this fix to Linus for 5.6?

- Eric


_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

Re: [f2fs-dev] [PATCH] f2fs: fix leaking uninitialized memory in compressed clusters

[Jaegeuk Kim]

On 02/27, Eric Biggers wrote:
> On Tue, Feb 25, 2020 at 04:53:02PM +0800, Chao Yu wrote:
> > On 2020/2/21 12:50, Eric Biggers wrote:
> > > From: Eric Biggers <ebiggers@google.com>
> > > 
> > > When the compressed data of a cluster doesn't end on a page boundary,
> > > the remainder of the last page must be zeroed in order to avoid leaking
> > > uninitialized memory to disk.
> > > 
> > > Fixes: 4c8ff7095bef ("f2fs: support data compression")
> > > Signed-off-by: Eric Biggers <ebiggers@google.com>
> > 
> > Reviewed-by: Chao Yu <yuchao0@huawei.com>
> > 
> 
> Jaegeuk, can you send this fix to Linus for 5.6?

Okay.

> 
> - Eric


_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel