linux-mm.kvack.org archive mirror
 help / color / mirror / Atom feed
From: Andrew Morton <akpm@linux-foundation.org>
To: adobriyan@gmail.com, akpm@linux-foundation.org,
	glider@google.com, keescook@chromium.org, linux-mm@kvack.org,
	mm-commits@vger.kernel.org, stable@vger.kernel.org,
	sunhaoyl@outlook.com, torvalds@linux-foundation.org,
	viro@zeniv.linux.org.uk
Subject: [patch 4/5] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
Date: Wed, 27 May 2020 22:20:52 -0700	[thread overview]
Message-ID: <20200528052052.tLpI_z4pp%akpm@linux-foundation.org> (raw)
In-Reply-To: <20200527222015.62ba8592af63dae12ab58ffe@linux-foundation.org>

From: Alexander Potapenko <glider@google.com>
Subject: fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()

KMSAN reported uninitialized data being written to disk when dumping core.
As a result, several kilobytes of kmalloc memory may be written to the
core file and then read by a non-privileged user.

Link: http://lkml.kernel.org/r/20200419100848.63472-1-glider@google.com
Link: https://github.com/google/kmsan/issues/76
Signed-off-by: Alexander Potapenko <glider@google.com>
Reported-by: sam <sunhaoyl@outlook.com>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/binfmt_elf.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/binfmt_elf.c~fs-binfmt_elfc-allocate-initialized-memory-in-fill_thread_core_info
+++ a/fs/binfmt_elf.c
@@ -1733,7 +1733,7 @@ static int fill_thread_core_info(struct
 		    (!regset->active || regset->active(t->task, regset) > 0)) {
 			int ret;
 			size_t size = regset_size(t->task, regset);
-			void *data = kmalloc(size, GFP_KERNEL);
+			void *data = kzalloc(size, GFP_KERNEL);
 			if (unlikely(!data))
 				return 0;
 			ret = regset->get(t->task, regset,
_


  parent reply	other threads:[~2020-05-28  5:20 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-28  5:20 incoming Andrew Morton
2020-05-28  5:20 ` [patch 1/5] mm/z3fold: silence kmemleak false positives of slots Andrew Morton
2020-05-28  5:20 ` [patch 2/5] mm,thp: stop leaking unreleased file pages Andrew Morton
2020-05-28  5:20 ` [patch 3/5] mm: remove VM_BUG_ON(PageSlab()) from page_mapcount() Andrew Morton
2020-05-28  5:20 ` Andrew Morton [this message]
2020-05-28  5:20 ` [patch 5/5] include/asm-generic/topology.h: guard cpumask_of_node() macro argument Andrew Morton
2020-05-28 20:10 ` incoming Linus Torvalds
2020-05-29 20:31   ` incoming Andrew Morton
2020-05-29 20:38     ` incoming Linus Torvalds
2020-05-29 21:12       ` incoming Andrew Morton
2020-05-29 21:20         ` incoming Linus Torvalds

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200528052052.tLpI_z4pp%akpm@linux-foundation.org \
    --to=akpm@linux-foundation.org \
    --cc=adobriyan@gmail.com \
    --cc=glider@google.com \
    --cc=keescook@chromium.org \
    --cc=linux-mm@kvack.org \
    --cc=mm-commits@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=sunhaoyl@outlook.com \
    --cc=torvalds@linux-foundation.org \
    --cc=viro@zeniv.linux.org.uk \
    --subject='Re: [patch 4/5] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
on how to clone and mirror all data and code used for this inbox