* [PATCH] ubifs: Don't leak kernel memory to the MTD
@ 2017-06-16 14:21 Richard Weinberger
2017-06-22 19:21 ` Boris Brezillon
0 siblings, 1 reply; 2+ messages in thread
From: Richard Weinberger @ 2017-06-16 14:21 UTC (permalink / raw)
To: linux-mtd
Cc: Richard Weinberger, stable, Artem Bityutskiy, Adrian Hunter,
linux-kernel
When UBIFS prepares data structures which will be written to the MTD it
ensues that their lengths are multiple of 8. Since it uses kmalloc() the
padded bytes are left uninitialized and we leak a few bytes of kernel
memory to the MTD.
To make sure that all bytes are initialized, let's switch to kzalloc().
Kzalloc() is fine in this case because the buffers are not huge and in
the IO path the performance bottleneck is anyway the MTD.
Cc: stable@vger.kernel.org
Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
Signed-off-by: Richard Weinberger <richard@nod.at>
---
fs/ubifs/journal.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index 294519b98874..981a7ea86674 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -574,7 +574,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,
/* Make sure to also account for extended attributes */
len += host_ui->data_len;
- dent = kmalloc(len, GFP_NOFS);
+ dent = kzalloc(len, GFP_NOFS);
if (!dent)
return -ENOMEM;
@@ -967,7 +967,7 @@ int ubifs_jnl_xrename(struct ubifs_info *c, const struct inode *fst_dir,
if (twoparents)
len += plen;
- dent1 = kmalloc(len, GFP_NOFS);
+ dent1 = kzalloc(len, GFP_NOFS);
if (!dent1)
return -ENOMEM;
@@ -1117,7 +1117,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir,
len = aligned_dlen1 + aligned_dlen2 + ALIGN(ilen, 8) + ALIGN(plen, 8);
if (move)
len += plen;
- dent = kmalloc(len, GFP_NOFS);
+ dent = kzalloc(len, GFP_NOFS);
if (!dent)
return -ENOMEM;
@@ -1500,7 +1500,7 @@ int ubifs_jnl_delete_xattr(struct ubifs_info *c, const struct inode *host,
hlen = host_ui->data_len + UBIFS_INO_NODE_SZ;
len = aligned_xlen + UBIFS_INO_NODE_SZ + ALIGN(hlen, 8);
- xent = kmalloc(len, GFP_NOFS);
+ xent = kzalloc(len, GFP_NOFS);
if (!xent)
return -ENOMEM;
@@ -1607,7 +1607,7 @@ int ubifs_jnl_change_xattr(struct ubifs_info *c, const struct inode *inode,
aligned_len1 = ALIGN(len1, 8);
aligned_len = aligned_len1 + ALIGN(len2, 8);
- ino = kmalloc(aligned_len, GFP_NOFS);
+ ino = kzalloc(aligned_len, GFP_NOFS);
if (!ino)
return -ENOMEM;
--
2.12.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] ubifs: Don't leak kernel memory to the MTD
2017-06-16 14:21 [PATCH] ubifs: Don't leak kernel memory to the MTD Richard Weinberger
@ 2017-06-22 19:21 ` Boris Brezillon
0 siblings, 0 replies; 2+ messages in thread
From: Boris Brezillon @ 2017-06-22 19:21 UTC (permalink / raw)
To: Richard Weinberger
Cc: linux-mtd, linux-kernel, Adrian Hunter, stable, Artem Bityutskiy
On Fri, 16 Jun 2017 16:21:44 +0200
Richard Weinberger <richard@nod.at> wrote:
> When UBIFS prepares data structures which will be written to the MTD it
> ensues that their lengths are multiple of 8. Since it uses kmalloc() the
> padded bytes are left uninitialized and we leak a few bytes of kernel
> memory to the MTD.
> To make sure that all bytes are initialized, let's switch to kzalloc().
> Kzalloc() is fine in this case because the buffers are not huge and in
> the IO path the performance bottleneck is anyway the MTD.
>
> Cc: stable@vger.kernel.org
> Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
> Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
> ---
> fs/ubifs/journal.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
> index 294519b98874..981a7ea86674 100644
> --- a/fs/ubifs/journal.c
> +++ b/fs/ubifs/journal.c
> @@ -574,7 +574,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,
> /* Make sure to also account for extended attributes */
> len += host_ui->data_len;
>
> - dent = kmalloc(len, GFP_NOFS);
> + dent = kzalloc(len, GFP_NOFS);
> if (!dent)
> return -ENOMEM;
>
> @@ -967,7 +967,7 @@ int ubifs_jnl_xrename(struct ubifs_info *c, const struct inode *fst_dir,
> if (twoparents)
> len += plen;
>
> - dent1 = kmalloc(len, GFP_NOFS);
> + dent1 = kzalloc(len, GFP_NOFS);
> if (!dent1)
> return -ENOMEM;
>
> @@ -1117,7 +1117,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir,
> len = aligned_dlen1 + aligned_dlen2 + ALIGN(ilen, 8) + ALIGN(plen, 8);
> if (move)
> len += plen;
> - dent = kmalloc(len, GFP_NOFS);
> + dent = kzalloc(len, GFP_NOFS);
> if (!dent)
> return -ENOMEM;
>
> @@ -1500,7 +1500,7 @@ int ubifs_jnl_delete_xattr(struct ubifs_info *c, const struct inode *host,
> hlen = host_ui->data_len + UBIFS_INO_NODE_SZ;
> len = aligned_xlen + UBIFS_INO_NODE_SZ + ALIGN(hlen, 8);
>
> - xent = kmalloc(len, GFP_NOFS);
> + xent = kzalloc(len, GFP_NOFS);
> if (!xent)
> return -ENOMEM;
>
> @@ -1607,7 +1607,7 @@ int ubifs_jnl_change_xattr(struct ubifs_info *c, const struct inode *inode,
> aligned_len1 = ALIGN(len1, 8);
> aligned_len = aligned_len1 + ALIGN(len2, 8);
>
> - ino = kmalloc(aligned_len, GFP_NOFS);
> + ino = kzalloc(aligned_len, GFP_NOFS);
> if (!ino)
> return -ENOMEM;
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-06-22 19:21 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-06-16 14:21 [PATCH] ubifs: Don't leak kernel memory to the MTD Richard Weinberger
2017-06-22 19:21 ` Boris Brezillon
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).