linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
@ 2020-04-19 10:08 glider
  2020-04-19 10:10 ` Alexander Potapenko
  2020-04-20 22:33 ` Andrew Morton
  0 siblings, 2 replies; 25+ messages in thread
From: glider @ 2020-04-19 10:08 UTC (permalink / raw)
  To: adobriyan, akpm; +Cc: linux-kernel, sunhaoyl, Alexander Potapenko

KMSAN reported uninitialized data being written to disk when dumping
core. As a result, several kilobytes of kmalloc memory may be written to
the core file and then read by a non-privileged user.

Reported-by: sam <sunhaoyl@outlook.com>
Signed-off-by: Alexander Potapenko <glider@google.com>

---

Note: Reported-by: line is subject to change
---
 fs/binfmt_elf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 13f25e241ac4..25d489bc9453 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1733,7 +1733,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
 		    (!regset->active || regset->active(t->task, regset) > 0)) {
 			int ret;
 			size_t size = regset_size(t->task, regset);
-			void *data = kmalloc(size, GFP_KERNEL);
+			void *data = kzalloc(size, GFP_KERNEL);
 			if (unlikely(!data))
 				return 0;
 			ret = regset->get(t->task, regset,
-- 
2.26.1.301.g55bc3eb7cb9-goog


^ permalink raw reply related	[flat|nested] 25+ messages in thread

end of thread, other threads:[~2020-05-27 21:55 UTC | newest]

Thread overview: 25+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-19 10:08 [PATCH] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() glider
2020-04-19 10:10 ` Alexander Potapenko
2020-04-20 22:33 ` Andrew Morton
2020-04-20 22:41   ` Kees Cook
2020-04-21  3:42     ` Al Viro
2020-04-21  8:14       ` Alexander Potapenko
2020-05-12  1:09         ` Al Viro
2020-05-12  3:44           ` Al Viro
2020-05-12  8:20             ` Alexander Potapenko
2020-05-13  3:33               ` Al Viro
2020-05-24 23:45                 ` Al Viro
2020-05-26 22:38                   ` Al Viro
2020-05-27 12:08                     ` Alexander Potapenko
2020-05-27 19:04                     ` Borislav Petkov
2020-05-27 19:53                       ` Al Viro
2020-05-27 20:09                         ` Borislav Petkov
2020-04-21 12:54       ` Alexander Potapenko
2020-04-21 15:09         ` Jann Horn
2020-04-21 16:04           ` Yu-cheng Yu
2020-04-21 16:16             ` Jann Horn
2020-04-21 16:26               ` Yu-cheng Yu
2020-04-21 20:20               ` Kees Cook
2020-04-21  8:06     ` Alexander Potapenko
2020-05-27 21:55     ` Kees Cook
2020-04-21  8:00   ` Alexander Potapenko

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).