From: Andrew Morton <akpm@linux-foundation.org> To: adobriyan@gmail.com, akpm@linux-foundation.org, glider@google.com, keescook@chromium.org, linux-mm@kvack.org, mm-commits@vger.kernel.org, stable@vger.kernel.org, sunhaoyl@outlook.com, torvalds@linux-foundation.org, viro@zeniv.linux.org.uk Subject: [patch 4/5] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() Date: Wed, 27 May 2020 22:20:52 -0700 Message-ID: <20200528052052.tLpI_z4pp%akpm@linux-foundation.org> (raw) In-Reply-To: <20200527222015.62ba8592af63dae12ab58ffe@linux-foundation.org> From: Alexander Potapenko <glider@google.com> Subject: fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() KMSAN reported uninitialized data being written to disk when dumping core. As a result, several kilobytes of kmalloc memory may be written to the core file and then read by a non-privileged user. Link: http://lkml.kernel.org/r/20200419100848.63472-1-glider@google.com Link: https://github.com/google/kmsan/issues/76 Signed-off-by: Alexander Potapenko <glider@google.com> Reported-by: sam <sunhaoyl@outlook.com> Acked-by: Kees Cook <keescook@chromium.org> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> --- fs/binfmt_elf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/binfmt_elf.c~fs-binfmt_elfc-allocate-initialized-memory-in-fill_thread_core_info +++ a/fs/binfmt_elf.c @@ -1733,7 +1733,7 @@ static int fill_thread_core_info(struct (!regset->active || regset->active(t->task, regset) > 0)) { int ret; size_t size = regset_size(t->task, regset); - void *data = kmalloc(size, GFP_KERNEL); + void *data = kzalloc(size, GFP_KERNEL); if (unlikely(!data)) return 0; ret = regset->get(t->task, regset, _
next prev parent reply index Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-05-28 5:20 incoming Andrew Morton 2020-05-28 5:20 ` [patch 1/5] mm/z3fold: silence kmemleak false positives of slots Andrew Morton 2020-05-28 5:20 ` [patch 2/5] mm,thp: stop leaking unreleased file pages Andrew Morton 2020-05-28 5:20 ` [patch 3/5] mm: remove VM_BUG_ON(PageSlab()) from page_mapcount() Andrew Morton 2020-05-28 5:20 ` Andrew Morton [this message] 2020-05-28 5:20 ` [patch 5/5] include/asm-generic/topology.h: guard cpumask_of_node() macro argument Andrew Morton 2020-05-28 19:11 ` [alternative-merged] add-kernel-config-option-for-twisting-kernel-behavior.patch removed from -mm tree Andrew Morton 2020-05-28 19:11 ` [alternative-merged] twist-allow-disabling-k_spec-function-in-drivers-tty-vt-keyboardc.patch " Andrew Morton 2020-05-28 19:11 ` [alternative-merged] twist-add-option-for-selecting-twist-options-for-syzkallers-testing.patch " Andrew Morton [not found] ` <CAHk-=whQSWcE1WvKxptHdyc9BUXQyxxyAH954=Jb_YSBrNJYDQ@mail.gmail.com> 2020-05-29 20:31 ` incoming Andrew Morton [not found] ` <CAHk-=wiU-vQVURz62dzitbh2Pk+m_+ipaJU6=z=ES3cd_wKSLQ@mail.gmail.com> 2020-05-29 21:12 ` incoming Andrew Morton
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200528052052.tLpI_z4pp%akpm@linux-foundation.org \ --to=akpm@linux-foundation.org \ --cc=adobriyan@gmail.com \ --cc=glider@google.com \ --cc=keescook@chromium.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=mm-commits@vger.kernel.org \ --cc=stable@vger.kernel.org \ --cc=sunhaoyl@outlook.com \ --cc=torvalds@linux-foundation.org \ --cc=viro@zeniv.linux.org.uk \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
mm-commits Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/mm-commits/0 mm-commits/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 mm-commits mm-commits/ https://lore.kernel.org/mm-commits \ mm-commits@vger.kernel.org public-inbox-index mm-commits Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.mm-commits AGPL code for this site: git clone https://public-inbox.org/public-inbox.git