mm-commits Archive on lore.kernel.org
 help / color / Atom feed
From: Andrew Morton <akpm@linux-foundation.org>
To: adobriyan@gmail.com, akpm@linux-foundation.org,
	glider@google.com, keescook@chromium.org, linux-mm@kvack.org,
	mm-commits@vger.kernel.org, stable@vger.kernel.org,
	sunhaoyl@outlook.com, torvalds@linux-foundation.org,
	viro@zeniv.linux.org.uk
Subject: [patch 4/5] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
Date: Wed, 27 May 2020 22:20:52 -0700
Message-ID: <20200528052052.tLpI_z4pp%akpm@linux-foundation.org> (raw)
In-Reply-To: <20200527222015.62ba8592af63dae12ab58ffe@linux-foundation.org>

From: Alexander Potapenko <glider@google.com>
Subject: fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()

KMSAN reported uninitialized data being written to disk when dumping core.
As a result, several kilobytes of kmalloc memory may be written to the
core file and then read by a non-privileged user.

Link: http://lkml.kernel.org/r/20200419100848.63472-1-glider@google.com
Link: https://github.com/google/kmsan/issues/76
Signed-off-by: Alexander Potapenko <glider@google.com>
Reported-by: sam <sunhaoyl@outlook.com>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/binfmt_elf.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/binfmt_elf.c~fs-binfmt_elfc-allocate-initialized-memory-in-fill_thread_core_info
+++ a/fs/binfmt_elf.c
@@ -1733,7 +1733,7 @@ static int fill_thread_core_info(struct
 		    (!regset->active || regset->active(t->task, regset) > 0)) {
 			int ret;
 			size_t size = regset_size(t->task, regset);
-			void *data = kmalloc(size, GFP_KERNEL);
+			void *data = kzalloc(size, GFP_KERNEL);
 			if (unlikely(!data))
 				return 0;
 			ret = regset->get(t->task, regset,
_

  parent reply index

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-28  5:20 incoming Andrew Morton
2020-05-28  5:20 ` [patch 1/5] mm/z3fold: silence kmemleak false positives of slots Andrew Morton
2020-05-28  5:20 ` [patch 2/5] mm,thp: stop leaking unreleased file pages Andrew Morton
2020-05-28  5:20 ` [patch 3/5] mm: remove VM_BUG_ON(PageSlab()) from page_mapcount() Andrew Morton
2020-05-28  5:20 ` Andrew Morton [this message]
2020-05-28  5:20 ` [patch 5/5] include/asm-generic/topology.h: guard cpumask_of_node() macro argument Andrew Morton
2020-05-28 19:11 ` [alternative-merged] add-kernel-config-option-for-twisting-kernel-behavior.patch removed from -mm tree Andrew Morton
2020-05-28 19:11 ` [alternative-merged] twist-allow-disabling-k_spec-function-in-drivers-tty-vt-keyboardc.patch " Andrew Morton
2020-05-28 19:11 ` [alternative-merged] twist-add-option-for-selecting-twist-options-for-syzkallers-testing.patch " Andrew Morton
     [not found] ` <CAHk-=whQSWcE1WvKxptHdyc9BUXQyxxyAH954=Jb_YSBrNJYDQ@mail.gmail.com>
2020-05-29 20:31   ` incoming Andrew Morton
     [not found]     ` <CAHk-=wiU-vQVURz62dzitbh2Pk+m_+ipaJU6=z=ES3cd_wKSLQ@mail.gmail.com>
2020-05-29 21:12       ` incoming Andrew Morton

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200528052052.tLpI_z4pp%akpm@linux-foundation.org \
    --to=akpm@linux-foundation.org \
    --cc=adobriyan@gmail.com \
    --cc=glider@google.com \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=mm-commits@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=sunhaoyl@outlook.com \
    --cc=torvalds@linux-foundation.org \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

mm-commits Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/mm-commits/0 mm-commits/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 mm-commits mm-commits/ https://lore.kernel.org/mm-commits \
		mm-commits@vger.kernel.org
	public-inbox-index mm-commits

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.mm-commits


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git