* [PATCH 5.4] block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
@ 2022-05-04 22:39 Nobel Barakat
0 siblings, 0 replies; only message in thread
From: Nobel Barakat @ 2022-05-04 22:39 UTC (permalink / raw)
To: stable
Cc: Nobel Barakat, Haimin Zhang, Chaitanya Kulkarni,
Christoph Hellwig, Jens Axboe
commit cc8f7fe1f5eab010191aa4570f27641876fa1267 upstream
Add __GFP_ZERO flag for alloc_page in function bio_copy_kern to initialize
the buffer of a bio.
Signed-off-by: Haimin Zhang <tcs.kernel@gmail.com>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20220216084038.15635-1-tcs.kernel@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[nobelbarakat: Backported to 5.4: Manually added __GFP_ZERO flag]
Signed-off-by: Nobel Barakat <nobelbarakat@google.com>
---
This changes fixes a kernel info leak since it's possible for bio_copy_kern to
copy unitialized memory into userspace.
This change had to be manually backported since bio_copy_kern is in a different
file (bio.c) than the upstream commit (blk-map.c)
block/bio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/block/bio.c b/block/bio.c
index b1170ec18464..363294afc394 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1570,7 +1570,7 @@ struct bio *bio_copy_kern(struct request_queue *q, void *data, unsigned int len,
if (bytes > len)
bytes = len;
- page = alloc_page(q->bounce_gfp | gfp_mask);
+ page = alloc_page(q->bounce_gfp | __GFP_ZERO | gfp_mask);
if (!page)
goto cleanup;
--
2.36.0.464.gb9c8b46e94-goog
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2022-05-04 22:39 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-04 22:39 [PATCH 5.4] block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern Nobel Barakat
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).