[PATCH] configfs: zero the write buffer on allocation

[PATCH] configfs: zero the write buffer on allocation

[Breno Leitao]

fill_write_buffer() allocates the per-open buffer page with kmalloc()
and initializes only the bytes copied from userspace plus the
terminating NUL. fill_read_buffer() reuses that page if it is already
allocated.

After a write, a read on the same file descriptor therefore passes
->show() a page that still holds stale heap data. A ->show() that
returns only what it wrote never notices, but one that returns a length
covering bytes it did not write leaks that data to userspace.

The Rust bindings are exposed more directly: ->show() receives the page
as an &mut [u8; PAGE_SIZE], so a driver can read the uninitialized
bytes.

fill_read_buffer() already allocates the same page with kzalloc(). Do
the same here, so the page is initialized whichever path allocates it.
The cost is zeroing one page the first time a file is written.

Link: https://lore.kernel.org/r/cover.1790981219.git.pgovind2@uci.edu
Suggested-by: Andreas Hindborg <a.hindborg@kernel.org>
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 fs/configfs/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/configfs/file.c b/fs/configfs/file.c
index 6460b000c593..a4b58616352c 100644
--- a/fs/configfs/file.c
+++ b/fs/configfs/file.c
@@ -184,7 +184,7 @@ static int fill_write_buffer(struct configfs_buffer *buffer,
 	int copied;
 
 	if (!buffer->page)
-		buffer->page = kmalloc(PAGE_SIZE, GFP_KERNEL);
+		buffer->page = kzalloc(PAGE_SIZE, GFP_KERNEL);
 	if (!buffer->page)
 		return -ENOMEM;
 

---
base-commit: 21671ce5ad38e0543331604bd96144d4d0d3b421
change-id: 20261015-b4-configfs_kzalloc-ca337878cdcb

Best regards,
--  
Breno Leitao <leitao@debian.org>

Re: [PATCH] configfs: zero the write buffer on allocation

[Andreas Hindborg]

Breno Leitao <leitao@debian.org> writes:

> fill_write_buffer() allocates the per-open buffer page with kmalloc()
> and initializes only the bytes copied from userspace plus the
> terminating NUL. fill_read_buffer() reuses that page if it is already
> allocated.
>
> After a write, a read on the same file descriptor therefore passes
> ->show() a page that still holds stale heap data. A ->show() that
> returns only what it wrote never notices, but one that returns a length
> covering bytes it did not write leaks that data to userspace.
>
> The Rust bindings are exposed more directly: ->show() receives the page
> as an &mut [u8; PAGE_SIZE], so a driver can read the uninitialized
> bytes.
>
> fill_read_buffer() already allocates the same page with kzalloc(). Do
> the same here, so the page is initialized whichever path allocates it.
> The cost is zeroing one page the first time a file is written.
>
> Link: https://lore.kernel.org/r/cover.1790981219.git.pgovind2@uci.edu
> Suggested-by: Andreas Hindborg <a.hindborg@kernel.org>
> Signed-off-by: Breno Leitao <leitao@debian.org>

Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org>


Best regards,
Andreas Hindborg