Re: [PATCH 0/1] rust: configfs: Fix reference creation from uninitialized data in `Attribute::show`

["Gary Guo" <gary@garyguo.net>]

On Fri Oct 9, 2026 at 1:49 PM BST, Andreas Hindborg wrote:
> Andreas Hindborg <a.hindborg@kernel.org> writes:
>
> Actually there may be a problem, but I think it may be in C configfs. If
> you take a look at the function that reads data from the iov_iter:
>
>   static int fill_write_buffer(struct configfs_buffer *buffer,
>             struct iov_iter *from)
>   {
>     int copied;
>
>     if (!buffer->page)
>       buffer->page = kmalloc(PAGE_SIZE, GFP_KERNEL); // <- HERE
>     if (!buffer->page)
>       return -ENOMEM;
>
>     copied = copy_from_iter(buffer->page, SIMPLE_ATTR_SIZE - 1, from);
>     buffer->needs_read_fill = 1;
>     /* if buf is assumed to contain a string, terminate it by \0,
>     * so e.g. sscanf() can scan the string easily */
>     buffer->page[copied] = 0;
>     return copied ? : -EFAULT;
>   }
>
> This function does not zero the page that is written into. This,
> combined with the buffer being per file handle means that you can read
> the original data in the page. The `kmalloc` should be probably be
> replaced with a `kzalloc`. This should be a problem for C modules as
> well.

Why is this an issue? The extra uninitialized bytes should not be used.

Best,
Gary

>
> Cc: Breno Leitao <leitao@debian.org>
>
> Looks like I only replied Priya when replying, so I'm adding back
> everyone from the original email.
>
> Best regards,
> Andreas Hindborg