From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753974AbdCFKmw (ORCPT ); Mon, 6 Mar 2017 05:42:52 -0500 Received: from mail-wr0-f195.google.com ([209.85.128.195]:34501 "EHLO mail-wr0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752935AbdCFKmI (ORCPT ); Mon, 6 Mar 2017 05:42:08 -0500 From: Michal Hocko To: Andrew Morton Cc: , LKML , Michal Hocko , Kees Cook , Vlastimil Babka Subject: [PATCH 5/9] xattr: zero out memory copied to userspace in getxattr Date: Mon, 6 Mar 2017 11:33:23 +0100 Message-Id: <20170306103327.2766-1-mhocko@kernel.org> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20170306103032.2540-1-mhocko@kernel.org> References: <20170306103032.2540-1-mhocko@kernel.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Michal Hocko getxattr uses vmalloc to allocate memory if kzalloc fails. This is filled by vfs_getxattr and then copied to the userspace. vmalloc, however, doesn't zero out the memory so if the specific implementation of the xattr handler is sloppy we can theoretically expose a kernel memory. There is no real sign this is really the case but let's make sure this will not happen and use vzalloc instead. Fixes: 779302e67835 ("fs/xattr.c:getxattr(): improve handling of allocation failures") Cc: stable # 3.6+ Acked-by: Kees Cook Spotted-by: Vlastimil Babka Signed-off-by: Michal Hocko --- fs/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/xattr.c b/fs/xattr.c index 7e3317cf4045..94f49a082dd2 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -530,7 +530,7 @@ getxattr(struct dentry *d, const char __user *name, void __user *value, size = XATTR_SIZE_MAX; kvalue = kzalloc(size, GFP_KERNEL | __GFP_NOWARN); if (!kvalue) { - kvalue = vmalloc(size); + kvalue = vzalloc(size); if (!kvalue) return -ENOMEM; } -- 2.11.0