From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Anant Thazhemadam <anant.thazhemadam@gmail.com>,
syzbot+a79e17c39564bedf0930@syzkaller.appspotmail.com,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.4 32/38] misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells()
Date: Tue, 22 Dec 2020 21:25:10 -0500 [thread overview]
Message-ID: <20201223022516.2794471-32-sashal@kernel.org> (raw)
In-Reply-To: <20201223022516.2794471-1-sashal@kernel.org>
From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
[ Upstream commit 31dcb6c30a26d32650ce134820f27de3c675a45a ]
A kernel-infoleak was reported by syzbot, which was caused because
dbells was left uninitialized.
Using kzalloc() instead of kmalloc() fixes this issue.
Reported-by: syzbot+a79e17c39564bedf0930@syzkaller.appspotmail.com
Tested-by: syzbot+a79e17c39564bedf0930@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201122224534.333471-1-anant.thazhemadam@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/vmw_vmci/vmci_context.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/vmw_vmci/vmci_context.c b/drivers/misc/vmw_vmci/vmci_context.c
index b9da2c6cc9818..0bdfa90ea6cda 100644
--- a/drivers/misc/vmw_vmci/vmci_context.c
+++ b/drivers/misc/vmw_vmci/vmci_context.c
@@ -750,7 +750,7 @@ static int vmci_ctx_get_chkpt_doorbells(struct vmci_ctx *context,
return VMCI_ERROR_MORE_DATA;
}
- dbells = kmalloc(data_size, GFP_ATOMIC);
+ dbells = kzalloc(data_size, GFP_ATOMIC);
if (!dbells)
return VMCI_ERROR_NO_MEM;
--
2.27.0
next prev parent reply other threads:[~2020-12-23 2:28 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-23 2:24 [PATCH AUTOSEL 4.4 01/38] locks: Fix UBSAN undefined behaviour in flock64_to_posix_lock Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 02/38] tomoyo: fix clang pointer arithmetic warning Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 03/38] staging: wimax: depends on NET Sasha Levin
2020-12-23 2:38 ` Jakub Kicinski
2020-12-23 14:14 ` Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 04/38] scsi: pm80xx: Avoid busywait in FW ready check Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 05/38] scsi: pm80xx: Fix pm8001_mpi_get_nvmd_resp() race condition Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 06/38] staging: rtl8192u: fix wrong judgement in rtl8192_rx_isr Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 07/38] mips: ar7: add missing iounmap() on error in ar7_gpio_init Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 08/38] locktorture: Prevent hangs for invalid arguments Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 09/38] rcutorture: " Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 10/38] drm: panel: simple: add missing platform_driver_unregister() in panel_simple_init Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 11/38] Bluetooth: hidp: use correct wait queue when removing ctrl_wait Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 12/38] net: skb_vlan_untag(): don't reset transport offset if set by GRO layer Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 13/38] MIPS: BMC47xx: fix kconfig dependency bug for BCM47XX_SSB Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 14/38] jfs: Fix memleak in dbAdjCtl Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 15/38] media: zr364xx: propagate errors from zr364xx_start_readpipe() Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 16/38] media: isif: reset global state Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 17/38] mmc: tmio: do not print real IOMEM pointer Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 18/38] ARM: OMAP2+: Fix memleak in omap2xxx_clkt_vps_init Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 19/38] tick/broadcast: Serialize access to tick_next_period Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 20/38] ALSA: usb-audio: Don't call usb_set_interface() at trigger callback Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.4 21/38] rxrpc: Don't leak the service-side session key to userspace Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 22/38] ARM: dts: hisilicon: fix errors detected by snps-dw-apb-uart.yaml Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 23/38] ARM: dts: hisilicon: fix errors detected by usb yaml Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 24/38] ARM: dts: hisilicon: fix errors detected by simple-bus.yaml Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 25/38] brcmsmac: ampdu: Check BA window size before checking block ack Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 26/38] iommu/tegra-smmu: Expand mutex protection range Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 27/38] crypto: qce - Fix SHA result buffer corruption issues Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 28/38] media: gp8psk: initialize stats at power control logic Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 29/38] net/lapb: fix t1 timer handling for LAPB_STATE_0 Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 30/38] x86/mce: Panic for LMCE only if mca_cfg.tolerant < 3 Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 31/38] mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start Sasha Levin
2020-12-23 2:25 ` Sasha Levin [this message]
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 33/38] iwlwifi: trans: consider firmware dead after errors Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 34/38] iwlwifi: add an extra firmware state in the transport Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 35/38] mac80211: disallow band-switch during CSA Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 36/38] mac80211: don't filter out beacons once we start CSA Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 37/38] ALSA: hda/hdmi: packet buffer index must be set before reading value Sasha Levin
2020-12-23 2:25 ` [PATCH AUTOSEL 4.4 38/38] PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201223022516.2794471-32-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=anant.thazhemadam@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+a79e17c39564bedf0930@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome