Re: [PATCH] configfs: zero the write buffer on allocation

[Andreas Hindborg <a.hindborg@kernel.org>]

Breno Leitao <leitao@debian.org> writes:

> fill_write_buffer() allocates the per-open buffer page with kmalloc()
> and initializes only the bytes copied from userspace plus the
> terminating NUL. fill_read_buffer() reuses that page if it is already
> allocated.
>
> After a write, a read on the same file descriptor therefore passes
> ->show() a page that still holds stale heap data. A ->show() that
> returns only what it wrote never notices, but one that returns a length
> covering bytes it did not write leaks that data to userspace.
>
> The Rust bindings are exposed more directly: ->show() receives the page
> as an &mut [u8; PAGE_SIZE], so a driver can read the uninitialized
> bytes.
>
> fill_read_buffer() already allocates the same page with kzalloc(). Do
> the same here, so the page is initialized whichever path allocates it.
> The cost is zeroing one page the first time a file is written.
>
> Link: https://lore.kernel.org/r/cover.1790981219.git.pgovind2@uci.edu
> Suggested-by: Andreas Hindborg <a.hindborg@kernel.org>
> Signed-off-by: Breno Leitao <leitao@debian.org>

Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org>


Best regards,
Andreas Hindborg