diff options
| author | Jann Horn <[email protected]> | 2024-08-06 19:51:42 +0000 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2024-08-18 15:45:39 +0000 |
| commit | 3c0da3d163eb32f1f91891efaade027fa9b245b9 (patch) | |
| tree | 044d7125e167dff4b438d662533ac955d6dd067d /drivers/media/mc/mc-request.c | |
| parent | Merge tag 'mm-hotfixes-stable-2024-08-17-19-34' of git://git.kernel.org/pub/s... (diff) | |
| download | kernel-3c0da3d163eb32f1f91891efaade027fa9b245b9.tar.gz kernel-3c0da3d163eb32f1f91891efaade027fa9b245b9.zip | |
fuse: Initialize beyond-EOF page contents before setting uptodate
fuse_notify_store(), unlike fuse_do_readpage(), does not enable page
zeroing (because it can be used to change partial page contents).
So fuse_notify_store() must be more careful to fully initialize page
contents (including parts of the page that are beyond end-of-file)
before marking the page uptodate.
The current code can leave beyond-EOF page contents uninitialized, which
makes these uninitialized page contents visible to userspace via mmap().
This is an information leak, but only affects systems which do not
enable init-on-alloc (via CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y or the
corresponding kernel command line parameter).
Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2574
Cc: [email protected]
Fixes: a1d75f258230 ("fuse: add store request")
Signed-off-by: Jann Horn <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Diffstat (limited to 'drivers/media/mc/mc-request.c')
0 files changed, 0 insertions, 0 deletions