On Wed, May 04, 2022 at 08:12:07PM +0000, Nobel Barakat wrote:
[ Upstream commit cc8f7fe1f5eab010191aa4570f27641876fa1267 ]
Add __GFP_ZERO flag for alloc_page in function bio_copy_kern to initialize the buffer of a bio.
Signed-off-by: Haimin Zhang tcs.kernel@gmail.com Reviewed-by: Chaitanya Kulkarni kch@nvidia.com Reviewed-by: Christoph Hellwig hch@lst.de Link: https://lore.kernel.org/r/20220216084038.15635-1-tcs.kernel@gmail.com Signed-off-by: Jens Axboe axboe@kernel.dk [nobelbarakat: Backported to 5.10: Manually added flag] Signed-off-by: Nobel Barakat nobelbarakat@google.com
This changes fixes a kernel info leak since it's possible for bio_copy_kern to copy unitialized memory into userspace.
For the backport, I had to manually add the __GFP_ZERO flag since alloc_page on 5.10 uses a different parameter than on 5.15. On 5.10, alloc_page is called with q->bounce_gfp whereas on 5.15 it's called with GFP_NOIO.
Version 5.4 is also affected, and I intend to submit a backport there as well.
block/blk-map.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/block/blk-map.c b/block/blk-map.c index 21630dccac62..ede73f4f7014 100644 --- a/block/blk-map.c +++ b/block/blk-map.c @@ -488,7 +488,7 @@ if (bytes > len) bytes = len;
page = alloc_page(q->bounce_gfp | gfp_mask);
page = alloc_page(q->bounce_gfp | __GFP_ZERO | gfp_mask);2.36.0.464.gb9c8b46e94-goog
Both now queued up, thanks.
greg k-h