Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1593181

[PATCH 5/9] xattr: zero out memory copied to userspace in getxattr

Show all headers | View raw

From: Michal Hocko <mhocko@suse.com>

getxattr uses vmalloc to allocate memory if kzalloc fails. This is
filled by vfs_getxattr and then copied to the userspace. vmalloc,
however, doesn't zero out the memory so if the specific implementation
of the xattr handler is sloppy we can theoretically expose a kernel
memory. There is no real sign this is really the case but let's make
sure this will not happen and use vzalloc instead.

Fixes: 779302e67835 ("fs/xattr.c:getxattr(): improve handling of allocation failures")
Cc: stable # 3.6+
Acked-by: Kees Cook <keescook@chromium.org>
Spotted-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Michal Hocko <mhocko@suse.com>
---
 fs/xattr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xattr.c b/fs/xattr.c
index 7e3317cf4045..94f49a082dd2 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -530,7 +530,7 @@ getxattr(struct dentry *d, const char __user *name, void __user *value,
 			size = XATTR_SIZE_MAX;
 		kvalue = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
 		if (!kvalue) {
-			kvalue = vmalloc(size);
+			kvalue = vzalloc(size);
 			if (!kvalue)
 				return -ENOMEM;
 		}
-- 
2.11.0

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH 0/6 v5] kvmalloc Michal Hocko <mhocko@kernel.org> - 2017-03-06 11:40 +0100
  [PATCH 2/9] mm: support __GFP_REPEAT in kvmalloc_node for >32kB Michal Hocko <mhocko@kernel.org> - 2017-03-06 11:40 +0100
  [PATCH 9/9] bcache: use kvmalloc Michal Hocko <mhocko@kernel.org> - 2017-03-06 11:40 +0100
  [PATCH 3/9] rhashtable: simplify a strange allocation pattern Michal Hocko <mhocko@kernel.org> - 2017-03-06 11:40 +0100
  [PATCH 1/9] mm: introduce kv[mz]alloc helpers Michal Hocko <mhocko@kernel.org> - 2017-03-06 11:40 +0100
  [PATCH 5/9] xattr: zero out memory copied to userspace in getxattr Michal Hocko <mhocko@kernel.org> - 2017-03-06 11:50 +0100

csiph-web