Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1613100

[PATCH 8/8] tcm_fileio: Prevent information leak for short reads

Show all headers | View raw

If we failed to read data from backing file (probably because some one
truncate file under us), we must zerofill cmd's data, otherwise it will
be returned as is. Most likely cmd's data are unitialized pages from
page cache. This result in information leak.

xfstests: generic/420
http://marc.info/?l=linux-scsi&m=149087996913448&w=2

Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
---
 drivers/target/target_core_file.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index 87aa376..d69908d 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -277,12 +277,11 @@ static int fd_do_rw(struct se_cmd *cmd, struct file *fd,
 	else
 		ret = vfs_iter_read(fd, &iter, &pos);
 
-	kfree(bvec);
-
 	if (is_write) {
 		if (ret < 0 || ret != data_length) {
 			pr_err("%s() write returned %d\n", __func__, ret);
-			return (ret < 0 ? ret : -EINVAL);
+			if (ret >= 0)
+				ret = -EINVAL;
 		}
 	} else {
 		/*
@@ -295,17 +294,27 @@ static int fd_do_rw(struct se_cmd *cmd, struct file *fd,
 				pr_err("%s() returned %d, expecting %u for "
 						"S_ISBLK\n", __func__, ret,
 						data_length);
-				return (ret < 0 ? ret : -EINVAL);
+				if (ret >= 0)
+					ret = -EINVAL;
 			}
 		} else {
 			if (ret < 0) {
 				pr_err("%s() returned %d for non S_ISBLK\n",
 						__func__, ret);
-				return ret;
+			} else if (ret != data_length) {
+				/*
+				 * Short read case:
+				 * Probably some one truncate file under us.
+				 * We must explicitly zero sg-pages to prevent
+				 * expose uninizialized pages to userspace.
+				 */
+				BUG_ON(ret > data_length);
+				ret += iov_iter_zero(data_length - ret, &iter);
 			}
 		}
 	}
-	return 1;
+	kfree(bvec);
+	return ret;
 }
 
 static sense_reason_t
-- 
2.9.3

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/8] block: T10/DIF Fixes and cleanups Dmitry Monakhov <dmonakhov@openvz.org> - 2017-03-30 15:50 +0200
  [PATCH 2/8] bio-integrity: Do not allocate integrity context for bio w/o data Dmitry Monakhov <dmonakhov@openvz.org> - 2017-03-30 16:00 +0200
  [PATCH 3/8] bio-integrity: save original iterator for verify stage Dmitry Monakhov <dmonakhov@openvz.org> - 2017-03-30 16:00 +0200
  [PATCH 5/8] bio-integrity: fix interface for bio_integrity_trim Dmitry Monakhov <dmonakhov@openvz.org> - 2017-03-30 16:00 +0200
  [PATCH 6/8] bio-integrity: add bio_integrity_setup helper Dmitry Monakhov <dmonakhov@openvz.org> - 2017-03-30 16:00 +0200
    Re: [PATCH 6/8] bio-integrity: add bio_integrity_setup helper kbuild test robot <lkp@intel.com> - 2017-04-01 00:20 +0200
  [PATCH 4/8] bio-integrity: bio_trim should truncate integrity vector accordingly Dmitry Monakhov <dmonakhov@openvz.org> - 2017-03-30 16:00 +0200
  [PATCH 8/8] tcm_fileio: Prevent information leak for short reads Dmitry Monakhov <dmonakhov@openvz.org> - 2017-03-30 16:00 +0200
  [PATCH 7/8] T10: Move opencoded contants to common header Dmitry Monakhov <dmonakhov@openvz.org> - 2017-03-30 16:00 +0200
    Re: [PATCH 7/8] T10: Move opencoded contants to common header kbuild test robot <lkp@intel.com> - 2017-04-01 00:20 +0200
  [PATCH 1/8] Guard bvec iteration logic Dmitry Monakhov <dmonakhov@openvz.org> - 2017-03-30 16:00 +0200
    Re: [PATCH 1/8] Guard bvec iteration logic Ming Lei <tom.leiming@gmail.com> - 2017-03-31 10:30 +0200

csiph-web