lkml.org 
[lkml]   [2007]   [Dec]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] tmpfs: restore missing clear_highpage
On Tue, 11 Dec 2007, Chuck Ebbert wrote:
> On 11/28/2007 01:55 PM, Hugh Dickins wrote:
> > tmpfs was misconverted to __GFP_ZERO in 2.6.11. There's an unusual case in
> > which shmem_getpage receives the page from its caller instead of allocating.
> > We must cover this case by clear_highpage before SetPageUptodate, as before.
> >
> > Signed-off-by: Hugh Dickins <hugh@veritas.com>
> > ---
>
> What are the symptoms of the bug this fixes?

I've not seen it in practice, just noticed it while working on that
area in the code. What's the polite way of describing these things
in public? It's a vulnerability which might allow an attacker to
access data from inside the kernel which should have been zeroed -
in very limited circumstances I'd prefer not to have to devise and
announce.

It would also be wrong data, so could for example crash any program
rightly relying on uninitialized static data to be zeroed - in the
unlikely event that its data was coming via this route (in most setups
it never can do, perhaps I'd conclude that's true of all setups). It
has escaped notice for nearly three years, so it's not a commonplace.

Further discussion offline if you like!

Hugh


\
 
 \ /
  Last update: 2007-12-12 06:17    [W:0.059 / U:0.064 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site