lkml.org 
[lkml]   [2020]   [May]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [git pull] coredump infoleak fix

* Al Viro <viro@zeniv.linux.org.uk> wrote:

> xstate note on boxes with xsaves support can leak uninitialized data
> into coredumps
>
> The following changes since commit 4e89b7210403fa4a8acafe7c602b6212b7af6c3b:
>
> fix multiplication overflow in copy_fdtable() (2020-05-19 18:29:36 -0400)
>
> are available in the git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes
>
> for you to fetch changes up to 9e4636545933131de15e1ecd06733538ae939b2f:
>
> copy_xstate_to_kernel(): don't leave parts of destination uninitialized (2020-05-27 17:06:31 -0400)
>
> ----------------------------------------------------------------
> Al Viro (1):
> copy_xstate_to_kernel(): don't leave parts of destination uninitialized
>
> arch/x86/kernel/fpu/xstate.c | 86 ++++++++++++++++++++++++--------------------
> 1 file changed, 48 insertions(+), 38 deletions(-)

Looks good to me.

I'm wondering, shouldn't we also zero-initialize the dump data to
begin with? See the patch below (untested).

Thanks,

Ingo

fs/binfmt_elf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 13f25e241ac4..25d489bc9453 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1733,7 +1733,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
(!regset->active || regset->active(t->task, regset) > 0)) {
int ret;
size_t size = regset_size(t->task, regset);
- void *data = kmalloc(size, GFP_KERNEL);
+ void *data = kzalloc(size, GFP_KERNEL);
if (unlikely(!data))
return 0;
ret = regset->get(t->task, regset,
\
 
 \ /
  Last update: 2020-05-28 09:04    [W:0.119 / U:7.680 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site