diff options
| author |   Jann Horn <jannh@google.com> | 2024-08-06 21:51:42 +0200 |
|---|---|---|
| committer |   Linus Torvalds <torvalds@linux-foundation.org> | 2024-08-18 08:45:39 -0700 |
| commit | 3c0da3d163eb32f1f91891efaade027fa9b245b9 (patch) | |
| tree | 044d7125e167dff4b438d662533ac955d6dd067d /rust/helpers/build_bug.c | |
| parent | Merge tag 'mm-hotfixes-stable-2024-08-17-19-34' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm (diff) | |
| download | wireguard-linux-3c0da3d163eb32f1f91891efaade027fa9b245b9.tar.xz wireguard-linux-3c0da3d163eb32f1f91891efaade027fa9b245b9.zip | |
fuse: Initialize beyond-EOF page contents before setting uptodate
fuse_notify_store(), unlike fuse_do_readpage(), does not enable page
zeroing (because it can be used to change partial page contents).
So fuse_notify_store() must be more careful to fully initialize page
contents (including parts of the page that are beyond end-of-file)
before marking the page uptodate.
The current code can leave beyond-EOF page contents uninitialized, which
makes these uninitialized page contents visible to userspace via mmap().
This is an information leak, but only affects systems which do not
enable init-on-alloc (via CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y or the
corresponding kernel command line parameter).
Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2574
Cc: stable@kernel.org
Fixes: a1d75f258230 ("fuse: add store request")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'rust/helpers/build_bug.c')
0 files changed, 0 insertions, 0 deletions