Skip to contentSkip to conversation

Patch "ubifs: Don't leak kernel memory to the MTD" has been added to the 4.9-stable tree

PATCH [email protected] 1 participant 1 message Jul 25, 2017

Subsystems (2)
Stable branch UBI file system (UBIFS)
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

ubifs: Don't leak kernel memory to the MTD

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ubifs-don-t-leak-kernel-memory-to-the-mtd.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 4acadda74ff8b949c448c0282765ae747e088c87 Mon Sep 17 00:00:00 2001

From: Richard Weinberger <[email protected]>
Date: Fri, 16 Jun 2017 16:21:44 +0200
Subject: ubifs: Don't leak kernel memory to the MTD

From: Richard Weinberger <[email protected]>

commit 4acadda74ff8b949c448c0282765ae747e088c87 upstream.

When UBIFS prepares data structures which will be written to the MTD it ensues that their lengths are multiple of 8. Since it uses kmalloc() the padded bytes are left uninitialized and we leak a few bytes of kernel memory to the MTD.
To make sure that all bytes are initialized, let's switch to kzalloc(). Kzalloc() is fine in this case because the buffers are not huge and in the IO path the performance bottleneck is anyway the MTD.

Fixes 1e51764a3c2a ("UBIFS: add new flash file system")
Signed-off-by Richard Weinberger <[email protected]>
Reviewed-by Boris Brezillon <[email protected]>
Signed-off-by Richard Weinberger <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 fs/ubifs/journal.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)
fs/ubifs/journal.c +5 -5
@@ -576,7 +576,7 @@ int ubifs_jnl_update(struct ubifs_info *
 	/* Make sure to also account for extended attributes */
 	len += host_ui->data_len;
 
-	dent = kmalloc(len, GFP_NOFS);
+	dent = kzalloc(len, GFP_NOFS);
 	if (!dent)
 		return -ENOMEM;
 

@@ -952,7 +952,7 @@ int ubifs_jnl_xrename(struct ubifs_info
 	if (twoparents)
 		len += plen;
 
-	dent1 = kmalloc(len, GFP_NOFS);
+	dent1 = kzalloc(len, GFP_NOFS);
 	if (!dent1)
 		return -ENOMEM;
 

@@ -1102,7 +1102,7 @@ int ubifs_jnl_rename(struct ubifs_info *
 	len = aligned_dlen1 + aligned_dlen2 + ALIGN(ilen, 8) + ALIGN(plen, 8);
 	if (move)
 		len += plen;
-	dent = kmalloc(len, GFP_NOFS);
+	dent = kzalloc(len, GFP_NOFS);
 	if (!dent)
 		return -ENOMEM;
 

@@ -1466,7 +1466,7 @@ int ubifs_jnl_delete_xattr(struct ubifs_
 	hlen = host_ui->data_len + UBIFS_INO_NODE_SZ;
 	len = aligned_xlen + UBIFS_INO_NODE_SZ + ALIGN(hlen, 8);
 
-	xent = kmalloc(len, GFP_NOFS);
+	xent = kzalloc(len, GFP_NOFS);
 	if (!xent)
 		return -ENOMEM;
 

@@ -1573,7 +1573,7 @@ int ubifs_jnl_change_xattr(struct ubifs_
 	aligned_len1 = ALIGN(len1, 8);
 	aligned_len = aligned_len1 + ALIGN(len2, 8);
 
-	ino = kmalloc(aligned_len, GFP_NOFS);
+	ino = kzalloc(aligned_len, GFP_NOFS);
 	if (!ino)
 		return -ENOMEM;

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/ubifs-don-t-leak-kernel-memory-to-the-mtd.patch