Patch "tcm_fileio: Prevent information leak for short reads" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

tcm_fileio: Prevent information leak for short reads

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
tcm_fileio-prevent-information-leak-for-short-reads.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Dmitry Monakhov <[email protected]>
Date: Fri, 31 Mar 2017 19:53:35 +0400
Subject: tcm_fileio: Prevent information leak for short reads

From: Dmitry Monakhov <[email protected]>

[ Upstream commit f11b55d13563e9428c88c873f4f03a6bef11ec0a ]

If we failed to read data from backing file (probably because some one truncate file under us), we must zerofill cmd's data, otherwise it will be returned as is. Most likely cmd's data are unitialized pages from page cache. This result in information leak.

(Change BUG_ON into -EINVAL se_cmd failure - nab)

testcase: https://github.com/dmonakhov/xfstests/commit/e11a1b7b907ca67b1be51a1594025600767366d5

---
 drivers/target/target_core_file.c |   23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

@@ -276,12 +276,11 @@ static int fd_do_rw(struct se_cmd *cmd,
 	else
 		ret = vfs_iter_read(fd, &iter, &pos);
 
-	kfree(bvec);
-
 	if (is_write) {
 		if (ret < 0 || ret != data_length) {
 			pr_err("%s() write returned %d\n", __func__, ret);
-			return (ret < 0 ? ret : -EINVAL);
+			if (ret >= 0)
+				ret = -EINVAL;
 		}
 	} else {
 		/*

@@ -294,17 +293,29 @@ static int fd_do_rw(struct se_cmd *cmd,
 				pr_err("%s() returned %d, expecting %u for "
 						"S_ISBLK\n", __func__, ret,
 						data_length);
-				return (ret < 0 ? ret : -EINVAL);
+				if (ret >= 0)
+					ret = -EINVAL;
 			}
 		} else {
 			if (ret < 0) {
 				pr_err("%s() returned %d for non S_ISBLK\n",
 						__func__, ret);
-				return ret;
+			} else if (ret != data_length) {
+				/*
+				 * Short read case:
+				 * Probably some one truncate file under us.
+				 * We must explicitly zero sg-pages to prevent
+				 * expose uninizialized pages to userspace.
+				 */
+				if (ret < data_length)
+					ret += iov_iter_zero(data_length - ret, &iter);
+				else
+					ret = -EINVAL;
 			}
 		}
 	}
-	return 1;
+	kfree(bvec);
+	return ret;
 }
 
 static sense_reason_t

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/tcm_fileio-prevent-information-leak-for-short-reads.patch