lkml.org 
[lkml]   [2021]   [Feb]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.11 50/67] Drivers: hv: vmbus: Initialize memory to be sent to the host
    Date
    From: "Andrea Parri (Microsoft)" <parri.andrea@gmail.com>

    [ Upstream commit e99c4afbee07e9323e9191a20b24d74dbf815bdf ]

    __vmbus_open() and vmbus_teardown_gpadl() do not inizialite the memory
    for the vmbus_channel_open_channel and the vmbus_channel_gpadl_teardown
    objects they allocate respectively. These objects contain padding bytes
    and fields that are left uninitialized and that are later sent to the
    host, potentially leaking guest data. Zero initialize such fields to
    avoid leaking sensitive information to the host.

    Reported-by: Juan Vazquez <juvazq@microsoft.com>
    Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
    Reviewed-by: Michael Kelley <mikelley@microsoft.com>
    Link: https://lore.kernel.org/r/20201209070827.29335-2-parri.andrea@gmail.com
    Signed-off-by: Wei Liu <wei.liu@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/hv/channel.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
    index 6fb0c76bfbf81..0bd202de79600 100644
    --- a/drivers/hv/channel.c
    +++ b/drivers/hv/channel.c
    @@ -618,7 +618,7 @@ static int __vmbus_open(struct vmbus_channel *newchannel,
    goto error_clean_ring;

    /* Create and init the channel open message */
    - open_info = kmalloc(sizeof(*open_info) +
    + open_info = kzalloc(sizeof(*open_info) +
    sizeof(struct vmbus_channel_open_channel),
    GFP_KERNEL);
    if (!open_info) {
    @@ -745,7 +745,7 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle)
    unsigned long flags;
    int ret;

    - info = kmalloc(sizeof(*info) +
    + info = kzalloc(sizeof(*info) +
    sizeof(struct vmbus_channel_gpadl_teardown), GFP_KERNEL);
    if (!info)
    return -ENOMEM;
    --
    2.27.0
    \
     
     \ /
      Last update: 2021-02-24 15:11    [W:4.102 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site