lkml.org 
[lkml]   [2022]   [Jul]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 20/29] xen/blkfront: fix leaking data in shared pages
    Date
    From: Roger Pau Monne <roger.pau@citrix.com>

    commit 2f446ffe9d737e9a844b97887919c4fda18246e7 upstream.

    When allocating pages to be used for shared communication with the
    backend always zero them, this avoids leaking unintended data present
    on the pages.

    This is CVE-2022-26365, part of XSA-403.

    Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Juergen Gross <jgross@suse.com>
    Signed-off-by: Juergen Gross <jgross@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/block/xen-blkfront.c | 7 ++++---
    1 file changed, 4 insertions(+), 3 deletions(-)

    --- a/drivers/block/xen-blkfront.c
    +++ b/drivers/block/xen-blkfront.c
    @@ -297,7 +297,7 @@ static int fill_grant_buffer(struct blkf
    goto out_of_memory;

    if (info->feature_persistent) {
    - granted_page = alloc_page(GFP_NOIO);
    + granted_page = alloc_page(GFP_NOIO | __GFP_ZERO);
    if (!granted_page) {
    kfree(gnt_list_entry);
    goto out_of_memory;
    @@ -1729,7 +1729,7 @@ static int setup_blkring(struct xenbus_d
    for (i = 0; i < info->nr_ring_pages; i++)
    rinfo->ring_ref[i] = GRANT_INVALID_REF;

    - sring = alloc_pages_exact(ring_size, GFP_NOIO);
    + sring = alloc_pages_exact(ring_size, GFP_NOIO | __GFP_ZERO);
    if (!sring) {
    xenbus_dev_fatal(dev, -ENOMEM, "allocating shared ring");
    return -ENOMEM;
    @@ -2311,7 +2311,8 @@ static int blkfront_setup_indirect(struc

    BUG_ON(!list_empty(&rinfo->indirect_pages));
    for (i = 0; i < num; i++) {
    - struct page *indirect_page = alloc_page(GFP_NOIO);
    + struct page *indirect_page = alloc_page(GFP_NOIO |
    + __GFP_ZERO);
    if (!indirect_page)
    goto out_of_memory;
    list_add(&indirect_page->lru, &rinfo->indirect_pages);

    \
     
     \ /
      Last update: 2022-07-05 14:01    [W:2.141 / U:0.768 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site