kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/fs/fuse
History
Jann Horn 8314335277 fuse: Initialize beyond-EOF page contents before setting uptodate 
commit 3c0da3d163 upstream.

fuse_notify_store(), unlike fuse_do_readpage(), does not enable page
zeroing (because it can be used to change partial page contents).

So fuse_notify_store() must be more careful to fully initialize page
contents (including parts of the page that are beyond end-of-file)
before marking the page uptodate.

The current code can leave beyond-EOF page contents uninitialized, which
makes these uninitialized page contents visible to userspace via mmap().

This is an information leak, but only affects systems which do not
enable init-on-alloc (via CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y or the
corresponding kernel command line parameter).

Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2574
Cc: stable@kernel.org
Fixes: a1d75f2582 ("fuse: add store request")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-08-29 17:30:12 +02:00
..
acl.c vfs: add rcu argument to ->get_acl() callback 2021-08-18 22:08:24 +02:00
control.c fuse: Remove the control interface for virtio-fs 2022-07-21 16:06:19 +02:00
cuse.c cuse: simplify refcount 2021-04-14 10:40:58 +02:00
dax.c fuse: dax: set fc->dax to NULL in fuse_dax_conn_free() 2023-12-20 17:00:20 +01:00
dev.c fuse: Initialize beyond-EOF page contents before setting uptodate 2024-08-29 17:30:12 +02:00
dir.c fuse: fix root lookup with nonzero generation 2024-04-03 15:19:30 +02:00
file.c attr: use consistent sgid stripping checks 2023-03-03 11:52:25 +01:00
fuse_i.h fuse: don't unhash root 2024-04-03 15:19:30 +02:00
inode.c fuse: verify {g,u}id mount options correctly 2024-08-03 08:49:31 +02:00
ioctl.c fuse: ioctl: translate ENOSYS in outarg 2023-07-27 08:50:25 +02:00
Kconfig dax: remove CONFIG_DAX_DRIVER 2021-12-04 08:58:51 -08:00
Makefile fuse: move ioctl to separate source file 2021-04-12 15:04:30 +02:00
readdir.c fuse: nlookup missing decrement in fuse_direntplus_link 2023-09-19 12:28:05 +02:00
virtio_fs.c virtio_fs: Modify format for virtio_fs_direct_access 2022-07-26 10:38:58 +02:00
xattr.c fuse: move fuse_invalidate_attr() into fuse_update_ctime() 2021-10-22 17:03:01 +02:00