mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
f2fs: fix information leak in f2fs_move_inline_dirents()
When converting an inline directory to a regular one, f2fs is leaking uninitialized memory to disk because it doesn't initialize the entire directory block. Fix this by zero-initializing the block. This bug was introduced by commit4ec17d688d
("f2fs: avoid unneeded initializing when converting inline dentry"), which didn't consider the security implications of leaking uninitialized memory to disk. This was found by running xfstest generic/435 on a KMSAN-enabled kernel. Fixes:4ec17d688d
("f2fs: avoid unneeded initializing when converting inline dentry") Cc: <stable@vger.kernel.org> # v4.3+ Signed-off-by: Eric Biggers <ebiggers@google.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
This commit is contained in:
parent
b1b9896718
commit
9a5571cff4
|
@ -421,18 +421,17 @@ static int f2fs_move_inline_dirents(struct inode *dir, struct page *ipage,
|
|||
|
||||
dentry_blk = page_address(page);
|
||||
|
||||
/*
|
||||
* Start by zeroing the full block, to ensure that all unused space is
|
||||
* zeroed and no uninitialized memory is leaked to disk.
|
||||
*/
|
||||
memset(dentry_blk, 0, F2FS_BLKSIZE);
|
||||
|
||||
make_dentry_ptr_inline(dir, &src, inline_dentry);
|
||||
make_dentry_ptr_block(dir, &dst, dentry_blk);
|
||||
|
||||
/* copy data from inline dentry block to new dentry block */
|
||||
memcpy(dst.bitmap, src.bitmap, src.nr_bitmap);
|
||||
memset(dst.bitmap + src.nr_bitmap, 0, dst.nr_bitmap - src.nr_bitmap);
|
||||
/*
|
||||
* we do not need to zero out remainder part of dentry and filename
|
||||
* field, since we have used bitmap for marking the usage status of
|
||||
* them, besides, we can also ignore copying/zeroing reserved space
|
||||
* of dentry block, because them haven't been used so far.
|
||||
*/
|
||||
memcpy(dst.dentry, src.dentry, SIZE_OF_DIR_ENTRY * src.max);
|
||||
memcpy(dst.filename, src.filename, src.max * F2FS_SLOT_LEN);
|
||||
|
||||
|
|
Loading…
Reference in a new issue