iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xen/blkfront: fix leaking data in shared pages

Browse Source 
When allocating pages to be used for shared communication with the
backend always zero them, this avoids leaking unintended data present
on the pages.

This is CVE-2022-26365, part of XSA-403.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
This commit is contained in:
Roger Pau Monne 2022-07-01 08:23:54 +02:00 committed by Juergen Gross
parent a175eca0f3
commit 2f446ffe9d
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/block/xen-blkfront.c
View File

@ -311,7 +311,7 @@ static int fill_grant_buffer(struct blkfront_ring_info *rinfo, int num)
goto out_of_memory; goto out_of_memory;
if (info->feature_persistent) { if (info->feature_persistent) {
granted_page = alloc_page(GFP_NOIO); granted_page = alloc_page(GFP_NOIO | __GFP_ZERO);
if (!granted_page) { if (!granted_page) {
kfree(gnt_list_entry); kfree(gnt_list_entry);
goto out_of_memory; goto out_of_memory;
@ -2183,7 +2183,8 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo)
BUG_ON(!list_empty(&rinfo->indirect_pages)); BUG_ON(!list_empty(&rinfo->indirect_pages));
for (i = 0; i < num; i++) { for (i = 0; i < num; i++) {
struct page *indirect_page = alloc_page(GFP_KERNEL); struct page *indirect_page = alloc_page(GFP_KERNEL |
__GFP_ZERO);
if (!indirect_page) if (!indirect_page)
goto out_of_memory; goto out_of_memory;
list_add(&indirect_page->lru, &rinfo->indirect_pages); list_add(&indirect_page->lru, &rinfo->indirect_pages);