| Message ID | 20221014234841.96935-3-cengiz.can@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | [SRU,HWE-5.17,1/1] xen/blkfront: fix leaking data in shared pages | expand |
On 15.10.22 01:48, Cengiz Can wrote: > From: Roger Pau Monne <roger.pau@citrix.com> > > When allocating pages to be used for shared communication with the > backend always zero them, this avoids leaking unintended data present > on the pages. > > This is CVE-2022-26365, part of XSA-403. > > Signed-off-by: Roger Pau Monné <roger.pau@citrix.com> > Reviewed-by: Jan Beulich <jbeulich@suse.com> > Reviewed-by: Juergen Gross <jgross@suse.com> > Signed-off-by: Juergen Gross <jgross@suse.com> > CVE-2022-26365 > (cherry picked from commit 2f446ffe9d737e9a844b97887919c4fda18246e7) > Signed-off-by: Cengiz Can <cengiz.can@canonical.com> > --- Applied to jammy:linux-hwe-5.17/hwe-5.15-next. Thanks. -Stefan > drivers/block/xen-blkfront.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c > index 03b5fb341e589..380fbc425bcc5 100644 > --- a/drivers/block/xen-blkfront.c > +++ b/drivers/block/xen-blkfront.c > @@ -313,7 +313,7 @@ static int fill_grant_buffer(struct blkfront_ring_info *rinfo, int num) > goto out_of_memory; > > if (info->feature_persistent) { > - granted_page = alloc_page(GFP_NOIO); > + granted_page = alloc_page(GFP_NOIO | __GFP_ZERO); > if (!granted_page) { > kfree(gnt_list_entry); > goto out_of_memory; > @@ -2204,7 +2204,8 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) > > BUG_ON(!list_empty(&rinfo->indirect_pages)); > for (i = 0; i < num; i++) { > - struct page *indirect_page = alloc_page(GFP_KERNEL); > + struct page *indirect_page = alloc_page(GFP_KERNEL | > + __GFP_ZERO); > if (!indirect_page) > goto out_of_memory; > list_add(&indirect_page->lru, &rinfo->indirect_pages);
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c index 03b5fb341e589..380fbc425bcc5 100644 --- a/drivers/block/xen-blkfront.c +++ b/drivers/block/xen-blkfront.c @@ -313,7 +313,7 @@ static int fill_grant_buffer(struct blkfront_ring_info *rinfo, int num) goto out_of_memory; if (info->feature_persistent) { - granted_page = alloc_page(GFP_NOIO); + granted_page = alloc_page(GFP_NOIO | __GFP_ZERO); if (!granted_page) { kfree(gnt_list_entry); goto out_of_memory; @@ -2204,7 +2204,8 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo) BUG_ON(!list_empty(&rinfo->indirect_pages)); for (i = 0; i < num; i++) { - struct page *indirect_page = alloc_page(GFP_KERNEL); + struct page *indirect_page = alloc_page(GFP_KERNEL | + __GFP_ZERO); if (!indirect_page) goto out_of_memory; list_add(&indirect_page->lru, &rinfo->indirect_pages);