src/patches/kernel-5.15-CVE-2022-0847.patch

   1 From 114e9f141822e6977633d322c1b03e89bd209932 Mon Sep 17 00:00:00 2001
   2 From: Max Kellermann <max.kellermann@ionos.com>
   3 Date: Mon, 21 Feb 2022 11:03:13 +0100
   4 Subject: [PATCH] lib/iov_iter: initialize "flags" in new pipe_buffer
   5
   6 commit 9d2231c5d74e13b2a0546fee6737ee4446017903 upstream.
   7
   8 The functions copy_page_to_iter_pipe() and push_pipe() can both
   9 allocate a new pipe_buffer, but the "flags" member initializer is
  10 missing.
  11
  12 Fixes: 241699cd72a8 ("new iov_iter flavour: pipe-backed")
  13 To: Alexander Viro <viro@zeniv.linux.org.uk>
  14 To: linux-fsdevel@vger.kernel.org
  15 To: linux-kernel@vger.kernel.org
  16 Cc: stable@vger.kernel.org
  17 Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
  18 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
  19 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  20 ---
  21  lib/iov_iter.c | 2 ++
  22  1 file changed, 2 insertions(+)
  23
  24 diff --git a/lib/iov_iter.c b/lib/iov_iter.c
  25 index 60b5e6edfbaa..c5b2f0f4b8a8 100644
  26 --- a/lib/iov_iter.c
  27 +++ b/lib/iov_iter.c
  28 @@ -416,6 +416,7 @@ static size_t copy_page_to_iter_pipe(struct page *page, size_t offset, size_t by
  29                 return 0;
  30
  31         buf->ops = &page_cache_pipe_buf_ops;
  32 +       buf->flags = 0;
  33         get_page(page);
  34         buf->page = page;
  35         buf->offset = offset;
  36 @@ -532,6 +533,7 @@ static size_t push_pipe(struct iov_iter *i, size_t size,
  37                         break;
  38
  39                 buf->ops = &default_pipe_buf_ops;
  40 +               buf->flags = 0;
  41                 buf->page = page;
  42                 buf->offset = 0;
  43                 buf->len = min_t(ssize_t, left, PAGE_SIZE);
  44 --
  45 2.30.2
  46