]>
Commit | Line | Data |
---|---|---|
6e071e54 GKH |
1 | From nab@linux-iscsi.org Fri Jun 27 17:13:41 2014 |
2 | From: "Nicholas A. Bellinger" <nab@linux-iscsi.org> | |
3 | Date: Mon, 16 Jun 2014 20:59:52 +0000 | |
4 | Subject: [PATCH] target: Explicitly clear ramdisk_mcp backend pages | |
5 | To: target-devel <target-devel@vger.kernel.org> | |
6 | Cc: Greg-KH <gregkh@linuxfoundation.org>, stable <stable@vger.kernel.org>, Nicholas Bellinger <nab@linux-iscsi.org>, Jorge Daniel Sequeira Matias <jdsm@tecnico.ulisboa.pt> | |
7 | Message-ID: <1402952392-30762-1-git-send-email-nab@linux-iscsi.org> | |
8 | ||
9 | ||
10 | [Note that a different patch to address the same issue went in during | |
11 | v3.15-rc1 (commit 4442dc8a), but includes a bunch of other changes that | |
12 | don't strictly apply to fixing the bug] | |
13 | ||
14 | This patch changes rd_allocate_sgl_table() to explicitly clear | |
15 | ramdisk_mcp backend memory pages by passing __GFP_ZERO into | |
16 | alloc_pages(). | |
17 | ||
18 | This addresses a potential security issue where reading from a | |
19 | ramdisk_mcp could return sensitive information, and follows what | |
20 | >= v3.15 does to explicitly clear ramdisk_mcp memory at backend | |
21 | device initialization time. | |
22 | ||
23 | Reported-by: Jorge Daniel Sequeira Matias <jdsm@tecnico.ulisboa.pt> | |
24 | Cc: Jorge Daniel Sequeira Matias <jdsm@tecnico.ulisboa.pt> | |
25 | Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> | |
26 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
27 | ||
28 | --- | |
29 | drivers/target/target_core_rd.c | 2 +- | |
30 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
31 | ||
32 | --- a/drivers/target/target_core_rd.c | |
33 | +++ b/drivers/target/target_core_rd.c | |
34 | @@ -177,7 +177,7 @@ static int rd_build_device_space(struct | |
35 | - 1; | |
36 | ||
37 | for (j = 0; j < sg_per_table; j++) { | |
38 | - pg = alloc_pages(GFP_KERNEL, 0); | |
39 | + pg = alloc_pages(GFP_KERNEL | __GFP_ZERO, 0); | |
40 | if (!pg) { | |
41 | pr_err("Unable to allocate scatterlist" | |
42 | " pages for struct rd_dev_sg_table\n"); |