5.4-stable patches

added patches:
	fuse-initialize-beyond-eof-page-contents-before-setting-uptodate.patch

diff --git a/queue-5.4/fuse-initialize-beyond-eof-page-contents-before-setting-uptodate.patch b/queue-5.4/fuse-initialize-beyond-eof-page-contents-before-setting-uptodate.patch
new file mode 100644 (file)
index 0000000..a65d9ee
--- /dev/null
+++ b/queue-5.4/fuse-initialize-beyond-eof-page-contents-before-setting-uptodate.patch
@@ -0,0 +1,49 @@
+From 3c0da3d163eb32f1f91891efaade027fa9b245b9 Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Tue, 6 Aug 2024 21:51:42 +0200
+Subject: fuse: Initialize beyond-EOF page contents before setting uptodate
+
+From: Jann Horn <jannh@google.com>
+
+commit 3c0da3d163eb32f1f91891efaade027fa9b245b9 upstream.
+
+fuse_notify_store(), unlike fuse_do_readpage(), does not enable page
+zeroing (because it can be used to change partial page contents).
+
+So fuse_notify_store() must be more careful to fully initialize page
+contents (including parts of the page that are beyond end-of-file)
+before marking the page uptodate.
+
+The current code can leave beyond-EOF page contents uninitialized, which
+makes these uninitialized page contents visible to userspace via mmap().
+
+This is an information leak, but only affects systems which do not
+enable init-on-alloc (via CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y or the
+corresponding kernel command line parameter).
+
+Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2574
+Cc: stable@kernel.org
+Fixes: a1d75f258230 ("fuse: add store request")
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/fuse/dev.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -1626,9 +1626,11 @@ static int fuse_notify_store(struct fuse
+ 
+               this_num = min_t(unsigned, num, PAGE_SIZE - offset);
+               err = fuse_copy_page(cs, &page, offset, this_num, 0);
+-              if (!err && offset == 0 &&
+-                  (this_num == PAGE_SIZE || file_size == end))
++              if (!PageUptodate(page) && !err && offset == 0 &&
++                  (this_num == PAGE_SIZE || file_size == end)) {
++                      zero_user_segment(page, this_num, PAGE_SIZE);
+                       SetPageUptodate(page);
++              }
+               unlock_page(page);
+               put_page(page);
+ 

diff --git a/queue-5.4/series b/queue-5.4/series
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..e834c81ba8ef23c48819d4a77cfed7e46e5f42bd 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -0,0 +1 @@
+fuse-initialize-beyond-eof-page-contents-before-setting-uptodate.patch