Commit 5494fb2d authored by Christoph Hellwig's avatar Christoph Hellwig Committed by Cheng Yu
Browse files

block: initialize integrity buffer to zero before writing it to media 

stable inclusion
from stable-v6.6.44
commit 23a19655fb56f241e592041156dfb1c6d04da644
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5R
CVE: CVE-2024-43854

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=23a19655fb56f241e592041156dfb1c6d04da644



--------------------------------

[ Upstream commit 899ee2c3829c5ac14bfc7d3c4a5846c0b709b78f ]

Metadata added by bio_integrity_prep is using plain kmalloc, which leads
to random kernel memory being written media.  For PI metadata this is
limited to the app tag that isn't used by kernel generated metadata,
but for non-PI metadata the entire buffer leaks kernel memory.

Fix this by adding the __GFP_ZERO flag to allocations for writes.

Fixes: 7ba1ba12 ("block: Block layer data integrity support")
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: default avatarKanchan Joshi <joshi.k@samsung.com>
Reviewed-by: default avatarChaitanya Kulkarni <kch@nvidia.com>
Link: https://lore.kernel.org/r/20240613084839.1044015-2-hch@lst.de


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Conflicts:
        block/bio-integrity.c
[This is a conflict caused by commit ce288e05("block: remove
BLK_BOUNCE_ISA support") which is not merged.]
Signed-off-by: default avatarCheng Yu <serein.chengyu@huawei.com>
parent 24a02e0a

block/bio-integrity.c

+10 −1
Original line number Diff line number Diff line
@@ -216,6 +216,7 @@ bool bio_integrity_prep(struct bio *bio) 
	unsigned int bytes, offset, i;

	unsigned int intervals;

	blk_status_t status;

	gfp_t gfp = GFP_NOIO;



	if (!bi)

		return true;
@@ -238,12 +239,20 @@ bool bio_integrity_prep(struct bio *bio) 
		if (!bi->profile->generate_fn ||

		    !(bi->flags & BLK_INTEGRITY_GENERATE))

			return true;



		/*

		 * Zero the memory allocated to not leak uninitialized kernel

		 * memory to disk.  For PI this only affects the app tag, but

		 * for non-integrity metadata it affects the entire metadata

		 * buffer.

		 */

		gfp |= __GFP_ZERO;

	}

	intervals = bio_integrity_intervals(bi, bio_sectors(bio));



	/* Allocate kernel buffer for protection data */

	len = intervals * bi->tuple_size;

	buf = kmalloc(len, GFP_NOIO | q->bounce_gfp);

	buf = kmalloc(len, gfp | q->bounce_gfp);

	status = BLK_STS_RESOURCE;

	if (unlikely(buf == NULL)) {

		printk(KERN_ERR "could not allocate integrity buffer\n");