block: Clear kernel memory before copying to user

Keith Busch · axboe · commit f3587d76da05 · 2018-11-07T15:41:31.000-07:00
If the kernel allocates a bounce buffer for user read data, this memory
needs to be cleared before copying it to the user, otherwise it may leak
kernel memory to user space.

Laurence Oberman &lt;loberman@redhat.com&gt;
Signed-off-by: Keith Busch &lt;keith.busch@intel.com&gt;
Signed-off-by: Jens Axboe &lt;axboe@kernel.dk&gt;
diff --git a/block/bio.c b/block/bio.c
@@ -1260,6 +1260,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
 		if (ret)
 			goto cleanup;
 	} else {
+		zero_fill_bio(bio);
 		iov_iter_advance(iter, bio->bi_iter.bi_size);
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -1260,6 +1260,7 @@ struct bio bio_copy_user_iov(struct request_queue q,`
`1260`	`1260`	`if (ret)`
`1261`	`1261`	`goto cleanup;`
`1262`	`1262`	`} else {`
	`1263`	`+ zero_fill_bio(bio);`
`1263`	`1264`	`iov_iter_advance(iter, bio->bi_iter.bi_size);`
`1264`	`1265`	`}`
`1265`	`1266`