tree 04455b3aee1fcb5b181aafb8dd8a61e59cd126f2
parent 6ba5a6c5aca37e26920859aff478293643008235
author Jann Horn <jannh@google.com> 1722973902 +0200
committer Kevin Berry <kpberry@google.com> 1726705316 +0000

fuse: Initialize beyond-EOF page contents before setting uptodate

commit 3c0da3d163eb32f1f91891efaade027fa9b245b9 upstream.

fuse_notify_store(), unlike fuse_do_readpage(), does not enable page
zeroing (because it can be used to change partial page contents).

So fuse_notify_store() must be more careful to fully initialize page
contents (including parts of the page that are beyond end-of-file)
before marking the page uptodate.

The current code can leave beyond-EOF page contents uninitialized, which
makes these uninitialized page contents visible to userspace via mmap().

This is an information leak, but only affects systems which do not
enable init-on-alloc (via CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y or the
corresponding kernel command line parameter).

BUG=b/367628103
TEST=presubmit
RELEASE_NOTE=Fixes CVE-2024-44947 in the Linux kernel

cos-patch: security-moderate
Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2574
Cc: stable@kernel.org
Fixes: a1d75f258230 ("fuse: add store request")
Change-Id: I49dba116f6b0f6fad716e5444cd5739ef1f27221
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kernel CVE Triage Automation <cloud-image-kernel-cve-triage-automation@prod.google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/81302
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>
Reviewed-by: Kevin Berry <kpberry@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>