Commit 4acadda7 authored by Richard Weinberger's avatar Richard Weinberger

ubifs: Don't leak kernel memory to the MTD

When UBIFS prepares data structures which will be written to the MTD it
ensues that their lengths are multiple of 8. Since it uses kmalloc() the
padded bytes are left uninitialized and we leak a few bytes of kernel
memory to the MTD.
To make sure that all bytes are initialized, let's switch to kzalloc().
Kzalloc() is fine in this case because the buffers are not huge and in
the IO path the performance bottleneck is anyway the MTD.

Cc: stable@vger.kernel.org
Fixes: 1e51764a ("UBIFS: add new flash file system")
Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
Reviewed-by: default avatarBoris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
parent 480a1a6a
...@@ -572,7 +572,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir, ...@@ -572,7 +572,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,
/* Make sure to also account for extended attributes */ /* Make sure to also account for extended attributes */
len += host_ui->data_len; len += host_ui->data_len;
dent = kmalloc(len, GFP_NOFS); dent = kzalloc(len, GFP_NOFS);
if (!dent) if (!dent)
return -ENOMEM; return -ENOMEM;
...@@ -968,7 +968,7 @@ int ubifs_jnl_xrename(struct ubifs_info *c, const struct inode *fst_dir, ...@@ -968,7 +968,7 @@ int ubifs_jnl_xrename(struct ubifs_info *c, const struct inode *fst_dir,
if (twoparents) if (twoparents)
len += plen; len += plen;
dent1 = kmalloc(len, GFP_NOFS); dent1 = kzalloc(len, GFP_NOFS);
if (!dent1) if (!dent1)
return -ENOMEM; return -ENOMEM;
...@@ -1116,7 +1116,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir, ...@@ -1116,7 +1116,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir,
len = aligned_dlen1 + aligned_dlen2 + ALIGN(ilen, 8) + ALIGN(plen, 8); len = aligned_dlen1 + aligned_dlen2 + ALIGN(ilen, 8) + ALIGN(plen, 8);
if (move) if (move)
len += plen; len += plen;
dent = kmalloc(len, GFP_NOFS); dent = kzalloc(len, GFP_NOFS);
if (!dent) if (!dent)
return -ENOMEM; return -ENOMEM;
...@@ -1498,7 +1498,7 @@ int ubifs_jnl_delete_xattr(struct ubifs_info *c, const struct inode *host, ...@@ -1498,7 +1498,7 @@ int ubifs_jnl_delete_xattr(struct ubifs_info *c, const struct inode *host,
hlen = host_ui->data_len + UBIFS_INO_NODE_SZ; hlen = host_ui->data_len + UBIFS_INO_NODE_SZ;
len = aligned_xlen + UBIFS_INO_NODE_SZ + ALIGN(hlen, 8); len = aligned_xlen + UBIFS_INO_NODE_SZ + ALIGN(hlen, 8);
xent = kmalloc(len, GFP_NOFS); xent = kzalloc(len, GFP_NOFS);
if (!xent) if (!xent)
return -ENOMEM; return -ENOMEM;
...@@ -1605,7 +1605,7 @@ int ubifs_jnl_change_xattr(struct ubifs_info *c, const struct inode *inode, ...@@ -1605,7 +1605,7 @@ int ubifs_jnl_change_xattr(struct ubifs_info *c, const struct inode *inode,
aligned_len1 = ALIGN(len1, 8); aligned_len1 = ALIGN(len1, 8);
aligned_len = aligned_len1 + ALIGN(len2, 8); aligned_len = aligned_len1 + ALIGN(len2, 8);
ino = kmalloc(aligned_len, GFP_NOFS); ino = kzalloc(aligned_len, GFP_NOFS);
if (!ino) if (!ino)
return -ENOMEM; return -ENOMEM;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment