[PATCH] configfs: zero the write buffer on allocation

[Breno Leitao]

fill_write_buffer() allocates the per-open buffer page with kmalloc()
and initializes only the bytes copied from userspace plus the
terminating NUL. fill_read_buffer() reuses that page if it is already
allocated.

After a write, a read on the same file descriptor therefore passes
->show() a page that still holds stale heap data. A ->show() that
returns only what it wrote never notices, but one that returns a length
covering bytes it did not write leaks that data to userspace.

The Rust bindings are exposed more directly: ->show() receives the page
as an &mut [u8; PAGE_SIZE], so a driver can read the uninitialized
bytes.

fill_read_buffer() already allocates the same page with kzalloc(). Do
the same here, so the page is initialized whichever path allocates it.
The cost is zeroing one page the first time a file is written.

Link: https://lore.kernel.org/r/cover.1790981219.git.pgovind2@xxxxxxx
Suggested-by: Andreas Hindborg <a.hindborg@xxxxxxxxxx>
Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>
---
 fs/configfs/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/configfs/file.c b/fs/configfs/file.c
index 6460b000c593..a4b58616352c 100644
--- a/fs/configfs/file.c
+++ b/fs/configfs/file.c
@@ -184,7 +184,7 @@ static int fill_write_buffer(struct configfs_buffer *buffer,
 	int copied;
 
 	if (!buffer->page)
-		buffer->page = kmalloc(PAGE_SIZE, GFP_KERNEL);
+		buffer->page = kzalloc(PAGE_SIZE, GFP_KERNEL);
 	if (!buffer->page)
 		return -ENOMEM;
 

---
base-commit: 21671ce5ad38e0543331604bd96144d4d0d3b421
change-id: 20261015-b4-configfs_kzalloc-ca337878cdcb

Best regards,
--  
Breno Leitao <leitao@xxxxxxxxxx>