Re: [PATCH] configfs: zero the write buffer on allocation

[Priya Bala Govindasamy]

On Mon, Oct 19, 2026 at 5:35 AM Andreas Hindborg <a.hindborg@xxxxxxxxxx> wrote:
>
> Breno Leitao <leitao@xxxxxxxxxx> writes:
>
> > fill_write_buffer() allocates the per-open buffer page with kmalloc()
> > and initializes only the bytes copied from userspace plus the
> > terminating NUL. fill_read_buffer() reuses that page if it is already
> > allocated.
> >
> > After a write, a read on the same file descriptor therefore passes
> > ->show() a page that still holds stale heap data. A ->show() that
> > returns only what it wrote never notices, but one that returns a length
> > covering bytes it did not write leaks that data to userspace.
> >
> > The Rust bindings are exposed more directly: ->show() receives the page
> > as an &mut [u8; PAGE_SIZE], so a driver can read the uninitialized
> > bytes.
> >
> > fill_read_buffer() already allocates the same page with kzalloc(). Do
> > the same here, so the page is initialized whichever path allocates it.
> > The cost is zeroing one page the first time a file is written.
> >
> > Link: https://urldefense.com/v3/__https://lore.kernel.org/r/cover.1790981219.git.pgovind2@uci.edu__;!!CzAuKJ42GuquVTTmVmPViYEvSg!MzBh-OGC90bot_58mikAXuNn-ZOko4X3HdO1al7Y_kCFHVAaLPKpyhKVLgRpDkWqziXPzvRGlJPkvD9e-ZWTkA$
> > Suggested-by: Andreas Hindborg <a.hindborg@xxxxxxxxxx>
> > Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>
>
> Reviewed-by: Andreas Hindborg <a.hindborg@xxxxxxxxxx>
>
>
> Best regards,
> Andreas Hindborg
>
>

I tested this patch on v7.3-rc5 against the PoC I provided earlier [1]
and it works correctly.
Without the patch, the PoC shows that the first 8 bytes observed by
`show()` were:
  [78, 0, fb, 4f, 83, 88, ff, ff]
With the patch applied, the same bytes were:
  [78, 0, 0, 0, 0, 0, 0, 0]
so the reference is no longer created from uninitialized memory. I did
not see any new warnings in dmesg.

Tested-by: Priya Bala Govindasamy <pgovind2@xxxxxxx>

[1] https://lore.kernel.org/all/cover.1790981219.git.pgovind2@xxxxxxx/