Re: [PATCH] configfs: zero the write buffer on allocation

[Breno Leitao]

On Thu, 15 Oct 2026 06:20:38 -0700, Breno Leitao wrote:
> fill_write_buffer() allocates the per-open buffer page with kmalloc()
> and initializes only the bytes copied from userspace plus the
> terminating NUL. fill_read_buffer() reuses that page if it is already
> allocated.
> 
> After a write, a read on the same file descriptor therefore passes
> ->show() a page that still holds stale heap data. A ->show() that
> returns only what it wrote never notices, but one that returns a length
> covering bytes it did not write leaks that data to userspace.
> 
> [...]

Applied, thanks!

[1/1] configfs: zero the write buffer on allocation
      https://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux.git/commit/?id=ea00693fd86e

Best regards,
-- 
Breno Leitao <leitao@xxxxxxxxxx>