Re: [git pull] coredump infoleak fix

[Ingo Molnar]

* Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote:

> 	xstate note on boxes with xsaves support can leak uninitialized data
> into coredumps
> 
> The following changes since commit 4e89b7210403fa4a8acafe7c602b6212b7af6c3b:
> 
>   fix multiplication overflow in copy_fdtable() (2020-05-19 18:29:36 -0400)
> 
> are available in the git repository at:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes
> 
> for you to fetch changes up to 9e4636545933131de15e1ecd06733538ae939b2f:
> 
>   copy_xstate_to_kernel(): don't leave parts of destination uninitialized (2020-05-27 17:06:31 -0400)
> 
> ----------------------------------------------------------------
> Al Viro (1):
>       copy_xstate_to_kernel(): don't leave parts of destination uninitialized
> 
>  arch/x86/kernel/fpu/xstate.c | 86 ++++++++++++++++++++++++--------------------
>  1 file changed, 48 insertions(+), 38 deletions(-)

Looks good to me.

I'm wondering, shouldn't we also zero-initialize the dump data to 
begin with? See the patch below (untested).

Thanks,

	Ingo

 fs/binfmt_elf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 13f25e241ac4..25d489bc9453 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1733,7 +1733,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
 		    (!regset->active || regset->active(t->task, regset) > 0)) {
 			int ret;
 			size_t size = regset_size(t->task, regset);
-			void *data = kmalloc(size, GFP_KERNEL);
+			void *data = kzalloc(size, GFP_KERNEL);
 			if (unlikely(!data))
 				return 0;
 			ret = regset->get(t->task, regset,