Skip to content

Commit bc0d89b

Browse files
asomerstonyhutter
authored andcommitted
Fix an uninitialized data access (openzfs#16511)
zfs_acl_node_alloc allocates an uninitialized data buffer, but upstack zfs_acl_chmod only partially initializes it. KMSAN reported that this memory remained uninitialized at the point when it was read by lzjb_compress, which suggests a possible kernel memory disclosure bug. The full KMSAN warning may be found in the PR. openzfs#16511 Signed-off-by: Alan Somers <[email protected]> Sponsored by: Axcient Reviewed-by: Alexander Motin <[email protected]> Reviewed-by: Tony Hutter <[email protected]>
1 parent 25ec9a9 commit bc0d89b

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

module/os/freebsd/zfs/zfs_acl.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -473,7 +473,7 @@ zfs_acl_node_alloc(size_t bytes)
473473

474474
aclnode = kmem_zalloc(sizeof (zfs_acl_node_t), KM_SLEEP);
475475
if (bytes) {
476-
aclnode->z_acldata = kmem_alloc(bytes, KM_SLEEP);
476+
aclnode->z_acldata = kmem_zalloc(bytes, KM_SLEEP);
477477
aclnode->z_allocdata = aclnode->z_acldata;
478478
aclnode->z_allocsize = bytes;
479479
aclnode->z_size = bytes;

module/os/linux/zfs/zfs_acl.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -471,7 +471,7 @@ zfs_acl_node_alloc(size_t bytes)
471471

472472
aclnode = kmem_zalloc(sizeof (zfs_acl_node_t), KM_SLEEP);
473473
if (bytes) {
474-
aclnode->z_acldata = kmem_alloc(bytes, KM_SLEEP);
474+
aclnode->z_acldata = kmem_zalloc(bytes, KM_SLEEP);
475475
aclnode->z_allocdata = aclnode->z_acldata;
476476
aclnode->z_allocsize = bytes;
477477
aclnode->z_size = bytes;

0 commit comments

Comments
 (0)