955eff5acc
simple_prepare_write leaks uninitialised kernel data. This happens because the it leaves an uninitialised "hole" over the part of the page that the write is expected to go to. This is fine, but it then marks the page uptodate, which means a concurrent read can come in and copy the uninitialised memory into userspace before it written to. Fix it by simply marking it uptodate in simple_commit_write instead, after the hole has been filled in. This could theoretically break an fs that uses simple_prepare_write and not simple_commit_write, and that relies on the incorrect simple_prepare_write behaviour. Luckily, none of those exists in the tree. Signed-off-by: Nick Piggin <npiggin@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
|---|---|---|
| .. | ||
| configfs | ||
| 9p.txt | ||
| 00-INDEX | ||
| adfs.txt | ||
| affs.txt | ||
| afs.txt | ||
| automount-support.txt | ||
| befs.txt | ||
| bfs.txt | ||
| cifs.txt | ||
| coda.txt | ||
| cramfs.txt | ||
| dentry-locking.txt | ||
| directory-locking | ||
| dlmfs.txt | ||
| Exporting | ||
| ext2.txt | ||
| ext3.txt | ||
| ext4.txt | ||
| files.txt | ||
| fuse.txt | ||
| gfs2.txt | ||
| hfs.txt | ||
| hpfs.txt | ||
| inotify.txt | ||
| isofs.txt | ||
| jfs.txt | ||
| Locking | ||
| ncpfs.txt | ||
| ntfs.txt | ||
| ocfs2.txt | ||
| porting | ||
| proc.txt | ||
| ramfs-rootfs-initramfs.txt | ||
| relay.txt | ||
| romfs.txt | ||
| smbfs.txt | ||
| spufs.txt | ||
| sysfs-pci.txt | ||
| sysfs.txt | ||
| sysv-fs.txt | ||
| tmpfs.txt | ||
| udf.txt | ||
| ufs.txt | ||
| vfat.txt | ||
| vfs.txt | ||
| xfs.txt | ||
| xip.txt | ||