From: Shivam Kalra <shivamkalra98@zohomail.in>
When growing an existing vmalloc allocation in-place, zero the newly
exposed memory region [old_size, size) if the caller requested it via
__GFP_ZERO (checked via want_init_on_alloc(flags)).
Previously, the code assumed that the unused capacity in the vm_struct
was already zeroed either at initial allocation time or during a prior
shrink. However, if an intermediate shrink operation occurred without
__GFP_ZERO and without init_on_free enabled, the "freed" portion of the
allocation would retain its old data.
If a subsequent grow-in-place operation then explicitly requests
__GFP_ZERO, failing to zero the memory here would violate the allocation
flags and leak the previously discarded, potentially sensitive data.
Signed-off-by: Shivam Kalra <shivamkalra98@zohomail.in>
---
mm/vmalloc.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 133c3b0418fe..ddb689bf9ba5 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -4368,13 +4368,16 @@ void *vrealloc_node_align_noprof(const void *p, size_t size, unsigned long align
* We already have the bytes available in the allocation; use them.
*/
if (size <= (size_t)vm->nr_pages << PAGE_SHIFT) {
- /*
- * No need to zero memory here, as unused memory will have
- * already been zeroed at initial allocation time or during
- * realloc shrink time.
- */
vm->requested_size = size;
kasan_vrealloc(p, old_size, size);
+
+ /*
+ * Zero the newly exposed bytes if requested.
+ * The region [old_size, size) may contain stale data from
+ * a previous shrink that did not use __GFP_ZERO.
+ */
+ if (want_init_on_alloc(flags))
+ memset((void *)p + old_size, 0, size - old_size);
return (void *)p;
}
--
2.43.0