diff options
| author | Yousef Alhouseen <alhouseenyousef@gmail.com> | 2026-06-28 02:43:14 +0200 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2026-07-28 21:12:01 -0700 |
| commit | 31fd8876a3447b62785976feb99b92ba5ea8b387 (patch) | |
| tree | 6e5adc648f36e899e149eff2326a4584b3c08fa8 /tools/lib/python/kdoc | |
| parent | efcf17453c7c3661aa6ac1c5d5a5b31284220797 (diff) | |
tmpfs: zero unused folio tail for long symlinks
shmem_symlink() marks the entire folio uptodate after copying only the
NUL-terminated link target. The remainder of the freshly allocated folio
is left uninitialized.
Reclaim may pass the whole folio to a swap compressor. KMSAN observed
sw842_compress() computing a checksum over the uninitialized tail. If the
folio is written to a swap device, those bytes can also leave the kernel.
Zero the remainder of the folio before marking it uptodate and dirty.
Link: https://lore.kernel.org/20260628004314.27370-1-alhouseenyousef@gmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+bf5586280a66e9ccdfa9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=bf5586280a66e9ccdfa9
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'tools/lib/python/kdoc')
0 files changed, 0 insertions, 0 deletions