diff options
| author | Max Kellermann <max.kellermann@ionos.com> | 2022-03-08 17:34:09 +0800 |
|---|---|---|
| committer | Zheng Zengkai <zhengzengkai@huawei.com> | 2022-03-09 16:58:27 +0800 |
| commit | 55eea973b66c48c33bbae62c739b0b1435ae11ec (patch) | |
| tree | d97b817b3e0c48d91ddb56f97177c73464e79186 | |
| parent | 1d48e14a7a15b509650b554f8deb66d7fc82ccc1 (diff) | |
| download | openEuler-kernel-openEuler-21.09.tar.gz | |
lib/iov_iter: initialize "flags" in new pipe_bufferopenEuler-21.09
mainline inclusion
from mainline-v5.17-rc6
commit 9d2231c5d74e13b2a0546fee6737ee4446017903
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I4WUKP?from=project-issue
CVE: CVE-2022-0847
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/lib/iov_iter.c?id=9d2231c5d74e13b2a0546fee6737ee4446017903
--------------------------------
The functions copy_page_to_iter_pipe() and push_pipe() can both
allocate a new pipe_buffer, but the "flags" member initializer is
missing.
Fixes: 241699cd72a8 ("new iov_iter flavour: pipe-backed")
To: Alexander Viro <viro@zeniv.linux.org.uk>
To: linux-fsdevel@vger.kernel.org
To: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com>
| -rw-r--r-- | lib/iov_iter.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/lib/iov_iter.c b/lib/iov_iter.c index f0b2ccb1bb0182..33a88a7e72d98a 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -407,6 +407,7 @@ static size_t copy_page_to_iter_pipe(struct page *page, size_t offset, size_t by return 0; buf->ops = &page_cache_pipe_buf_ops; + buf->flags = 0; get_page(page); buf->page = page; buf->offset = offset; @@ -543,6 +544,7 @@ static size_t push_pipe(struct iov_iter *i, size_t size, break; buf->ops = &default_pipe_buf_ops; + buf->flags = 0; buf->page = page; buf->offset = 0; buf->len = min_t(ssize_t, left, PAGE_SIZE); |