[3.13.y.z extended stable] Patch "sysfs: make sure read buffer is zeroed" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    sysfs: make sure read buffer is zeroed

to the linux-3.13.y-queue branch of the 3.13.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.13.y-queue

This patch is scheduled to be released in version 3.13.11.4.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.13.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From a556fc4fe6f50f57c96922ea5199e3e7f4cd3053 Mon Sep 17 00:00:00 2001
From: Tejun Heo <tj at kernel.org>
Date: Mon, 19 May 2014 15:52:10 -0400
Subject: sysfs: make sure read buffer is zeroed

commit f5c16f29bf5e57ba4051fc7785ba7f035f798c71 upstream.

13c589d5b0ac ("sysfs: use seq_file when reading regular files")
switched sysfs from custom read implementation to seq_file to enable
later transition to kernfs.  After the change, the buffer passed to
->show() is acquired through seq_get_buf(); unfortunately, this
introduces a subtle behavior change.  Before the commit, the buffer
passed to ->show() was always zero as it was allocated using
get_zeroed_page().  Because seq_file doesn't clear buffers on
allocation and neither does seq_get_buf(), after the commit, depending
on the behavior of ->show(), we may end up exposing uninitialized data
to userland thus possibly altering userland visible behavior and
leaking information.

Fix it by explicitly clearing the buffer.

Signed-off-by: Tejun Heo <tj at kernel.org>
Reported-by: Ron <ron at debian.org>
Fixes: 13c589d5b0ac ("sysfs: use seq_file when reading regular files")
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 fs/sysfs/file.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 35e7d08..ea3e7e2 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -94,12 +94,13 @@ static int sysfs_seq_show(struct seq_file *sf, void *v)
 	char *buf;
 	ssize_t count;

-	/* acquire buffer and ensure that it's >= PAGE_SIZE */
+	/* acquire buffer and ensure that it's >= PAGE_SIZE and clear */
 	count = seq_get_buf(sf, &buf);
 	if (count < PAGE_SIZE) {
 		seq_commit(sf, -1);
 		return 0;
 	}
+	memset(buf, 0, PAGE_SIZE);

 	/*
 	 * Need @of->sd for attr and ops, its parent for kobj.  @of->mutex
--
1.9.1