linux-kernel - Re: [PATCH 6/7] zram: Return zero'd pages on new reads

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1296290964.30654.10.camel@jaguar>
Date:	Sat, 29 Jan 2011 10:49:24 +0200
From:	Pekka Enberg <penberg@...helsinki.fi>
To:	Robert Jennings <rcj@...ux.vnet.ibm.com>
Cc:	Nitin Gupta <ngupta@...are.org>,
	Greg Kroah-Hartman <gregkh@...e.de>,
	devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 6/7] zram: Return zero'd pages on new reads

On Fri, 2011-01-28 at 09:00 -0600, Robert Jennings wrote:
> Currently zram will do nothing to the page in the bvec when that page
> has not been previously written.  This allows random data to leak to
> user space.  That can be seen by doing the following:
> 
>  ## Load the module and create a 256Mb zram device called /dev/zram0
>  # modprobe zram
>  # echo $((256*1024*1024)) > /sys/class/block/zram0/disksize
> 
>  ## Initialize the device by writing zero to the first block
>  # dd if=/dev/zero of=/dev/zram0 bs=512 count=1
> 
>  ## Read ~256Mb of memory into a file and hope for something interesting
>  # dd if=/dev/zram0 of=file
> 
> This patch will treat an unwritten page as a zero-filled page.  If a
> page is read before a write has occurred the data returned is all 0's.
> 
> Signed-off-by: Robert Jennings <rcj@...ux.vnet.ibm.com>

Reviewed-by: Pekka Enberg <penberg@...nel.org>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/