linux-kernel - Re: [PATCH] VDUSE: avoid leaking information to userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJaqyWdciiqB7uvUs0_13zYY9bO_h0KSxGqESDUN0ZRGfuWODg@mail.gmail.com>
Date: Fri, 30 Jan 2026 09:55:18 +0100
From: Eugenio Perez Martin <eperezma@...hat.com>
To: Jason Wang <jasowang@...hat.com>
Cc: mst@...hat.com, virtualization@...ts.linux.dev, 
	linux-kernel@...r.kernel.org, xuanzhuo@...ux.alibaba.com, 
	xieyongji@...edance.com, stable@...r.kernel.org
Subject: Re: [PATCH] VDUSE: avoid leaking information to userspace

On Fri, Jan 30, 2026 at 6:08 AM Jason Wang <jasowang@...hat.com> wrote:
>
> The bounceing is not necessarily page aligned, so current VDUSE can
> leak kernel information through mapping bounce pages to
> userspace. Allocate bounce pages with __GFP_ZERO to avoid leaking
> information to userspace.
>
> Fixes: 8c773d53fb7b ("vduse: Implement an MMU-based software IOTLB")
> Cc: stable@...r.kernel.org

Reviewed-by: Eugenio Pérez <eperezma@...hat.com>

Thanks!

> Signed-off-by: Jason Wang <jasowang@...hat.com>
> ---
>  drivers/vdpa/vdpa_user/iova_domain.c | 2 +-
>  drivers/vdpa/vdpa_user/vduse_dev.c   | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/vdpa/vdpa_user/iova_domain.c b/drivers/vdpa/vdpa_user/iova_domain.c
> index 0a9f668467a8..ec743bed361c 100644
> --- a/drivers/vdpa/vdpa_user/iova_domain.c
> +++ b/drivers/vdpa/vdpa_user/iova_domain.c
> @@ -124,7 +124,7 @@ static int vduse_domain_map_bounce_page(struct vduse_iova_domain *domain,
>                 if (!map->bounce_page) {
>                         head_map = &domain->bounce_maps[(iova & PAGE_MASK) >> BOUNCE_MAP_SHIFT];
>                         if (!head_map->bounce_page) {
> -                               tmp_page = alloc_page(GFP_ATOMIC);
> +                               tmp_page = alloc_page(GFP_ATOMIC | __GFP_ZERO);
>                                 if (!tmp_page)
>                                         return -ENOMEM;
>                                 if (cmpxchg(&head_map->bounce_page, NULL, tmp_page))
> diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c
> index 73d1d517dc6c..57a40a821c65 100644
> --- a/drivers/vdpa/vdpa_user/vduse_dev.c
> +++ b/drivers/vdpa/vdpa_user/vduse_dev.c
> @@ -976,7 +976,7 @@ static void *vduse_dev_alloc_coherent(union virtio_map token, size_t size,
>         if (!token.group)
>                 return NULL;
>
> -       addr = alloc_pages_exact(size, flag);
> +       addr = alloc_pages_exact(size, flag | __GFP_ZERO);
>         if (!addr)
>                 return NULL;
>
> --
> 2.34.1
>