Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20200419100848.63472-1-glider@google.com> <20200420153352.6682533e794f591dae7aafbc@linux-foundation.org>
 <202004201540.01C8F82B@keescook>
In-Reply-To: <202004201540.01C8F82B@keescook>
From:   Alexander Potapenko <glider@google.com>
Date:   Tue, 21 Apr 2020 10:06:16 +0200
Message-ID: <CAG_fn=XBn-kKWdoPFhnfOGTXBaMfeziPQJCrgE7KvteSwYLmnA@mail.gmail.com>
Subject: Re: [PATCH] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
To:     Kees Cook <keescook@chromium.org>
Cc:     Andrew Morton <akpm@linux-foundation.org>,
        Alexey Dobriyan <adobriyan@gmail.com>,
        LKML <linux-kernel@vger.kernel.org>, sunhaoyl@outlook.com
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

> Ewww. That's been there for 12 years. Did something change in
> regset_size() or regset->get()? Do you know what leaves the hole?

I don't think anything changed on the kernel side recently.
But I've made some changes to DMA handling recently, which made uninit
writes to the disk discoverable.
We don't use core dumping on syzbot (because the auto-generated
programs crash all the time), so it could be a very old bug that was
triggered in a non-standard setup.