On Tue, 13 Aug 2024, Danilo Krummrich wrote: > As long as krealloc() is called with __GFP_ZERO consistently, starting > with the initial memory allocation, __GFP_ZERO should be fully honored. > > However, if for an existing allocation krealloc() is called with a > decreased size, it is not ensured that the spare portion the allocation > is zeroed. Thus, if krealloc() is subsequently called with a larger size > again, __GFP_ZERO can't be fully honored, since we don't know the > previous size, but only the bucket size. > > Example: > > buf = kzalloc(64, GFP_KERNEL); > memset(buf, 0xff, 64); > > buf = krealloc(buf, 48, GFP_KERNEL | __GFP_ZERO); > > /* After this call the last 16 bytes are still 0xff. */ > buf = krealloc(buf, 64, GFP_KERNEL | __GFP_ZERO); > > Fix this, by explicitly setting spare memory to zero, when shrinking an > allocation with __GFP_ZERO flag set or init_on_alloc enabled. > > Acked-by: Vlastimil Babka <vbabka@xxxxxxx> > Signed-off-by: Danilo Krummrich <dakr@xxxxxxxxxx> Acked-by: David Rientjes <rientjes@xxxxxxxxxx>
