lkml.org 
[lkml]   [2020]   [Jun]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 053/190] ovl: initialize error in ovl_copy_xattr
    Date
    From: Yuxuan Shui <yshuiv7@gmail.com>

    commit 520da69d265a91c6536c63851cbb8a53946974f0 upstream.

    In ovl_copy_xattr, if all the xattrs to be copied are overlayfs private
    xattrs, the copy loop will terminate without assigning anything to the
    error variable, thus returning an uninitialized value.

    If ovl_copy_xattr is called from ovl_clear_empty, this uninitialized error
    value is put into a pointer by ERR_PTR(), causing potential invalid memory
    accesses down the line.

    This commit initialize error with 0. This is the correct value because when
    there's no xattr to copy, because all xattrs are private, ovl_copy_xattr
    should succeed.

    This bug is discovered with the help of INIT_STACK_ALL and clang.

    Signed-off-by: Yuxuan Shui <yshuiv7@gmail.com>
    Link: https://bugs.chromium.org/p/chromium/issues/detail?id=1050405
    Fixes: 0956254a2d5b ("ovl: don't copy up opaqueness")
    Cc: stable@vger.kernel.org # v4.8
    Signed-off-by: Alexander Potapenko <glider@google.com>
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/overlayfs/copy_up.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/fs/overlayfs/copy_up.c
    +++ b/fs/overlayfs/copy_up.c
    @@ -59,7 +59,7 @@ int ovl_copy_xattr(struct dentry *old, s
    {
    ssize_t list_size, size, value_size = 0;
    char *buf, *name, *value = NULL;
    - int uninitialized_var(error);
    + int error = 0;
    size_t slen;

    if (!(old->d_inode->i_opflags & IOP_XATTR) ||

    \
     
     \ /
      Last update: 2020-06-19 18:39    [W:2.908 / U:0.184 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site