Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0053438e authored by Yuxuan Shui's avatar Yuxuan Shui Committed by synt4x93
Browse files

ovl: initialize error in ovl_copy_xattr 



commit 520da69d265a91c6536c63851cbb8a53946974f0 upstream.

In ovl_copy_xattr, if all the xattrs to be copied are overlayfs private
xattrs, the copy loop will terminate without assigning anything to the
error variable, thus returning an uninitialized value.

If ovl_copy_xattr is called from ovl_clear_empty, this uninitialized error
value is put into a pointer by ERR_PTR(), causing potential invalid memory
accesses down the line.

This commit initialize error with 0. This is the correct value because when
there's no xattr to copy, because all xattrs are private, ovl_copy_xattr
should succeed.

This bug is discovered with the help of INIT_STACK_ALL and clang.

Signed-off-by: default avatarYuxuan Shui <yshuiv7@gmail.com>
Link: https://bugs.chromium.org/p/chromium/issues/detail?id=1050405


Fixes: 0956254a ("ovl: don't copy up opaqueness")
Cc: stable@vger.kernel.org # v4.8
Signed-off-by: default avatarAlexander Potapenko <glider@google.com>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: If556348168a737373557db0508df8d2ad517cbeb
parent ee3bfeb5

fs/overlayfs/copy_up.c

+1 −1
Original line number Diff line number Diff line
@@ -56,7 +56,7 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new) 
{

	ssize_t list_size, size, value_size = 0;

	char *buf, *name, *value = NULL;

	int uninitialized_var(error);

	int error = 0;

	size_t slen;



	if (!(old->d_inode->i_opflags & IOP_XATTR) ||