Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Yuxuan Shui <yshuiv7@gmail.com>
To:     Miklos Szeredi <miklos@szeredi.hu>
Cc:     linux-unionfs@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] overlayfs: initialize error in ovl_copy_xattr
Date:   Wed, 27 May 2020 04:08:02 +0100
Message-ID: <874ks212uj.fsf@m5Zedd9JOGzJrf0>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
        micalg=pgp-sha256; protocol="application/pgp-signature"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

--=-=-=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable


In ovl_copy_xattr, if all the xattrs to be copied are overlayfs private
xattrs, the copy loop will terminate without assigning anything to the
error variable, thus returning an uninitialized value.

If ovl_copy_xattr is called from ovl_clear_empty, this uninitialized
error value is put into a pointer by ERR_PTR(), causing potential
invalid memory accesses down the line.

This commit initialize error with 0. This is the correct value because
when there's no xattr to copy, because all xattrs are private,
ovl_copy_xattr should succeed.

This bug is discovered with the help of INIT_STACK_ALL and clang.

Signed-off-by: Yuxuan Shui <yshuiv7@gmail.com>
=2D--
 fs/overlayfs/copy_up.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 9709cf22cab3..07e0d1961e96 100644
=2D-- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -47,7 +47,7 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
 {
 	ssize_t list_size, size, value_size =3D 0;
 	char *buf, *name, *value =3D NULL;
=2D	int uninitialized_var(error);
+	int error =3D 0;
 	size_t slen;
=20
 	if (!(old->d_inode->i_opflags & IOP_XATTR) ||
=2D-=20
2.26.2


--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEL6EJkr0WlitWahBy06RAW+bMF/QFAl7N3FkACgkQ06RAW+bM
F/RKGg/+Mal8/fZGFJmB4SjmletMefSDfnlLnsTfMQC75ZepOCCixJQG+7+DGH1b
T3QsqDVBpl8W73SGGqo/45FewG7zD2Yedmg9SdFUwQsLVfXA+QhH0umAehO1MAG7
3jhn4jEC7YL5RRhc0BwSbrQA+1N9Mq4UBn0aai1W+dhbsibY86EIvpaJzZzT/Btc
BrxOtM522VtL6ZGxuz5tfSn1yQxNMBGB754q0wP7b9xo79ImNHcNnOUaqFCWVcOc
W/B0ThhhJALiP/GEa+cuRzdRYfR6JmASW/EoCHzHkZ6YWgf4inRD/hF/4Ml/p++W
aQAxyiRsiUUmEQUD4vGcYQa4ssBsiengGM++c7VoqKX+TGtxKCOGfed8/W6A2CLV
62yMEA477fKvpU2mLa3XuJptyoqr3hNb00JNKBj/Z9cuDOn9mxjYbdYyQlSlH3XI
2kj5cW1hfhdvvoDIWrE1lUzhGsXac6KS5MPh2vJL6DobJDOEoNI2o8hWN9fplPpr
TjtszOyFuFuwRDURfhl/4/80i/T7jcbGR0SLkNkB5s2Ic7u8lLJRrqyb9JLeGJI2
ExJ650h9rsg5QWvx2LEpI21TX8XbCorwc1zCHpghCijO3qUg0eTXmYHevmZXK7DH
GYQJVI35TFHxIBvFM+Wo/Nl+OB0iaeFePOe3G0j6oVPHOsW7oIk=
=nXDi
-----END PGP SIGNATURE-----
--=-=-=--