Skip to content

Commit cb184dd

Browse files
ea1davisbrauner
authored andcommitted
fs: init flags_valid before calling vfs_fileattr_get
syzbot reported a uninit-value bug in [1]. Similar to the "*get" context where the kernel's internal file_kattr structure is initialized before calling vfs_fileattr_get(), we should use the same mechanism when using fa. [1] BUG: KMSAN: uninit-value in fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517 fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517 vfs_fileattr_get fs/file_attr.c:94 [inline] __do_sys_file_getattr fs/file_attr.c:416 [inline] Local variable fa.i created at: __do_sys_file_getattr fs/file_attr.c:380 [inline] __se_sys_file_getattr+0x8c/0xbd0 fs/file_attr.c:372 Reported-by: syzbot+7c31755f2cea07838b0c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7c31755f2cea07838b0c Tested-by: syzbot+7c31755f2cea07838b0c@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@qq.com> Link: https://patch.msgid.link/tencent_B6C4583771D76766D71362A368696EC3B605@qq.com Signed-off-by: Christian Brauner <brauner@kernel.org>
1 parent 770aaed commit cb184dd

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

fs/file_attr.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -376,7 +376,7 @@ SYSCALL_DEFINE5(file_getattr, int, dfd, const char __user *, filename,
376376
struct path filepath __free(path_put) = {};
377377
unsigned int lookup_flags = 0;
378378
struct file_attr fattr;
379-
struct file_kattr fa;
379+
struct file_kattr fa = { .flags_valid = true }; /* hint only */
380380
int error;
381381

382382
BUILD_BUG_ON(sizeof(struct file_attr) < FILE_ATTR_SIZE_VER0);

0 commit comments

Comments
 (0)