Unverified Commit cb184dd1 authored by Edward Adam Davis's avatar Edward Adam Davis Committed by Christian Brauner
Browse files

fs: init flags_valid before calling vfs_fileattr_get 



syzbot reported a uninit-value bug in [1].

Similar to the "*get" context where the kernel's internal file_kattr
structure is initialized before calling vfs_fileattr_get(), we should
use the same mechanism when using fa.

[1]
BUG: KMSAN: uninit-value in fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517
 fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517
 vfs_fileattr_get fs/file_attr.c:94 [inline]
 __do_sys_file_getattr fs/file_attr.c:416 [inline]

Local variable fa.i created at:
 __do_sys_file_getattr fs/file_attr.c:380 [inline]
 __se_sys_file_getattr+0x8c/0xbd0 fs/file_attr.c:372

Reported-by: default avatar <syzbot+7c31755f2cea07838b0c@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=7c31755f2cea07838b0c


Tested-by: default avatar <syzbot+7c31755f2cea07838b0c@syzkaller.appspotmail.com>
Signed-off-by: default avatarEdward Adam Davis <eadavis@qq.com>
Link: https://patch.msgid.link/tencent_B6C4583771D76766D71362A368696EC3B605@qq.com


Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent 770aaedb

fs/file_attr.c

+1 −1
Original line number Diff line number Diff line
@@ -376,7 +376,7 @@ SYSCALL_DEFINE5(file_getattr, int, dfd, const char __user *, filename, 
	struct path filepath __free(path_put) = {};

	unsigned int lookup_flags = 0;

	struct file_attr fattr;

	struct file_kattr fa;

	struct file_kattr fa = { .flags_valid = true }; /* hint only */

	int error;



	BUILD_BUG_ON(sizeof(struct file_attr) < FILE_ATTR_SIZE_VER0);