Commit f99260b7 authored by Zhao Mengmeng's avatar Zhao Mengmeng Committed by Hongbo Li
Browse files

jfs: Fix uninit-value access of new_ea in ea_buffer 

mainline inclusion
from mainline-v6.12-rc1
commit 2b59ffad47db1c46af25ccad157bb3b25147c35c
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR97
CVE: CVE-2024-49900

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2b59ffad47db1c46af25ccad157bb3b25147c35c



--------------------------------

syzbot reports that lzo1x_1_do_compress is using uninit-value:

=====================================================
BUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178

...

Uninit was stored to memory at:
 ea_put fs/jfs/xattr.c:639 [inline]

...

Local variable ea_buf created at:
 __jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662
 __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934

=====================================================

The reason is ea_buf->new_ea is not initialized properly.

Fix this by using memset to empty its content at the beginning
in ea_get().

Reported-by: default avatar <syzbot+02341e0daa42a15ce130@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=02341e0daa42a15ce130


Signed-off-by: default avatarZhao Mengmeng <zhaomengmeng@kylinos.cn>
Signed-off-by: default avatarDave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: default avatarHongbo Li <lihongbo22@huawei.com>
parent 9d0af12b

fs/jfs/xattr.c

+2 −0
Original line number Diff line number Diff line
@@ -434,6 +434,8 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size) 
	int rc;

	int quota_allocation = 0;



	memset(&ea_buf->new_ea, 0, sizeof(ea_buf->new_ea));



	/* When fsck.jfs clears a bad ea, it doesn't clear the size */

	if (ji->ea.flag == 0)

		ea_size = 0;