kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/fs/overlayfs
History
Qing Wang 8ae999c410 ovl: Fix uninit-value in ovl_fill_real 
[ Upstream commit 1992330d90 ]

Syzbot reported a KMSAN uninit-value issue in ovl_fill_real.

This iusse's call chain is:
__do_sys_getdents64()
    -> iterate_dir()
        ...
            -> ext4_readdir()
                -> fscrypt_fname_alloc_buffer() // alloc
                -> fscrypt_fname_disk_to_usr // write without tail '\0'
                -> dir_emit()
                    -> ovl_fill_real() // read by strcmp()

The string is used to store the decrypted directory entry name for an
encrypted inode. As shown in the call chain, fscrypt_fname_disk_to_usr()
write it without null-terminate. However, ovl_fill_real() uses strcmp() to
compare the name against "..", which assumes a null-terminated string and
may trigger a KMSAN uninit-value warning when the buffer tail contains
uninit data.

Reported-by: syzbot+d130f98b2c265fae5297@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d130f98b2c265fae5297
Fixes: 4edb83bb10 ("ovl: constant d_ino for non-merge dirs")
Signed-off-by: Qing Wang <wangqing7171@gmail.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Link: https://patch.msgid.link/20260128132406.23768-2-amir73il@gmail.com
Acked-by: Miklos Szeredi <mszeredi@redhat.com>
Reviewed-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-02-26 14:59:34 -08:00
..
copy_up.c Revert "fs: make vfs_fileattr_[get|set] return -EOPNOTSUPP" 2025-10-10 13:44:03 +02:00
dir.c ovl: make sure that ovl_create_real() returns a hashed dentry 2025-09-23 12:29:36 +02:00
export.c VFS: rename lookup_one_len family to lookup_noperm and remove permission check 2025-04-08 11:24:36 +02:00
file.c ovl: remove redundant IOCB_DIO_CALLER_COMP clearing 2025-10-10 14:02:47 +02:00
inode.c Revert "fs: make vfs_fileattr_[get|set] return -EOPNOTSUPP" 2025-10-10 13:44:03 +02:00
Kconfig fs: prepare for stackable filesystems backing file helpers 2023-12-23 16:35:08 +02:00
Makefile ovl: Move xattr support to new xattrs.c file 2023-10-31 00:12:59 +02:00
namei.c ovl: Support mounting case-insensitive enabled layers 2025-09-23 12:29:36 +02:00
overlayfs.h file->f_path constification 2025-10-03 16:32:36 -07:00
ovl_entry.h ovl: Prepare for mounting case-insensitive enabled layers 2025-09-23 12:29:35 +02:00
params.c ovl: Prepare for mounting case-insensitive enabled layers 2025-09-23 12:29:35 +02:00
params.h ovl: Prepare for mounting case-insensitive enabled layers 2025-09-23 12:29:35 +02:00
readdir.c ovl: Fix uninit-value in ovl_fill_real 2026-02-26 14:59:34 -08:00
super.c file->f_path constification 2025-10-03 16:32:36 -07:00
util.c ovl: fail ovl_lock_rename_workdir() if either target is unhashed 2025-11-28 10:42:32 +01:00
xattrs.c ovl: use wrapper ovl_revert_creds() 2024-11-11 10:45:04 +01:00