diff options
| author | Edward Adam Davis <eadavis@qq.com> | 2026-02-06 14:20:28 +0800 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2026-02-14 13:17:43 +0100 |
| commit | cb184dd19154fc486fa3d9e02afe70a97e54e055 (patch) | |
| tree | 437e2bd890537ed7750e9a56340232170ebc25e4 | |
| parent | 770aaedb461a055f79b971d538678942b6607894 (diff) | |
fs: init flags_valid before calling vfs_fileattr_get
syzbot reported a uninit-value bug in [1].
Similar to the "*get" context where the kernel's internal file_kattr
structure is initialized before calling vfs_fileattr_get(), we should
use the same mechanism when using fa.
[1]
BUG: KMSAN: uninit-value in fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517
fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517
vfs_fileattr_get fs/file_attr.c:94 [inline]
__do_sys_file_getattr fs/file_attr.c:416 [inline]
Local variable fa.i created at:
__do_sys_file_getattr fs/file_attr.c:380 [inline]
__se_sys_file_getattr+0x8c/0xbd0 fs/file_attr.c:372
Reported-by: syzbot+7c31755f2cea07838b0c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7c31755f2cea07838b0c
Tested-by: syzbot+7c31755f2cea07838b0c@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Link: https://patch.msgid.link/tencent_B6C4583771D76766D71362A368696EC3B605@qq.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
| -rw-r--r-- | fs/file_attr.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/file_attr.c b/fs/file_attr.c index 42721427245a..0e9b4f737546 100644 --- a/fs/file_attr.c +++ b/fs/file_attr.c @@ -376,7 +376,7 @@ SYSCALL_DEFINE5(file_getattr, int, dfd, const char __user *, filename, struct path filepath __free(path_put) = {}; unsigned int lookup_flags = 0; struct file_attr fattr; - struct file_kattr fa; + struct file_kattr fa = { .flags_valid = true }; /* hint only */ int error; BUILD_BUG_ON(sizeof(struct file_attr) < FILE_ATTR_SIZE_VER0); |