Commit 43385846 authored by David Rientjes's avatar David Rientjes Committed by Linus Torvalds

fs, xattr: fix bug when removing a name not in xattr list

Commit 38f38657 ("xattr: extract simple_xattr code from tmpfs") moved
some code from tmpfs but introduced a subtle bug along the way.

If the name passed to simple_xattr_remove() does not exist in the list of
xattrs, then it is possible to call kfree(new_xattr) when new_xattr is
actually initialized to itself on the stack via uninitialized_var().

This causes a BUG() since the memory was not allocated via the slab
allocator and was not bypassed through to the page allocator because it
was too large.

Initialize the local variable to NULL so the kfree() never takes place.
Reported-by: default avatarFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: default avatarDavid Rientjes <rientjes@google.com>
Acked-by: default avatarHugh Dickins <hughd@google.com>
Acked-by: default avatarAristeu Rozanski <aris@redhat.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent d63e210e
...@@ -846,7 +846,7 @@ static int __simple_xattr_set(struct simple_xattrs *xattrs, const char *name, ...@@ -846,7 +846,7 @@ static int __simple_xattr_set(struct simple_xattrs *xattrs, const char *name,
const void *value, size_t size, int flags) const void *value, size_t size, int flags)
{ {
struct simple_xattr *xattr; struct simple_xattr *xattr;
struct simple_xattr *uninitialized_var(new_xattr); struct simple_xattr *new_xattr = NULL;
int err = 0; int err = 0;
/* value == NULL means remove */ /* value == NULL means remove */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment