From: Alessandro Zanni alessandro.zanni87@gmail.com
mainline inclusion from mainline-v6.12-rc3 commit 15f34347481648a567db67fb473c23befb796af5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB705C CVE: CVE-2024-53101
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
--------------------------------
ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set.
Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0.
Reported-by: syzbot+6c55f725d1bdc8c52058@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c55f725d1bdc8c52058 Signed-off-by: Alessandro Zanni alessandro.zanni87@gmail.com Link: https://lore.kernel.org/r/20241017120553.55331-1-alessandro.zanni87@gmail.co... Reviewed-by: Jan Kara jack@suse.cz Signed-off-by: Christian Brauner brauner@kernel.org Signed-off-by: Yongjian Sun sunyongjian1@huawei.com --- fs/ocfs2/file.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index 8c0e300f0463..da209f81c9ee 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1139,9 +1139,12 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) trace_ocfs2_setattr(inode, dentry, (unsigned long long)OCFS2_I(inode)->ip_blkno, dentry->d_name.len, dentry->d_name.name, - attr->ia_valid, attr->ia_mode, - from_kuid(&init_user_ns, attr->ia_uid), - from_kgid(&init_user_ns, attr->ia_gid)); + attr->ia_valid, + attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0, + attr->ia_valid & ATTR_UID ? + from_kuid(&init_user_ns, attr->ia_uid) : 0, + attr->ia_valid & ATTR_GID ? + from_kgid(&init_user_ns, attr->ia_gid) : 0);
/* ensuring we don't even attempt to truncate a symlink */ if (S_ISLNK(inode->i_mode))