From: Eric Biggers ebiggers@google.com

mainline inclusion from mainline-v6.8-rc1 commit e26b6d39270f5eab0087453d9b544189a38c8564 category: bugfix bugzilla: 189530 CVE: CVE-2023-52436

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...

--------------------------------

When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed.

Signed-off-by: Eric Biggers ebiggers@google.com Reviewed-by: Chao Yu chao@kernel.org Signed-off-by: Jaegeuk Kim jaegeuk@kernel.org Signed-off-by: Zizhi Wo wozizhi@huawei.com --- fs/f2fs/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+)

diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c index 1858c66d871d..eef2b05fd7e1 100644 --- a/fs/f2fs/xattr.c +++ b/fs/f2fs/xattr.c @@ -718,6 +718,12 @@ static int __f2fs_setxattr(struct inode *inode, int index, memcpy(pval, value, size); last->e_value_size = cpu_to_le16(size); new_hsize += newsize; + /* + * Explicitly add the null terminator. The unused xattr space + * is supposed to always be zeroed, which would make this + * unnecessary, but don't depend on that. + */ + *(u32 *)((u8 *)last + newsize) = 0; }

error = write_all_xattrs(inode, new_hsize, base_addr, ipage);