| From: Jan Kara <jack@suse.cz> |
| Subject: fat: fix uninitialized field in nostale filehandles |
| Date: Mon, 5 Feb 2024 13:26:26 +0100 |
| |
| When fat_encode_fh_nostale() encodes file handle without a parent it |
| stores only first 10 bytes of the file handle. However the length of the |
| file handle must be a multiple of 4 so the file handle is actually 12 |
| bytes long and the last two bytes remain uninitialized. This is not |
| great at we potentially leak uninitialized information with the handle |
| to userspace. Properly initialize the full handle length. |
| |
| Link: https://lkml.kernel.org/r/20240205122626.13701-1-jack@suse.cz |
| Reported-by: syzbot+3ce5dea5b1539ff36769@syzkaller.appspotmail.com |
| Fixes: ea3983ace6b7 ("fat: restructure export_operations") |
| Signed-off-by: Jan Kara <jack@suse.cz> |
| Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> |
| Cc: Amir Goldstein <amir73il@gmail.com> |
| Cc: <stable@vger.kernel.org> |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| --- |
| |
| fs/fat/nfs.c | 6 ++++++ |
| 1 file changed, 6 insertions(+) |
| |
| --- a/fs/fat/nfs.c~fat-fix-uninitialized-field-in-nostale-filehandles |
| +++ a/fs/fat/nfs.c |
| @@ -130,6 +130,12 @@ fat_encode_fh_nostale(struct inode *inod |
| fid->parent_i_gen = parent->i_generation; |
| type = FILEID_FAT_WITH_PARENT; |
| *lenp = FAT_FID_SIZE_WITH_PARENT; |
| + } else { |
| + /* |
| + * We need to initialize this field because the fh is actually |
| + * 12 bytes long |
| + */ |
| + fid->parent_i_pos_hi = 0; |
| } |
| |
| return type; |
| _ |
