Yuxuan Shui abe82c85d7 ovl: initialize error in ovl_copy_xattr ... commit 520da69d26 upstream. In ovl_copy_xattr, if all the xattrs to be copied are overlayfs private xattrs, the copy loop will terminate without assigning anything to the error variable, thus returning an uninitialized value. If ovl_copy_xattr is called from ovl_clear_empty, this uninitialized error value is put into a pointer by ERR_PTR(), causing potential invalid memory accesses down the line. This commit initialize error with 0. This is the correct value because when there's no xattr to copy, because all xattrs are private, ovl_copy_xattr should succeed. This bug is discovered with the help of INIT_STACK_ALL and clang. Signed-off-by: Yuxuan Shui <yshuiv7@gmail.com> Link: https://bugs.chromium.org/p/chromium/issues/detail?id=1050405 Fixes: 0956254a2d ("ovl: don't copy up opaqueness") Cc: stable@vger.kernel.org # v4.8 Signed-off-by: Alexander Potapenko <glider@google.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-06-20 10:25:04 +02:00
..
copy_up.c	ovl: initialize error in ovl_copy_xattr	2020-06-20 10:25:04 +02:00
dir.c	ovl: relax WARN_ON() on rename to self	2019-12-17 20:39:21 +01:00
inode.c	ovl: filter of trusted xattr results in audit	2019-10-05 12:48:09 +02:00
Kconfig	ovl: introduce the inodes index dir feature	2017-07-04 22:03:17 +02:00
Makefile	ovl: split super.c	2016-12-16 11:02:56 +01:00
namei.c	ovl: fix error handling in ovl_verify_set_fh()	2018-11-21 09:24:04 +01:00
overlayfs.h	ovl: fix format of setxattr debug	2018-10-10 08:54:27 +02:00
ovl_entry.h	locking/barriers: Convert users of lockless_dereference() to READ_ONCE()	2017-12-25 14:26:21 +01:00
readdir.c	ovl: fix wrong use of impure dir cache in ovl_iterate()	2018-09-09 19:55:58 +02:00
super.c	ovl: Sync upper dirty data when syncing overlayfs	2018-08-03 07:50:43 +02:00
util.c	ovl: fix memory leak on unlink of indexed file	2018-10-10 08:54:27 +02:00