Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

reiserfs: Initialize sec->length in reiserfs_security_init().

syzbot is reporting that sec->length is not initialized.

Since security_inode_init_security() returns 0 when initxattrs is provided
but call_int_hook(inode_init_security) returned -EOPNOTSUPP, control will
reach to "if (sec->length && ...) {" without initializing sec->length.

Reported-by: syzbot <syzbot+00a3779539a23cbee38c@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=00a3779539a23cbee38c
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 52ca4b6435a4 ("reiserfs: Switch to security_inode_init_security()")
Signed-off-by: Paul Moore <paul@paul-moore.com>

authored by

Tetsuo Handa and committed by
Paul Moore
d031f4e8 a495108e

+1
+1
fs/reiserfs/xattr_security.c
··· 67 67 68 68 sec->name = NULL; 69 69 sec->value = NULL; 70 + sec->length = 0; 70 71 71 72 /* Don't add selinux attributes on xattrs - they'll never get used */ 72 73 if (IS_PRIVATE(dir))