[PATCH 6/8] ksmbd: zero-initialize xattr_dos_attrib in smb2_update_xattrs()
"Gaël Blivet-Bailly" <[email protected]>
| Newsgroups | org.kernel.vger.linux-cifs |
|---|---|
| Message-ID | <[email protected]> |
From: Gael Blivet <[email protected]> ndr_decode_dos_attr() only populates da->itime for version-4 DOS attribute xattrs; for version 3 it's skipped entirely (only da->create_time is set). smb2_update_xattrs() declared da without initializing it, so fp->itime = da.itime unconditionally copies whatever was on the kernel stack for any file carrying a version-3 xattr (e.g. written by an older client or server) -- uninitialized stack memory that can later be exposed to a client via QUERY_INFO. Zero-initialize da at declaration, matching the pattern fsctl_set_sparse() already uses in this same file. Signed-off-by: Gael Blivet <[email protected]> --- fs/smb/server/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index ca3d4985a..7d7315e34 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -3000,7 +3000,7 @@ static bool smb2_parent_compressed(struct ksmbd_tree_connect *tcon, static void smb2_update_xattrs(struct ksmbd_tree_connect *tcon, const struct path *path, struct ksmbd_file *fp) { - struct xattr_dos_attrib da; + struct xattr_dos_attrib da = {}; bool store_dos_attrs = test_share_config_flag(tcon->share_conf, KSMBD_SHARE_FLAG_STORE_DOS_ATTRS); int rc; -- 2.43.0