Re: ovl_copy_xattr() can write uninitialised heap into the upper file's xattr

Miklos Szeredi <[email protected]> Mon, 24 Aug 2026 10:49:12 +0200

Newsgroups	org.kernel.vger.linux-unionfs,org.kernel.vger.linux-fsdevel
Message-ID	<CAJfpegt1WinKmP5nOGv8Yx9VLf4Mk1ojg7e3xR5iUz=7yDAh0Q@mail.gmail.com>

On Mon, 24 Aug 2026 at 10:29, Amir Goldstein <[email protected]> wrote:

>     size = ovl_do_getxattr(oldpath, name, value, value_size);
>     if (size == -ERANGE) {
>         size = ovl_do_getxattr(oldpath, name, NULL, 0);
>         if (size >= 0 && size <= value_size) {
>             error = -EIO;
>             break;
>         }
>     }

Well, the whole retry loop is bogus.   Just use ovl_getxattr_value().
That one could be fixed up to return -EIO in the "size doesn't match"
case.

Thanks,
Miklos