Re: ovl_copy_xattr() can write uninitialised heap into the upper file's xattr

On Mon, Aug 24, 2026 at 10:49 AM Miklos Szeredi <[email protected]> wrote:
>
> On Mon, 24 Aug 2026 at 10:29, Amir Goldstein <[email protected]> wrote:
>
> >     size = ovl_do_getxattr(oldpath, name, value, value_size);
> >     if (size == -ERANGE) {
> >         size = ovl_do_getxattr(oldpath, name, NULL, 0);
> >         if (size >= 0 && size <= value_size) {
> >             error = -EIO;
> >             break;
> >         }
> >     }
>
> Well, the whole retry loop is bogus.   Just use ovl_getxattr_value().
> That one could be fixed up to return -EIO in the "size doesn't match"
> case.
>

It's not really a retry loop, it is an opportunistic buffer auto grow
loop, see
e4ad29fa0d22 ("ovl: use a minimal buffer in ovl_copy_xattr")

Thanks,
Amir.