Re: ovl_copy_xattr() can write uninitialised heap into the upper file's xattr

Miklos Szeredi <[email protected]> Mon, 24 Aug 2026 11:49:27 +0200

Newsgroups	org.kernel.vger.linux-unionfs,org.kernel.vger.linux-fsdevel
Message-ID	<CAJfpegsVoUyqy0dYkTvBGRZvgdv_nmzmCw_uF+LP-Vq3EhEkSg@mail.gmail.com>

On Mon, 24 Aug 2026 at 11:30, Amir Goldstein <[email protected]> wrote:

> It's not really a retry loop, it is an opportunistic buffer auto grow
> loop, see
> e4ad29fa0d22 ("ovl: use a minimal buffer in ovl_copy_xattr")

Ah, okay.

The logic is too complicated, though.

I'd still go with a separate helper  that gets passed (..., void
**bufp, size_t *bufsizep). Single caller of ovl_getxattr_value() can
also be converted to that.

Thanks,
Miklos