Re: ovl_copy_xattr() can write uninitialised heap into the upper file's xattr

Miklos Szeredi <[email protected]> Mon, 24 Aug 2026 14:53:05 +0200

Newsgroups	org.kernel.vger.linux-unionfs,org.kernel.vger.linux-fsdevel
Message-ID	<CAJfpegut15YWZyS5zJ9-WmG0+fVPgRJp+c0aoGQv-0KM8iYj=Q@mail.gmail.com>

On Mon, 24 Aug 2026 at 14:46, Amir Goldstein <[email protected]> wrote:
>
> On Mon, Aug 24, 2026 at 11:49 AM Miklos Szeredi <[email protected]> wrote:
> >
> > On Mon, 24 Aug 2026 at 11:30, Amir Goldstein <[email protected]> wrote:
> >
> > > It's not really a retry loop, it is an opportunistic buffer auto grow
> > > loop, see
> > > e4ad29fa0d22 ("ovl: use a minimal buffer in ovl_copy_xattr")
> >
> > Ah, okay.
> >
> > The logic is too complicated, though.
> >
> > I'd still go with a separate helper  that gets passed (..., void
> > **bufp, size_t *bufsizep). Single caller of ovl_getxattr_value() can
> > also be converted to that.
>
> OK. something like this?

Perfect, thanks.

Miklos