]> git.baikalelectronics.ru Git - kernel.git/commit
fscache: Fix incomplete initialisation of inline key space
authorDavid Howells <dhowells@redhat.com>
Wed, 17 Oct 2018 14:23:45 +0000 (15:23 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 18 Oct 2018 09:32:21 +0000 (11:32 +0200)
commit9c2f1a6919d17f6be1dd64b3f2d0e27a3051c15a
tree113747086e8d148ccd64a1cfcec97f10f558071e
parent85b80b37cb0a2f19b36a644f269003e21a259038
fscache: Fix incomplete initialisation of inline key space

The inline key in struct rxrpc_cookie is insufficiently initialized,
zeroing only 3 of the 4 slots, therefore an index_key_len between 13 and 15
bytes will end up hashing uninitialized memory because the memcpy only
partially fills the last buf[] element.

Fix this by clearing fscache_cookie objects on allocation rather than using
the slab constructor to initialise them.  We're going to pretty much fill
in the entire struct anyway, so bringing it into our dcache writably
shouldn't incur much overhead.

This removes the need to do clearance in fscache_set_key() (where we aren't
doing it correctly anyway).

Also, we don't need to set cookie->key_len in fscache_set_key() as we
already did it in the only caller, so remove that.

Fixes: aac5768a9525 ("fscache: Maintain a catalogue of allocated cookies")
Reported-by: syzbot+a95b989b2dde8e806af8@syzkaller.appspotmail.com
Reported-by: Eric Sandeen <sandeen@redhat.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/fscache/cookie.c
fs/fscache/internal.h
fs/fscache/main.c