• David Howells's avatar
    fscache: Fix incomplete initialisation of inline key space · 1ff22883
    David Howells authored
    The inline key in struct rxrpc_cookie is insufficiently initialized,
    zeroing only 3 of the 4 slots, therefore an index_key_len between 13 and 15
    bytes will end up hashing uninitialized memory because the memcpy only
    partially fills the last buf[] element.
    Fix this by clearing fscache_cookie objects on allocation rather than using
    the slab constructor to initialise them.  We're going to pretty much fill
    in the entire struct anyway, so bringing it into our dcache writably
    shouldn't incur much overhead.
    This removes the need to do clearance in fscache_set_key() (where we aren't
    doing it correctly anyway).
    Also, we don't need to set cookie->key_len in fscache_set_key() as we
    already did it in the only caller, so remove that.
    Fixes: ec0328e4 ("fscache: Maintain a catalogue of allocated cookies")
    Reported-by: syzbot+a95b989b2dde8e806af8@syzkaller.appspotmail.com
    Reported-by: default avatarEric Sandeen <sandeen@redhat.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
main.c 4.78 KB