From: Roi Martin <jroi.martin@xxxxxxxxx>
commit 2ab5e243c2266c841e0f6904fad1514b18eaf510 upstream.
The function read_alloc_one_name() does not initialize the name field of
the passed fscrypt_str struct if kmalloc fails to allocate the
corresponding buffer. Thus, it is not guaranteed that
fscrypt_str.name is initialized when freeing it.
This is a follow-up to the linked patch that fixes the remaining
instances of the bug introduced by commit e43eec81c516 ("btrfs: use
struct qstr instead of name and namelen pairs").
Link: https://lore.kernel.org/linux-btrfs/20241009080833.1355894-1-jroi.martin@xxxxxxxxx/
Fixes: e43eec81c516 ("btrfs: use struct qstr instead of name and namelen pairs")
CC: stable@xxxxxxxxxxxxxxx # 6.1+
Reviewed-by: Anand Jain <anand.jain@xxxxxxxxxx>
Signed-off-by: Roi Martin <jroi.martin@xxxxxxxxx>
Signed-off-by: David Sterba <dsterba@xxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/btrfs/tree-log.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -1844,7 +1844,7 @@ static noinline int replay_one_name(stru
struct btrfs_dir_item *di,
struct btrfs_key *key)
{
- struct fscrypt_str name;
+ struct fscrypt_str name = { 0 };
struct btrfs_dir_item *dir_dst_di;
struct btrfs_dir_item *index_dst_di;
bool dir_dst_matches = false;
@@ -2124,7 +2124,7 @@ static noinline int check_item_in_log(st
struct extent_buffer *eb;
int slot;
struct btrfs_dir_item *di;
- struct fscrypt_str name;
+ struct fscrypt_str name = { 0 };
struct inode *inode = NULL;
struct btrfs_key location;
Patches currently in stable-queue which might be from jroi.martin@xxxxxxxxx are
queue-6.1/btrfs-fix-uninitialized-pointer-free-in-add_inode_ref.patch
queue-6.1/btrfs-fix-uninitialized-pointer-free-on-read_alloc_one_name-error.patch
