fs: init flags_valid before calling vfs_fileattr_get

syzbot reported a uninit-value bug in [1].

Similar to the "*get" context where the kernel's internal file_kattr
structure is initialized before calling vfs_fileattr_get(), we should
use the same mechanism when using fa.

[1]
BUG: KMSAN: uninit-value in fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517
 fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517
 vfs_fileattr_get fs/file_attr.c:94 [inline]
 __do_sys_file_getattr fs/file_attr.c:416 [inline]

Local variable fa.i created at:
 __do_sys_file_getattr fs/file_attr.c:380 [inline]
 __se_sys_file_getattr+0x8c/0xbd0 fs/file_attr.c:372

Reported-by: syzbot+7c31755f2cea07838b0c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7c31755f2cea07838b0c
Tested-by: syzbot+7c31755f2cea07838b0c@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Link: https://patch.msgid.link/tencent_B6C4583771D76766D71362A368696EC3B605@qq.com
Signed-off-by: Christian Brauner <brauner@kernel.org>

diff --git a/fs/file_attr.c b/fs/file_attr.c
index 42721427245a6d8497d19be47fce8268460f235f..0e9b4f737546100495c36a2ae034948bfae2db05 100644 (file)
--- a/fs/file_attr.c
+++ b/fs/file_attr.c
@@ -376,7 +376,7 @@ SYSCALL_DEFINE5(file_getattr, int, dfd, const char __user *, filename,
        struct path filepath __free(path_put) = {};
        unsigned int lookup_flags = 0;
        struct file_attr fattr;
-       struct file_kattr fa;
+       struct file_kattr fa = { .flags_valid = true }; /* hint only */
        int error;
 
        BUILD_BUG_ON(sizeof(struct file_attr) < FILE_ATTR_SIZE_VER0);