ext4: avoid writing unitialized memory to disk in EA inodes

If the extended attribute size is not a multiple of block size, the last
block in the EA inode will have uninitialized tail which will get
written to disk. We will never expose the data to userspace but still
this is not a good practice so just zero out the tail of the block as it
isn't going to cause a noticeable performance overhead.

Fixes: e50e5129f384 ("ext4: xattr-in-inode support")
Reported-by: syzbot+9c1fe13fcb51574b249b@syzkaller.appspotmail.com
Reported-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20240613150234.25176-1-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>

diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 6460879b9fcbb35ddb40139659cd9fce080f83ce..46ce2f21fef9dc29e1d127b9bb8404d846337fab 100644 (file)
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1433,6 +1433,12 @@ retry:
                        goto out;
 
                memcpy(bh->b_data, buf, csize);
+               /*
+                * Zero out block tail to avoid writing uninitialized memory
+                * to disk.
+                */
+               if (csize < blocksize)
+                       memset(bh->b_data + csize, 0, blocksize - csize);
                set_buffer_uptodate(bh);
                ext4_handle_dirty_metadata(handle, ea_inode, bh);