[PATCH v2] overlayfs: fix uninitialized pointers with free attribute

[PATCH v2] overlayfs: fix uninitialized pointers with free attribute

[Ally Heev]

Uninitialized pointers with `__free` attribute can cause undefined
behavior as the memory assigned randomly to the pointer is freed
automatically when the pointer goes out of scope.

overlayfs doesn't have any bugs related to this as of now, but
it is better to initialize and assign pointers with `__free` attribute
in one statement to ensure proper scope-based cleanup

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/
Acked-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Ally Heev <allyheev@gmail.com>
---
Changes in v2:
- moved the variable initialization to the top
- Link to v1: https://lore.kernel.org/r/20251105-aheev-uninitialized-free-attr-overlayfs-v1-1-6ae4624655db@gmail.com
---
 fs/overlayfs/params.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c
index 63b7346c5ee1c127a9c33b12c3704aa035ff88cf..37086f73ac3ecfcd1c09ae6eccbb69723006e031 100644
--- a/fs/overlayfs/params.c
+++ b/fs/overlayfs/params.c
@@ -448,7 +448,7 @@ static int ovl_parse_layer(struct fs_context *fc, struct fs_parameter *param,
 		err = ovl_do_parse_layer(fc, param->string, &layer_path, layer);
 		break;
 	case fs_value_is_file: {
-		char *buf __free(kfree);
+		char *buf __free(kfree) = NULL;
 		char *layer_name;
 
 		buf = kmalloc(PATH_MAX, GFP_KERNEL_ACCOUNT);

---
base-commit: c9cfc122f03711a5124b4aafab3211cf4d35a2ac
change-id: 20251105-aheev-uninitialized-free-attr-overlayfs-6873964429e0

Best regards,
-- 
Ally Heev <allyheev@gmail.com>

Re: [PATCH v2] overlayfs: fix uninitialized pointers with free attribute

[Amir Goldstein]

On Sat, Nov 15, 2025 at 2:41 PM Ally Heev <allyheev@gmail.com> wrote:
>
> Uninitialized pointers with `__free` attribute can cause undefined
> behavior as the memory assigned randomly to the pointer is freed
> automatically when the pointer goes out of scope.
>
> overlayfs doesn't have any bugs related to this as of now, but
> it is better to initialize and assign pointers with `__free` attribute
> in one statement to ensure proper scope-based cleanup
>
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/
> Acked-by: Amir Goldstein <amir73il@gmail.com>
> Signed-off-by: Ally Heev <allyheev@gmail.com>
> ---
> Changes in v2:
> - moved the variable initialization to the top
> - Link to v1: https://lore.kernel.org/r/20251105-aheev-uninitialized-free-attr-overlayfs-v1-1-6ae4624655db@gmail.com
> ---

Christian,

Mind picking this one?

Thanks,
Amir.

>  fs/overlayfs/params.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c
> index 63b7346c5ee1c127a9c33b12c3704aa035ff88cf..37086f73ac3ecfcd1c09ae6eccbb69723006e031 100644
> --- a/fs/overlayfs/params.c
> +++ b/fs/overlayfs/params.c
> @@ -448,7 +448,7 @@ static int ovl_parse_layer(struct fs_context *fc, struct fs_parameter *param,
>                 err = ovl_do_parse_layer(fc, param->string, &layer_path, layer);
>                 break;
>         case fs_value_is_file: {
> -               char *buf __free(kfree);
> +               char *buf __free(kfree) = NULL;
>                 char *layer_name;
>
>                 buf = kmalloc(PATH_MAX, GFP_KERNEL_ACCOUNT);
>
> ---
> base-commit: c9cfc122f03711a5124b4aafab3211cf4d35a2ac
> change-id: 20251105-aheev-uninitialized-free-attr-overlayfs-6873964429e0
>
> Best regards,
> --
> Ally Heev <allyheev@gmail.com>
>

Re: [PATCH v2] overlayfs: fix uninitialized pointers with free attribute

[ally heev]

On Sat, 2025-11-15 at 14:59 +0100, Amir Goldstein wrote:
[...]
> Christian,
> 
> Mind picking this one?
> 
> Thanks,
> Amir.
> 

We might want to wait. There's an ongoing discussion going on about
this rule
https://lore.kernel.org/lkml/58fd478f408a34b578ee8d949c5c4b4da4d4f41d.camel@HansenPartnership.com/.
Mostly likely, I might have to revert to v1 of this patch
 
> >  fs/overlayfs/params.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c
> > index 63b7346c5ee1c127a9c33b12c3704aa035ff88cf..37086f73ac3ecfcd1c09ae6eccbb69723006e031 100644
> > --- a/fs/overlayfs/params.c
> > +++ b/fs/overlayfs/params.c
> > @@ -448,7 +448,7 @@ static int ovl_parse_layer(struct fs_context *fc, struct fs_parameter *param,
> >                 err = ovl_do_parse_layer(fc, param->string, &layer_path, layer);
> >                 break;
> >         case fs_value_is_file: {
> > -               char *buf __free(kfree);
> > +               char *buf __free(kfree) = NULL;
> >                 char *layer_name;
> > 
> >                 buf = kmalloc(PATH_MAX, GFP_KERNEL_ACCOUNT);
> > 
> > ---
> > base-commit: c9cfc122f03711a5124b4aafab3211cf4d35a2ac
> > change-id: 20251105-aheev-uninitialized-free-attr-overlayfs-6873964429e0
> > 
> > Best regards,
> > --
> > Ally Heev <allyheev@gmail.com>
> > 

Thanks,
Ally

Re: [PATCH v2] overlayfs: fix uninitialized pointers with free attribute

[ally heev]

On Wed, Nov 19, 2025 at 12:43 PM ally heev <allyheev@gmail.com> wrote:
>
> On Sat, 2025-11-15 at 14:59 +0100, Amir Goldstein wrote:
> [...]
> > Christian,
> >
> > Mind picking this one?
> >
> > Thanks,
> > Amir.
> >
>
> We might want to wait. There's an ongoing discussion going on about
> this rule
> https://lore.kernel.org/lkml/58fd478f408a34b578ee8d949c5c4b4da4d4f41d.camel@HansenPartnership.com/.
> Mostly likely, I might have to revert to v1 of this patch
>
[...]

I am reverting this to v1

Regards,
Ally