[PATCH] fs/hfsplus: fix uninit-value in hfs_find_1st_rec_by_cnid
From: Edward Adam Davis
Date: Thu Mar 21 2024 - 20:37:34 EST
[syzbot reported]
BUG: KMSAN: uninit-value in hfs_find_1st_rec_by_cnid+0x27a/0x3f0 fs/hfsplus/bfind.c:78
hfs_find_1st_rec_by_cnid+0x27a/0x3f0 fs/hfsplus/bfind.c:78
__hfsplus_brec_find+0x26f/0x7b0 fs/hfsplus/bfind.c:135
hfsplus_brec_find+0x445/0x970 fs/hfsplus/bfind.c:195
hfsplus_find_attr+0x30c/0x390
hfsplus_listxattr+0x586/0x1a60 fs/hfsplus/xattr.c:708
vfs_listxattr fs/xattr.c:493 [inline]
listxattr+0x1f3/0x6b0 fs/xattr.c:840
path_listxattr fs/xattr.c:864 [inline]
__do_sys_listxattr fs/xattr.c:876 [inline]
__se_sys_listxattr fs/xattr.c:873 [inline]
__x64_sys_listxattr+0x16b/0x2f0 fs/xattr.c:873
do_syscall_64+0xd5/0x1f0
entry_SYSCALL_64_after_hwframe+0x6d/0x75
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3804 [inline]
slab_alloc_node mm/slub.c:3845 [inline]
__do_kmalloc_node mm/slub.c:3965 [inline]
__kmalloc+0x6e4/0x1000 mm/slub.c:3979
kmalloc include/linux/slab.h:632 [inline]
hfsplus_find_init+0x91/0x250 fs/hfsplus/bfind.c:21
hfsplus_listxattr+0x44a/0x1a60 fs/hfsplus/xattr.c:695
vfs_listxattr fs/xattr.c:493 [inline]
listxattr+0x1f3/0x6b0 fs/xattr.c:840
path_listxattr fs/xattr.c:864 [inline]
__do_sys_listxattr fs/xattr.c:876 [inline]
__se_sys_listxattr fs/xattr.c:873 [inline]
__x64_sys_listxattr+0x16b/0x2f0 fs/xattr.c:873
do_syscall_64+0xd5/0x1f0
entry_SYSCALL_64_after_hwframe+0x6d/0x75
[Fix]
Let's clear all search_key fields at alloc time.
Reported-and-tested-by: syzbot+65f53dd6a0f7ad64c0cb@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Edward Adam Davis <eadavis@xxxxxx>
---
fs/hfsplus/bfind.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/hfsplus/bfind.c b/fs/hfsplus/bfind.c
index ca2ba8c9f82e..b939dc879dac 100644
--- a/fs/hfsplus/bfind.c
+++ b/fs/hfsplus/bfind.c
@@ -18,7 +18,7 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd)
fd->tree = tree;
fd->bnode = NULL;
- ptr = kmalloc(tree->max_key_len * 2 + 4, GFP_KERNEL);
+ ptr = kzalloc(tree->max_key_len * 2 + 4, GFP_KERNEL);
if (!ptr)
return -ENOMEM;
fd->search_key = ptr;
--
2.43.0