Re: [PATCH] hfsplus: zero-initialize data buffer in hfs_bnode_read_u16 and hfs_bnode_read_u8

[Viacheslav Dubeyko]

On Fri, 2026-04-17 at 19:39 +0000, Tristan Madani wrote:
> hfs_bnode_read_u16() and hfs_bnode_read_u8() declare local data
> variables without initialization, then pass them to hfs_bnode_read().
> 
> When hfs_bnode_read() returns early due to an invalid offset on a
> corrupted HFS+ image (the is_bnode_offset_valid() check), the data
> buffer is never written and the functions return uninitialized stack
> data.  KMSAN flags this as a use of uninitialized memory.
> 
> Zero-initialize both data variables so that an early return from
> hfs_bnode_read() produces a deterministic zero value instead of
> stack garbage.
> 
> Reported-by: syzbot+217eb327242d08197efb@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=217eb327242d08197efb
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
> ---
>  fs/hfsplus/bnode.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c
> index 14f4995588ff..4404cd35c192 100644
> --- a/fs/hfsplus/bnode.c
> +++ b/fs/hfsplus/bnode.c
> @@ -96,7 +96,7 @@ void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len)
>  
>  u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off)
>  {
> -	__be16 data;
> +	__be16 data = 0;
>  	/* TODO: optimize later... */
>  	hfs_bnode_read(node, &data, off, 2);
>  	return be16_to_cpu(data);
> @@ -104,7 +104,7 @@ u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off)
>  
>  u8 hfs_bnode_read_u8(struct hfs_bnode *node, int off)
>  {
> -	u8 data;
> +	u8 data = 0;
>  	/* TODO: optimize later... */
>  	hfs_bnode_read(node, &data, off, 1);
>  	return data;

Both methods hfs_bnode_read_u16() and hfs_bnode_read_u8() call the
hfs_bnode_read(). And it is widely used method. We need to make initialization
at all places where hfs_bnode_read() is called. Oppositely, we can initialize
buffer in hfs_bnode_read() itself.

Thanks,
Slava.