Forwarded: Re: [syzbot] [hfs?] KMSAN: uninit-value in hfs_bnode_read_u16

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.

***

Subject: Re: [syzbot] [hfs?] KMSAN: uninit-value in hfs_bnode_read_u16
Author: tristmd@xxxxxxxxx

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

>From fa9693d02a6d2e2fda72504085400c761d5eec1f Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
Date: Sat, 18 Apr 2026 13:39:03 +0000
Subject: [PATCH] hfsplus: zero-initialize buffer in hfs_bnode_read

hfs_bnode_read() can return early without initializing the output
buffer when the offset is invalid or the requested length is
corrected to zero by check_and_correct_requested_length().  Callers
such as hfs_bnode_read_u16() pass stack-allocated buffers and use the
result unconditionally, leading to KMSAN uninit-value reports.

Rather than initializing at each individual call site, zero the buffer
at the start of hfs_bnode_read() before any validation checks.  This
ensures the buffer is always in a known state regardless of which
early-return path is taken.

Reported-by: syzbot+217eb327242d08197efb@xxxxxxxxxxxxxxxxxxxxxxxxx
Tested-by: syzbot+217eb327242d08197efb@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=217eb327242d08197efb
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
---
 fs/hfsplus/bnode.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c
index f8b5a8ae58ff5..14d1af2c7ba93 100644
--- a/fs/hfsplus/bnode.c
+++ b/fs/hfsplus/bnode.c
@@ -25,6 +25,8 @@ void hfs_bnode_read(struct hfs_bnode *node, void *buf, u32 off, u32 len)
 	struct page **pagep;
 	u32 l;
 
+	memset(buf, 0, len);
+
 	if (!is_bnode_offset_valid(node, off))
 		return;
 
-- 
2.47.3