From nobody Sun Feb 8 05:42:10 2026 Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6577943CEDB for ; Wed, 21 Jan 2026 06:31:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768977078; cv=none; b=mE1MiBCXxdpzL5x6O3P0RTcjtIRlt2v/fAPF/LQvGRGutaPxR1gteC2sK0fTUnTEoFHPgOenvsIIILJXZkSE2B/i0wSM2BdqYheQlwOb8q9RTQ2lgw1L0HjQvNFroZC9wScdyU6VYU37VpvxojEws6WdDya4yWYc0jpIfnVPAXE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768977078; c=relaxed/simple; bh=10IIxeBpOmbtDtny4F9jlFEYN9gHuP7Hs3r2Spr9jDY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Rd0LgGgnQHIPboGbgYQbZcw7+5gQX0iR6PFSJDsnACc+N3y/CNOHSsHGSsrLzQ/0RtJQfh82+RWAy2R6xK7qC3Fq+yWmMji5mU2JIbTkzpk/3RthHjNGfNeKGHtHUK08RfEBN3YsEIhQCWCgyCJiCmMhRV4eJTVLg4QeXbG5FHU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=eATw6xKN; arc=none smtp.client-ip=209.85.214.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="eATw6xKN" Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-29efd139227so40771615ad.1 for ; Tue, 20 Jan 2026 22:31:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1768977076; x=1769581876; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=KzWJlQOGK7PP500ykt7DBzIMtyiEntcVzChvAEYBZDg=; b=eATw6xKNatEeVYy/rPMLfSdOs1IFIOdcTGvpsGK/6fMsbx47iQN30NjBXKssxuEol8 da7NkOv5Kq4sYLvuFqUmWTquVWW8EgYeHI/d4z2rXld+fNIy+lnbo+Nsw6Pud9ztAgGe xh/ipnz+sU+Rp4YdTQsc82BtIy+M34vBij+ZEqmvbc6cDzI9olUqPD3o1yVMvK50RhBC Z95AESZ17nxH4yMmFgsTAcRK8X2pCZnBNP3qRpVCjKaATFY8HOPAS7gMcX3KuMgeT8w5 QYoWC9Qm7WjnhMIaMLHasp8aIY033moGRq30m+xP8YAcMk+kuCeAafVv/4JRtjvnwyY1 SddA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768977077; x=1769581877; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=KzWJlQOGK7PP500ykt7DBzIMtyiEntcVzChvAEYBZDg=; b=ntVlxN525u04TMsaPeDPy4ItMciyNPWZejUKPPGCpgyz4A+zs0WRZgBkXkWn/zcB1O 5pobDsoQEOY1a1gMv5dKWW9lLfiH3AOz88afzSzSBuofCpkp87joJ8lAfarfYOwy7MLS Vs1JbOd66xnH/8ujvzEmzDvfuCDPFj+UeUYZSh0brHrNKwo2ZjPtJkg7TLfBhy++jx8P C3+rs0+rONuM+hDOPKc1/EFsbXaQHsF0at2H0lRQO7gpWygomtdJ5D9wQ+KpLuwOki3X bH/bFDQakEEOCkuWRx4EeN7+P/ufjsVkzv7q27N53BuwRz9CGQmMUcedaOwu/SJzkQ9j KnDg== X-Forwarded-Encrypted: i=1; AJvYcCVdESPCHdnb9zgtRhMGgGLre4Uikhp/OppsDDMpm4Nsk3fM/OT3LssFEJQFtD4UMwg/kgpU505mnOOQuPw=@vger.kernel.org X-Gm-Message-State: AOJu0Ywke7huRZJ3Avd+0JlLJwHUQ6wze3LY6jwchKaf51n3QCZgu2rL U24jzxFLmS+6S05yN4xaRc1ewSSsVMHEKBE010nw3/hG8CsCLToK6GHo X-Gm-Gg: AZuq6aIz1xXjV8cXoxqmLsNulv8gHDnRf8I4Nikqw9Gm7/GAbgusg196TREg1WL7u/u if2HTesgqbrPOYf6VzG9YpoqR8ER/GQChvy1jO1R3X22qimx1K2lFMsjDMUmHh3VNkzmb4H0n4N SWWlVyna2ZD2LR0XtGnOM+6hJ9Y0my5KRShs2pBsqQcR48Ai8PrIa3rAQaFHQDfjcTndnmi+AxH m3L7rtPrkO6CsP3NkLkdLyNrVUOgip3+P1AiJDAXJW0Po0QdZ0Z3sx8CVw+T0/9lggkP8UOWHYn 7Csq+ySRIexJ4koCNT0xN1x8LseX9RAaq7m38eNg8e1VGz1W1UTLiEH2sUWrL6TfQp9OuenTcrc Bn47Dvp9MxopXoLWv2m98NMkEUvM36UeeE12fulEoD403Fc2E2ueB8aQGZrpKI5d6JRrodtrxVo h7rcfFQC2QXNEKpUez+05IKozU22IHwRyglqjAkI7H9xtyl87Oqu5Hp+Csaua/91soew== X-Received: by 2002:a17:903:17c3:b0:2a0:fe9f:1884 with SMTP id d9443c01a7336-2a718973282mr149691925ad.55.1768977076504; Tue, 20 Jan 2026 22:31:16 -0800 (PST) Received: from deepanshu-kernel-hacker.. ([2405:201:682f:389d:efe:9255:b6ce:79ee]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2a718f79f40sm142007965ad.0.2026.01.20.22.31.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Jan 2026 22:31:15 -0800 (PST) From: Deepanshu Kartikey To: slava@dubeyko.com, glaubitz@physik.fu-berlin.de, frank.li@vivo.com Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, Deepanshu Kartikey , syzbot+d80abb5b890d39261e72@syzkaller.appspotmail.com Subject: [PATCH v2] hfsplus: fix uninit-value in hfsplus_strcasecmp Date: Wed, 21 Jan 2026 12:01:09 +0530 Message-ID: <20260121063109.1830263-1-kartikey406@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Syzbot reported a KMSAN uninit-value issue in hfsplus_strcasecmp() during filesystem mount operations. The root cause is that hfsplus_find_cat() declares a local hfsplus_cat_entry variable without initialization before passing it to hfs_brec_read(). When the filesystem image is corrupted or malformed (as syzbot fuzzes), hfs_brec_read() may read less data than sizeof(hfsplus_cat_entry). In such cases, the tmp.thread.nodeName.unicode array may only be partially filled, leaving remaining bytes uninitialized. hfsplus_cat_build_key_uni() then copies from this array based on nodeName.length. If the on-disk length field is corrupted or the array wasn't fully written by hfs_brec_read(), uninitialized stack data gets copied into the search key. When hfsplus_strcasecmp() subsequently reads these uninitialized bytes and uses them in case_fold() as an array index into hfsplus_case_fold_table, KMSAN detects the use of uninitialized values. Fix this by initializing tmp to zero, ensuring that even with corrupted filesystem images, no uninitialized data is propagated. Reported-by: syzbot+d80abb5b890d39261e72@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Dd80abb5b890d39261e72 Tested-by: syzbot+d80abb5b890d39261e72@syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Link: https://lore.kernel.org/all/20260120051114.1281285-1-kartikey406@gmai= l.com/T/ [v1] Signed-off-by: Deepanshu Kartikey --- Changes in v2: - Use structure initialization (=3D {0}) instead of memset() as suggested by Viacheslav Dubeyko - Improved commit message to clarify how uninitialized data is used --- fs/hfsplus/catalog.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c index 02c1eee4a4b8..56a53d2d437e 100644 --- a/fs/hfsplus/catalog.c +++ b/fs/hfsplus/catalog.c @@ -194,7 +194,7 @@ static int hfsplus_fill_cat_thread(struct super_block *= sb, int hfsplus_find_cat(struct super_block *sb, u32 cnid, struct hfs_find_data *fd) { - hfsplus_cat_entry tmp; + hfsplus_cat_entry tmp =3D {0}; int err; u16 type; =20 --=20 2.43.0