From nobody Tue Jun 16 10:11:27 2026 Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3EC921B4156 for ; Fri, 17 Apr 2026 19:39:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.45 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776454757; cv=none; b=IaOTYJ5Fsf0nA/a25Fghee/Lh92AqT2gXwnGLnNPBHrxtjuuXxLLzKMmvvU5+3Iezd+h2h79LPwM10Qi1JhSRYaUsfy1njyscT5AisjUEbtFmepvVqhoGKdOfu1vfm+z485/E9xQ9hDNZ/MQ9kwKNMj3UiUIA7ahtbeiIcC4I6o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776454757; c=relaxed/simple; bh=NJ6/CANuGl3odwtb7ysxZy/MRZxYmQz1gQeHADHI/i4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=tHHKvkkX+pPuycwZikfaabT5hSPiooUsnb5je92SBTD1vWoF4w6XyAD4k0SZXY15X1qRp5itOSGkNAofDT1oLDd/Xni9AxjIvUPiniaOy1xAUyfK4vMvoexExN9bpn0qDzBzXWpWBXPTGOZvcWCPQiUzCm56cmT8TVcvQa48doA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=VDvWN9va; arc=none smtp.client-ip=209.85.128.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="VDvWN9va" Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-488a8ca4aadso12707565e9.3 for ; Fri, 17 Apr 2026 12:39:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776454754; x=1777059554; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=T+guEPCIISTmp6PybkOSuXnNzgmVvlfkjaLWc09D5zw=; b=VDvWN9vaZTGPFxrTfm7EVkvoF4Y3X/GVXZZuXNsfEbnR6r8ymhgUpDi6hwYjAZE6Kc 9lQhEhY+CgkHuGejfYTKfDOtsEEbrLVWuWB9yYQhFbh5tT3aezUcqAhiknhmYrGHvjGm QQzHJrK457Rf1HANYgZ061i6mwpAxRYVPE2Ermk5k6DEhCMnNEZqOXZhAKxfreY4jTMc ryi8HV+LTMFICIo4oNVieIDS0cTlZDd+ToHNOXtYBe8bw2XM/rJibQhV1GOyi5pPoVDI nTwAApzwMwAtVhLk+Fhab88Jiimb5HLCkzxdALRXdx8ocDx0kRTcWq7w0RdBgvYyuOkT OYdQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776454754; x=1777059554; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=T+guEPCIISTmp6PybkOSuXnNzgmVvlfkjaLWc09D5zw=; b=l784ri1BN/zFk4KoUpbc9CZL0hkxK26C0sTIgK8lpDmJxQN4oEY8xClLMVmAKHqmsG HWX++N4gPSIPS6RVWqVFwGAvvY5ucgkxvb4bm1ZyXDa1ZWNyGOP7z6tyegy3192qhSLC /h1XpQIOBWJ4SYXyEULSsR15AFr16s1D/4E55hdmhC1c/bzDZ6UsgvdDjajFAr5WIgfw LErp3GT6YpCsmjFBqi2O6TkLl7up80jYiOLM36IxS7JwO6Yt28B6BCb/E/GaqXCmM/L1 MEOYfxt7+DAK6tEzJc6zjfx4auGROlZ8R/obOo1UZrjpF6cUt8i5tpYRlnQww22PUHl8 WFDA== X-Forwarded-Encrypted: i=1; AFNElJ+bR5nqBdAdPPUOK1P8F/00wtFCErqk39wQeCIFACDSPtu2jjCw6x6lu/Br9MgkSaruLLaBvTqPe5zLOzA=@vger.kernel.org X-Gm-Message-State: AOJu0Ywq8s+gDTdKYRcmJTW6S0kzyfINzcoez3AAORa9OMJL0QH8bPa0 nYVAgAjgFgnXfViVaVk50az+PVpjFSXisT8re+rw5u2KXv+maGfpkXm5S3MdR+o= X-Gm-Gg: AeBDiesIKwINdgVPuFOvryc3sXSw0V7vZLBBVhT35SknJLYtFjlab1Nj8nfqt/FD4Et 1qBdXS5PK5IflysdxGnSzUxeGXcV7ssMZD5zm5lilrkMTjS2KUogwZS/EF9Wn2nejn4NUUyxhsl BWXUr8jd+853ubd91BhwAEnjEqMLEAh0rxL+2CaXBgThqlzJqDeBJlrEEJSOI3EaMr1O3u7CHa/ rVN17EQqr7itkFx1gCqpn6vhtsqc1s1R9JYAVO2J2Q9ygQtNQFhcxz6uIjVXeg1fsjdFzC8lK8k ULBKaPjRUPIYVrfTCLt7giUq5wKUdOpN9P5JkPN7OHQ8dC1LkqdE1M3t99bnjRyCmDoVn5aWAhM jsskCaQouzJ+wCGjeFIUN3WYAgHEXUIPcaOLUepoAzWB2LwMb0UsKpQHjq40YuNWyaNA6kKFUkw 5reMexufF/56LFUr7m X-Received: by 2002:a05:600c:1da1:b0:488:f453:b976 with SMTP id 5b1f17b1804b1-488fb7844c5mr70072535e9.27.1776454754460; Fri, 17 Apr 2026 12:39:14 -0700 (PDT) Received: from debian.. ([2001:41d0:303:db6b::]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-488fc140c82sm62834555e9.12.2026.04.17.12.39.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Apr 2026 12:39:13 -0700 (PDT) From: Tristan Madani X-Google-Original-From: Tristan Madani To: Andrew Morton Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+217eb327242d08197efb@syzkaller.appspotmail.com, stable@vger.kernel.org, Tristan Madani Subject: [PATCH] hfsplus: zero-initialize data buffer in hfs_bnode_read_u16 and hfs_bnode_read_u8 Date: Fri, 17 Apr 2026 19:39:13 +0000 Message-ID: <20260417193913.338982-1-tristan@talencesecurity.com> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" hfs_bnode_read_u16() and hfs_bnode_read_u8() declare local data variables without initialization, then pass them to hfs_bnode_read(). When hfs_bnode_read() returns early due to an invalid offset on a corrupted HFS+ image (the is_bnode_offset_valid() check), the data buffer is never written and the functions return uninitialized stack data. KMSAN flags this as a use of uninitialized memory. Zero-initialize both data variables so that an early return from hfs_bnode_read() produces a deterministic zero value instead of stack garbage. Reported-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D217eb327242d08197efb Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- fs/hfsplus/bnode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c index 14f4995588ff..4404cd35c192 100644 --- a/fs/hfsplus/bnode.c +++ b/fs/hfsplus/bnode.c @@ -96,7 +96,7 @@ void hfs_bnode_read(struct hfs_bnode *node, void *buf, in= t off, int len) =20 u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off) { - __be16 data; + __be16 data =3D 0; /* TODO: optimize later... */ hfs_bnode_read(node, &data, off, 2); return be16_to_cpu(data); @@ -104,7 +104,7 @@ u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off) =20 u8 hfs_bnode_read_u8(struct hfs_bnode *node, int off) { - u8 data; + u8 data =3D 0; /* TODO: optimize later... */ hfs_bnode_read(node, &data, off, 1); return data; --=20 2.47.3