From: Tristan Madani <tristan@talencesecurity.com>

ocfs2 quota recovery allocates a bitmap buffer with kmalloc and does
not fully initialize it. This can lead to use of uninitialized bits
during quota recovery from a corrupted filesystem image.

Use kzalloc instead to ensure the bitmap is zero-initialized.

Reported-by: syzbot+7ea0b96c4ddb49fd1a70@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/ocfs2/quota_local.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index 12cbb4fccda0d..f55810c59b1b1 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -302,7 +302,7 @@ static int ocfs2_add_recovery_chunk(struct super_block *sb,
 	if (!rc)
 		return -ENOMEM;
 	rc->rc_chunk = chunk;
-	rc->rc_bitmap = kmalloc(sb->s_blocksize, GFP_NOFS);
+	rc->rc_bitmap = kzalloc(sb->s_blocksize, GFP_NOFS);
 	if (!rc->rc_bitmap) {
 		kfree(rc);
 		return -ENOMEM;
-- 
2.47.3

On Sat, 18 Apr 2026 13:10:48 +0000 Tristan Madani <tristmd@gmail.com> wrote:

> ocfs2 quota recovery allocates a bitmap buffer with kmalloc and does
> not fully initialize it. This can lead to use of uninitialized bits
> during quota recovery from a corrupted filesystem image.
> 
> Use kzalloc instead to ensure the bitmap is zero-initialized.

AI review asks a question about the nearby code:
	https://sashiko.dev/#/patchset/20260418131048.1052507-1-tristmd@gmail.com

On 4/18/26 9:10 PM, Tristan Madani wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> ocfs2 quota recovery allocates a bitmap buffer with kmalloc and does
> not fully initialize it. This can lead to use of uninitialized bits
> during quota recovery from a corrupted filesystem image.
> 
> Use kzalloc instead to ensure the bitmap is zero-initialized.
> 
> Reported-by: syzbot+7ea0b96c4ddb49fd1a70@syzkaller.appspotmail.com
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>

Looks good.
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>

> ---
>  fs/ocfs2/quota_local.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
> index 12cbb4fccda0d..f55810c59b1b1 100644
> --- a/fs/ocfs2/quota_local.c
> +++ b/fs/ocfs2/quota_local.c
> @@ -302,7 +302,7 @@ static int ocfs2_add_recovery_chunk(struct super_block *sb,
>  	if (!rc)
>  		return -ENOMEM;
>  	rc->rc_chunk = chunk;
> -	rc->rc_bitmap = kmalloc(sb->s_blocksize, GFP_NOFS);
> +	rc->rc_bitmap = kzalloc(sb->s_blocksize, GFP_NOFS);
>  	if (!rc->rc_bitmap) {
>  		kfree(rc);
>  		return -ENOMEM;