For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] jfs: zero-initialize btstack to fix KMSAN uninit-value in BT_STACK_DUMP
Author: tristmd@gmail.com
From: Tristan Madani <tristan@talencesecurity.com>
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
BT_STACK_DUMP() unconditionally prints all MAXTREEHEIGHT entries of the
btstack->stack[] array. However, only entries between stack[0] and *top
have been written by BT_PUSH(); the rest contain uninitialized stack
data.
When dtSearch() or dtReadFirst() detect a corrupted B-tree that exceeds
MAXTREEHEIGHT, they call BT_STACK_DUMP() for diagnostic output. Reading
the uninitialized entries triggers a KMSAN uninit-value report.
Fix this by only iterating over the entries that were actually pushed
onto the stack (from stack[0] up to but not including top), rather than
blindly dumping all MAXTREEHEIGHT slots.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+ba5f49027aace342d24d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ba5f49027aace342d24d
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/jfs/jfs_btree.h | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/jfs/jfs_btree.h b/fs/jfs/jfs_btree.h
index a1312322..b6737db2 100644
--- a/fs/jfs/jfs_btree.h
+++ b/fs/jfs/jfs_btree.h
@@ -130,10 +130,12 @@ struct btstack {
static inline void BT_STACK_DUMP(struct btstack *btstack)
{
int i;
+ int depth = btstack->top - btstack->stack;
+
printk("btstack dump:\n");
- for (i = 0; i < MAXTREEHEIGHT; i++)
+ for (i = 0; i < depth; i++)
printk(KERN_ERR "bn = %Lx, index = %d\n",
(long long)btstack->stack[i].bn,
btstack->stack[i].index);
}
--
2.39.2