For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ocfs2: zero-initialize quota recovery bitmap allocation
Author: tristmd@gmail.com
From: Tristan Madani <tristan@talencesecurity.com>
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
ocfs2_add_recovery_chunk() allocates a full block-sized buffer for the
recovery bitmap with kmalloc(), but only copies the meaningful portion
of the on-disk bitmap:
rc->rc_bitmap = kmalloc(sb->s_blocksize, GFP_NOFS);
memcpy(rc->rc_bitmap, dchunk->dqc_bitmap,
(ol_chunk_entries(sb) + 7) >> 3);
The remaining bytes beyond the copied region are left uninitialized.
When ocfs2_recover_local_quota_file() later passes this bitmap to
find_next_bit(), it reads the uninitialized tail bytes, which KMSAN
flags as a use of uninitialized memory.
Fix this by using kzalloc() to ensure the entire buffer is zeroed,
so that find_next_bit() sees zero bits (no recovery needed) for
entries beyond the valid bitmap portion.
Reported-by: syzbot+7ea0b96c4ddb49fd1a70@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7ea0b96c4ddb49fd1a70
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/ocfs2/quota_local.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index XXXXXXX..XXXXXXX 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -305,7 +305,7 @@ static int ocfs2_add_recovery_chunk(struct super_block *sb,
if (!rc)
return -ENOMEM;
rc->rc_chunk = chunk;
- rc->rc_bitmap = kmalloc(sb->s_blocksize, GFP_NOFS);
+ rc->rc_bitmap = kzalloc(sb->s_blocksize, GFP_NOFS);
if (!rc->rc_bitmap) {
kfree(rc);
return -ENOMEM;
--
2.43.0