ntfs3: fix uninit memory after failed mi_read in mi_format_new

Fix a KMSAN un-init bug found by syzkaller.

ntfs_get_bh() expects a buffer from sb_getblk(), that buffer may not be
uptodate. We do not bring the buffer uptodate before setting it as
uptodate. If the buffer were to not be uptodate, it could mean adding a
buffer with un-init data to the mi record. Attempting to load that record
will trigger KMSAN.

Avoid this by setting the buffer as uptodate, if it’s not already, by
overwriting it.

Reported-by: syzbot+7a2ba6b7b66340cff225@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7a2ba6b7b66340cff225
Tested-by: syzbot+7a2ba6b7b66340cff225@syzkaller.appspotmail.com
Fixes: 4342306f0f0d5 ("fs/ntfs3: Add file operations and implementation")
Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>

diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
index c7a2f191254dad5beab8e8a46587e44936fef51b..5ae910e9ecbda483536a6312d3d935909e132aa4 100644 (file)
--- a/fs/ntfs3/fsntfs.c
+++ b/fs/ntfs3/fsntfs.c
@@ -1349,7 +1349,14 @@ int ntfs_get_bh(struct ntfs_sb_info *sbi, const struct runs_tree *run, u64 vbo,
                                }
                                if (buffer_locked(bh))
                                        __wait_on_buffer(bh);
-                               set_buffer_uptodate(bh);
+
+                               lock_buffer(bh);
+                               if (!buffer_uptodate(bh))
+                               {
+                                       memset(bh->b_data, 0, blocksize);
+                                       set_buffer_uptodate(bh);
+                               }
+                               unlock_buffer(bh);
                        } else {
                                bh = ntfs_bread(sb, block);
                                if (!bh) {