]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
jfs: Fix uninit-value access of new_ea in ea_buffer
authorZhao Mengmeng <zhaomengmeng@kylinos.cn>
Wed, 4 Sep 2024 01:07:58 +0000 (09:07 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 17 Oct 2024 13:11:30 +0000 (15:11 +0200)
commitd7444f91a9f93eaa48827087ed0f3381c194181d
tree8615c9792d85c036934affb68f2f1e77ba497333
parent48edb1f7c288488bf4f2e3540e37c1d768d59c14
jfs: Fix uninit-value access of new_ea in ea_buffer

[ Upstream commit 2b59ffad47db1c46af25ccad157bb3b25147c35c ]

syzbot reports that lzo1x_1_do_compress is using uninit-value:

=====================================================
BUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178

...

Uninit was stored to memory at:
 ea_put fs/jfs/xattr.c:639 [inline]

...

Local variable ea_buf created at:
 __jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662
 __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934

=====================================================

The reason is ea_buf->new_ea is not initialized properly.

Fix this by using memset to empty its content at the beginning
in ea_get().

Reported-by: syzbot+02341e0daa42a15ce130@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=02341e0daa42a15ce130
Signed-off-by: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/jfs/xattr.c