From b6bd758b0e9d88c2c83aa646e709c8290a4b8c5a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 23 May 2026 11:23:41 +0200 Subject: [PATCH] 6.18-stable patches added patches: netfs-fix-potential-uninitialised-var-in-netfs_extract_user_iter.patch --- ...lised-var-in-netfs_extract_user_iter.patch | 41 +++++++++++++++++++ queue-6.18/series | 1 + 2 files changed, 42 insertions(+) create mode 100644 queue-6.18/netfs-fix-potential-uninitialised-var-in-netfs_extract_user_iter.patch diff --git a/queue-6.18/netfs-fix-potential-uninitialised-var-in-netfs_extract_user_iter.patch b/queue-6.18/netfs-fix-potential-uninitialised-var-in-netfs_extract_user_iter.patch new file mode 100644 index 0000000000..99b77bea07 --- /dev/null +++ b/queue-6.18/netfs-fix-potential-uninitialised-var-in-netfs_extract_user_iter.patch @@ -0,0 +1,41 @@ +From 7e3d8db899d54af39fafb2eb3392b0cdae9973b5 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 12 May 2026 13:33:45 +0100 +Subject: netfs: Fix potential uninitialised var in netfs_extract_user_iter() + +From: David Howells + +commit 7e3d8db899d54af39fafb2eb3392b0cdae9973b5 upstream. + +In netfs_extract_user_iter(), if it's given a zero-length iterator, it will +fall through the loop without setting ret, and so the error handling +behaviour will be undefined, depending on whether ret happens to be +negative. The value of ret then propagates back up the callstack. + +Fix this by presetting ret to 0. + +Fixes: 85dd2c8ff368 ("netfs: Add a function to extract a UBUF or IOVEC into a BVEC iterator") +Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com +Signed-off-by: David Howells +Link: https://patch.msgid.link/20260512123404.719402-9-dhowells@redhat.com +cc: Paulo Alcantara +cc: Matthew Wilcox +cc: netfs@lists.linux.dev +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman +--- + fs/netfs/iterator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/netfs/iterator.c ++++ b/fs/netfs/iterator.c +@@ -43,7 +43,7 @@ ssize_t netfs_extract_user_iter(struct i + unsigned int max_pages; + unsigned int npages = 0; + unsigned int i; +- ssize_t ret; ++ ssize_t ret = 0; + size_t count = orig_len, offset, len; + size_t bv_size, pg_size; + diff --git a/queue-6.18/series b/queue-6.18/series index 6b375bd8aa..eed89119b6 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -948,3 +948,4 @@ net-rds-reset-op_nents-when-zerocopy-page-pin-fails.patch net-skbuff-preserve-shared-frag-marker-during-coalescing.patch net-skbuff-propagate-shared-frag-marker-through-frag-transfer-helpers.patch selftests-bpf-remove-test_access_variable_array.patch +netfs-fix-potential-uninitialised-var-in-netfs_extract_user_iter.patch -- 2.47.3