From: Greg Kroah-Hartman Date: Sat, 23 May 2026 09:23:33 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v6.6.141~3 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=7442c0448841326ff8b8a316b5cd84ae80dd6dba;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: netfs-fix-potential-uninitialised-var-in-netfs_extract_user_iter.patch --- diff --git a/queue-6.12/netfs-fix-potential-uninitialised-var-in-netfs_extract_user_iter.patch b/queue-6.12/netfs-fix-potential-uninitialised-var-in-netfs_extract_user_iter.patch new file mode 100644 index 0000000000..99b77bea07 --- /dev/null +++ b/queue-6.12/netfs-fix-potential-uninitialised-var-in-netfs_extract_user_iter.patch @@ -0,0 +1,41 @@ +From 7e3d8db899d54af39fafb2eb3392b0cdae9973b5 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 12 May 2026 13:33:45 +0100 +Subject: netfs: Fix potential uninitialised var in netfs_extract_user_iter() + +From: David Howells + +commit 7e3d8db899d54af39fafb2eb3392b0cdae9973b5 upstream. + +In netfs_extract_user_iter(), if it's given a zero-length iterator, it will +fall through the loop without setting ret, and so the error handling +behaviour will be undefined, depending on whether ret happens to be +negative. The value of ret then propagates back up the callstack. + +Fix this by presetting ret to 0. + +Fixes: 85dd2c8ff368 ("netfs: Add a function to extract a UBUF or IOVEC into a BVEC iterator") +Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com +Signed-off-by: David Howells +Link: https://patch.msgid.link/20260512123404.719402-9-dhowells@redhat.com +cc: Paulo Alcantara +cc: Matthew Wilcox +cc: netfs@lists.linux.dev +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman +--- + fs/netfs/iterator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/netfs/iterator.c ++++ b/fs/netfs/iterator.c +@@ -43,7 +43,7 @@ ssize_t netfs_extract_user_iter(struct i + unsigned int max_pages; + unsigned int npages = 0; + unsigned int i; +- ssize_t ret; ++ ssize_t ret = 0; + size_t count = orig_len, offset, len; + size_t bv_size, pg_size; + diff --git a/queue-6.12/series b/queue-6.12/series index 7420ef7a80..1b843744bc 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -659,3 +659,4 @@ mptcp-pm-add_addr-rtx-resched-blocked-add_addr-quicker.patch net-rds-reset-op_nents-when-zerocopy-page-pin-fails.patch net-skbuff-preserve-shared-frag-marker-during-coalescing.patch net-skbuff-propagate-shared-frag-marker-through-frag-transfer-helpers.patch +netfs-fix-potential-uninitialised-var-in-netfs_extract_user_iter.patch