Skip to content

Commit 73e6b9d

Browse files
rpthibeaultaalexandrovich
authored andcommitted
ntfs3: fix uninit memory after failed mi_read in mi_format_new
Fix a KMSAN un-init bug found by syzkaller. ntfs_get_bh() expects a buffer from sb_getblk(), that buffer may not be uptodate. We do not bring the buffer uptodate before setting it as uptodate. If the buffer were to not be uptodate, it could mean adding a buffer with un-init data to the mi record. Attempting to load that record will trigger KMSAN. Avoid this by setting the buffer as uptodate, if it’s not already, by overwriting it. Reported-by: syzbot+7a2ba6b7b66340cff225@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7a2ba6b7b66340cff225 Tested-by: syzbot+7a2ba6b7b66340cff225@syzkaller.appspotmail.com Fixes: 4342306 ("fs/ntfs3: Add file operations and implementation") Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
1 parent 02f3127 commit 73e6b9d

1 file changed

Lines changed: 8 additions & 1 deletion

File tree

fs/ntfs3/fsntfs.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1349,7 +1349,14 @@ int ntfs_get_bh(struct ntfs_sb_info *sbi, const struct runs_tree *run, u64 vbo,
13491349
}
13501350
if (buffer_locked(bh))
13511351
__wait_on_buffer(bh);
1352-
set_buffer_uptodate(bh);
1352+
1353+
lock_buffer(bh);
1354+
if (!buffer_uptodate(bh))
1355+
{
1356+
memset(bh->b_data, 0, blocksize);
1357+
set_buffer_uptodate(bh);
1358+
}
1359+
unlock_buffer(bh);
13531360
} else {
13541361
bh = ntfs_bread(sb, block);
13551362
if (!bh) {

0 commit comments

Comments
 (0)