Chao Yu 58d83fc160 hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() ... commit 26a2ed1079 upstream. Syzbot reports uninitialized value access issue as below: loop0: detected capacity change from 0 to 64 ===================================================== BUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 d_revalidate fs/namei.c:862 [inline] lookup_fast+0x89e/0x8e0 fs/namei.c:1649 walk_component fs/namei.c:2001 [inline] link_path_walk+0x817/0x1480 fs/namei.c:2332 path_lookupat+0xd9/0x6f0 fs/namei.c:2485 filename_lookup+0x22e/0x740 fs/namei.c:2515 user_path_at_empty+0x8b/0x390 fs/namei.c:2924 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3689 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount+0x66b/0x810 fs/namespace.c:3875 __x64_sys_mount+0xe4/0x140 fs/namespace.c:3875 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline] BUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 hfs_ext_read_extent fs/hfs/extent.c:196 [inline] hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271 hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39 filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426 do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553 do_read_cache_page mm/filemap.c:3595 [inline] read_cache_page+0xfb/0x2f0 mm/filemap.c:3604 read_mapping_page include/linux/pagemap.h:755 [inline] hfs_btree_open+0x928/0x1ae0 fs/hfs/btree.c:78 hfs_mdb_get+0x260c/0x3000 fs/hfs/mdb.c:204 hfs_fill_super+0x1fb1/0x2790 fs/hfs/super.c:406 mount_bdev+0x628/0x920 fs/super.c:1359 hfs_mount+0xcd/0xe0 fs/hfs/super.c:456 legacy_get_tree+0x167/0x2e0 fs/fs_context.c:610 vfs_get_tree+0xdc/0x5d0 fs/super.c:1489 do_new_mount+0x7a9/0x16f0 fs/namespace.c:3145 path_mount+0xf98/0x26a0 fs/namespace.c:3475 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x919/0x9e0 fs/namespace.c:3674 __ia32_sys_mount+0x15b/0x1b0 fs/namespace.c:3674 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Uninit was created at: __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2190 [inline] allocate_slab mm/slub.c:2354 [inline] new_slab+0x2d7/0x1400 mm/slub.c:2407 ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] kmem_cache_alloc_lru+0x64d/0xb30 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3018 [inline] hfs_alloc_inode+0x5a/0xc0 fs/hfs/super.c:165 alloc_inode+0x83/0x440 fs/inode.c:260 new_inode_pseudo fs/inode.c:1005 [inline] new_inode+0x38/0x4f0 fs/inode.c:1031 hfs_new_inode+0x61/0x1010 fs/hfs/inode.c:186 hfs_mkdir+0x54/0x250 fs/hfs/dir.c:228 vfs_mkdir+0x49a/0x700 fs/namei.c:4126 do_mkdirat+0x529/0x810 fs/namei.c:4149 __do_sys_mkdirat fs/namei.c:4164 [inline] __se_sys_mkdirat fs/namei.c:4162 [inline] __x64_sys_mkdirat+0xc8/0x120 fs/namei.c:4162 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b It missed to initialize .tz_secondswest, .cached_start and .cached_blocks fields in struct hfs_inode_info after hfs_alloc_inode(), fix it. Cc: stable@vger.kernel.org Reported-by: syzbot+3ae6be33a50b5aae4dab@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-fsdevel/0000000000005ad04005ee48897f@google.com Signed-off-by: Chao Yu <chao@kernel.org> Link: https://lore.kernel.org/r/20240616013841.2217-1-chao@kernel.org Signed-off-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-08-03 08:49:32 +02:00
..
9p	9p: add missing locking around taking dentry fid list	2024-06-16 13:41:37 +02:00
adfs	fs: Convert block_read_full_page() to block_read_full_folio()	2022-05-09 16:21:44 -04:00
affs	affs: initialize fsdata in affs_truncate()	2023-02-01 08:34:08 +01:00
afs	afs: Don't cross .backup mountpoint from backup volume	2024-06-16 13:41:31 +02:00
autofs	autofs: fix memory leak of waitqueues in autofs_catatonic_mode	2023-09-23 11:10:59 +02:00
befs	befs: Convert befs_symlink_read_folio() to use a folio	2022-08-02 12:34:03 -04:00
bfs	fs: Convert block_read_full_page() to block_read_full_folio()	2022-05-09 16:21:44 -04:00
btrfs	btrfs: do not BUG_ON on failure to get dir index for new snapshot	2024-07-27 11:32:19 +02:00
cachefiles	cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()	2024-07-25 09:49:21 +02:00
ceph	ceph: switch to corrected encoding of max_xattr_size in mdsmap	2024-03-15 10:48:13 -04:00
coda	coda: Avoid partial allocation of sig_inputArgs	2023-03-10 09:33:52 +01:00
configfs	configfs: fix possible memory leak in configfs_create_dir()	2022-12-31 13:32:22 +01:00
cramfs	fs/cramfs/inode.c: initialize file_ra_state	2023-03-10 09:34:09 +01:00
crypto	blk-crypto: add a blk_crypto_config_supported_natively helper	2023-05-11 23:03:00 +09:00
debugfs	debugfs: fix automount d_fsdata usage	2024-01-20 11:50:04 +01:00
devpts
dlm	fs: dlm: don't put dlm_local_addrs on heap	2024-02-16 19:06:29 +01:00
ecryptfs	ecryptfs: Fix buffer size for tag 66 packet	2024-06-12 11:03:04 +02:00
efivarfs	efivarfs: Request at most 512 bytes for variable names	2024-03-06 14:45:11 +00:00
efs	efs: Convert efs symlinks to read_folio	2022-05-09 16:21:45 -04:00
erofs	erofs: ensure m_llen is reset to 0 if metadata is invalid	2024-07-25 09:49:18 +02:00
exfat	exfat: support handle zero-size directory	2023-11-28 17:07:00 +00:00
exportfs	exportfs: use pr_debug for unreachable debug statements	2024-03-06 14:45:15 +00:00
ext2	ext2: fix datatype of block number in ext2_xattr_set2()	2023-09-23 11:11:05 +02:00
ext4	ext4: avoid writing unitialized memory to disk in EA inodes	2024-08-03 08:49:16 +02:00
f2fs	f2fs: avoid dead loop in f2fs_issue_checkpoint()	2024-07-27 11:32:18 +02:00
fat	fat: fix uninitialized field in nostale filehandles	2024-04-03 15:19:27 +02:00
freevxfs	freevxfs: Convert vxfs_immed_read_folio() to use a folio	2022-08-02 12:34:03 -04:00
fscache	netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume()	2024-07-25 09:49:20 +02:00
fuse	fuse: verify {g,u}id mount options correctly	2024-08-03 08:49:31 +02:00
gfs2	gfs2: Fix slab-use-after-free in gfs2_qd_dealloc	2024-07-05 09:32:00 +02:00
hfs	hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()	2024-08-03 08:49:32 +02:00
hfsplus	hfsplus: fix to avoid false alarm of circular locking	2024-08-03 08:48:53 +02:00
hostfs	hostfs: move from strlcpy with unused retval to strscpy	2022-09-19 22:46:25 +02:00
hpfs	hpfs: Convert symlinks to read_folio	2022-05-09 16:21:45 -04:00
hugetlbfs	mm/hugetlb: add hugetlb_folio_subpool() helpers	2024-05-17 11:55:51 +02:00
iomap	iomap: Fix iomap_adjust_read_range for plen calculation	2024-07-25 09:49:12 +02:00
isofs	isofs: handle CDs with bad root inode but good Joliet root directory	2024-04-13 13:05:06 +02:00
jbd2	jbd2: fix soft lockup in journal_finish_inode_data_buffers()	2024-01-20 11:50:07 +01:00
jffs2	jffs2: Fix potential illegal address access in jffs2_free_inode	2024-07-11 12:47:09 +02:00
jfs	jfs: don't walk off the end of ealist	2024-07-27 11:32:18 +02:00
kernfs	kernfs: Convert kernfs_path_from_node_locked() from strlcpy() to strscpy()	2024-08-03 08:48:54 +02:00
lockd	lockd: fix file selection in nlmsvc_cancel_blocked	2024-03-06 14:45:16 +00:00
minix	vfs: open inside ->tmpfile()	2022-09-24 07:00:00 +02:00
netfs	netfs: Only call folio_start_fscache() one time for each folio	2023-10-06 14:56:32 +02:00
nfs	NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server	2024-08-03 08:49:16 +02:00
nfs_common
nfsd	knfsd: LOOKUP can return an illegal error value	2024-06-21 14:35:55 +02:00
nilfs2	nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro	2024-08-03 08:49:28 +02:00
nls	fs/nls: make load_nls() take a const parameter	2023-09-13 09:42:22 +02:00
notify	fanotify: disallow mount/sb marks on kernel internal pseudo fs	2023-07-19 16:22:05 +02:00
ntfs	- hfs and hfsplus kmap API modernization from Fabio Francesco	2022-10-12 11:00:22 -07:00
ntfs3	fs/ntfs3: Keep runs for $MFT::$ATTR_DATA and $MFT::$ATTR_BITMAP	2024-08-03 08:49:28 +02:00
ocfs2	ocfs2: add bounds checking to ocfs2_check_dir_entry()	2024-07-27 11:32:18 +02:00
omfs	fs: Convert block_read_full_page() to block_read_full_folio()	2022-05-09 16:21:44 -04:00
openpromfs	openpromfs: finish conversion to the new mount API	2024-06-12 11:03:03 +02:00
orangefs	orangefs: fix out-of-bounds fsid access	2024-07-11 12:47:08 +02:00
overlayfs	ovl: remove upper umask handling from ovl_create_upper()	2024-06-12 11:03:39 +02:00
proc	fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP	2024-08-03 08:49:28 +02:00
pstore	pstore/zone: Add a null pointer check to the psz_kmsg_read	2024-04-13 13:04:57 +02:00
qnx4	fs: Convert block_read_full_page() to block_read_full_folio()	2022-05-09 16:21:44 -04:00
qnx6	fs/qnx6: delete unnecessary checks before brelse()	2022-09-11 21:55:07 -07:00
quota	quota: Fix rcu annotations of inode dquot pointers	2024-03-26 18:20:47 -04:00
ramfs	shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs	2023-07-19 16:22:11 +02:00
reiserfs	reiserfs: Check the return value from __getblk()	2023-09-13 09:42:27 +02:00
romfs	romfs: Convert romfs to read_folio	2022-05-09 16:21:46 -04:00
smb	cifs: fix noisy message on copy_file_range	2024-07-25 09:49:19 +02:00
squashfs	revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"	2023-02-22 12:59:50 +01:00
sysfs	fs: sysfs: Fix reference leak in sysfs_break_active_protection()	2024-04-27 17:07:16 +02:00
sysv	sysv: don't call sb_bread() with pointers_lock held	2024-04-13 13:05:05 +02:00
tracefs	tracefs: Add missing lockdown check to tracefs_create_dir()	2023-09-23 11:11:12 +02:00
ubifs	ubifs: Set page uptodate in the correct place	2024-04-03 15:19:27 +02:00
udf	udf: udftime: prevent overflow in udf_disk_stamp_to_time()	2024-06-27 13:46:17 +02:00
ufs	ufs: replace ll_rw_block()	2022-09-11 20:26:07 -07:00
unicode
vboxsf	vboxsf: Avoid an spurious warning if load_nls_xxx() fails	2024-04-10 16:28:25 +02:00
verity	fsverity: skip PKCS#7 parser when keyring is empty	2023-09-13 09:43:03 +02:00
xfs	xfs: short circuit xfs_growfs_data_private() if delta is zero	2024-05-25 16:21:34 +02:00
zonefs	zonefs: Improve error handling	2024-02-23 09:12:45 +01:00
aio.c	fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion	2024-04-03 15:19:42 +02:00
anon_inodes.c	dynamic_dname(): drop unused dentry argument	2022-08-20 11:34:04 -04:00
attr.c	attr: block mode changes of symlinks	2023-09-23 11:11:10 +02:00
bad_inode.c	vfs: open inside ->tmpfile()	2022-09-24 07:00:00 +02:00
binfmt_elf_fdpic.c	fs: binfmt_elf_efpic: fix personality for ELF-FDPIC	2023-10-06 14:57:06 +02:00
binfmt_elf_test.c
binfmt_elf.c	mm: always expand the stack with the mmap write lock held	2023-07-01 13:16:25 +02:00
binfmt_flat.c	binfmt_flat: Remove shared library support	2022-04-22 10:57:18 -07:00
binfmt_misc.c	binfmt_misc: fix shift-out-of-bounds in check_special_flags	2022-12-31 13:32:57 +01:00
binfmt_script.c
buffer.c	- hfs and hfsplus kmap API modernization from Fabio Francesco	2022-10-12 11:00:22 -07:00
char_dev.c	chardev: fix error handling in cdev_device_add()	2022-12-31 13:32:41 +01:00
compat_binfmt_elf.c
coredump.c	coredump: Move dump_emit_page() to kill unused warning	2023-02-22 12:59:50 +01:00
d_path.c	d_path.c: typo fix...	2022-08-20 11:34:33 -04:00
dax.c	Merge branch 'for-6.0/dax' into libnvdimm-fixes	2022-09-24 18:14:12 -07:00
dcache.c	fs: better handle deep ancestor chains in is_subdir()	2024-07-25 09:49:18 +02:00
direct-io.c	block: remove PSI accounting from the bio layer	2022-09-20 08:24:38 -06:00
drop_caches.c
eventfd.c	eventfd: prevent underflow for eventfd semaphores	2023-09-13 09:42:27 +02:00
eventpoll.c	epoll: be better about file lifetimes	2024-06-12 11:03:03 +02:00
exec.c	exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()	2024-04-03 15:19:48 +02:00
fcntl.c	fs: Fix rw_hint validation	2024-03-26 18:20:28 -04:00
fhandle.c	do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak	2024-03-26 18:20:27 -04:00
file_table.c	locks: fix TOCTOU race when granting write lease	2022-08-16 10:59:54 -04:00
file.c	fs/file: fix the check in find_next_fd()	2024-07-25 09:49:12 +02:00
filesystems.c
fs_context.c	vfs, security: Fix automount superblock LSM init problem, preventing NFS sb sharing	2023-09-13 09:42:28 +02:00
fs_parser.c	ext4: journal_path mount options should follow links	2023-01-07 11:11:59 +01:00
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c	writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs	2023-11-20 11:51:50 +01:00
fsopen.c	uninline may_mount() and don't opencode it in fspick(2)/fsopen(2)	2022-05-19 23:25:10 -04:00
init.c
inode.c	filemap: add a per-mapping stable writes flag	2024-01-10 17:10:32 +01:00
internal.h	nfs: use vfs setgid helper	2023-08-30 16:11:10 +02:00
ioctl.c	lsm: new security_file_ioctl_compat() hook	2024-01-31 16:17:00 -08:00
Kconfig	smb: move client and server files to common directory fs/smb	2023-06-28 11:12:40 +02:00
Kconfig.binfmt	Xtensa updates for v6.1	2022-10-10 14:21:11 -07:00
kernel_read_file.c	fs/kernel_read_file: allow to read files up-to ssize_t	2022-06-16 19:58:21 -07:00
libfs.c	libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value	2022-12-31 13:31:58 +01:00
locks.c	filelock: Fix fcntl/close race recovery compat path	2024-07-27 11:32:19 +02:00
Makefile	smb: move client and server files to common directory fs/smb	2023-06-28 11:12:40 +02:00
mbcache.c	ext4: fix deadlock due to mbcache entry corruption	2023-01-07 11:12:02 +01:00
mount.h	switch try_to_unlazy_next() to __legitimize_mnt()	2022-07-05 16:18:21 -04:00
mpage.c	Folio changes for 6.0	2022-08-03 10:35:43 -07:00
namei.c	rename(): fix the locking of subdirectories	2024-01-31 16:17:02 -08:00
namespace.c	fs: relax mount_setattr() permission checks	2024-02-23 09:12:46 +01:00
no-block.c
nsfs.c	dynamic_dname(): drop unused dentry argument	2022-08-20 11:34:04 -04:00
open.c	ftruncate: pass a signed offset	2024-07-05 09:31:59 +02:00
pipe.c	fs/pipe: Fix lockdep false-positive in watchqueue pipe_write()	2024-04-10 16:28:30 +02:00
pnode.c	pnode: terminate at peers of source	2023-01-04 11:29:01 +01:00
pnode.h
posix_acl.c	- Yu Zhao's Multi-Gen LRU patches are here. They've been under test in	2022-10-10 17:53:04 -07:00
proc_namespace.c	vfs: escape hash as well	2022-06-28 13:58:05 -04:00
read_write.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
readdir.c	Change calling conventions for filldir_t	2022-08-17 17:25:04 -04:00
remap_range.c	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
select.c	fs/select: rework stack allocation hack for clang	2024-03-26 18:20:28 -04:00
seq_file.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
signalfd.c
splice.c	mm: merge folio_has_private()/filemap_release_folio() call pairs	2024-01-10 17:10:31 +01:00
stack.c
stat.c	vfs: support STATX_DIOALIGN on block devices	2022-09-11 19:47:12 -05:00
statfs.c	statfs: enforce statfs[64] structure initialization	2023-05-24 17:32:51 +01:00
super.c	fs: Protect reconfiguration of sb read-write from racing writes	2023-08-11 12:08:24 +02:00
sync.c	riscv: compat: syscall: Add compat_sys_call_table implementation	2022-04-26 13:36:25 -07:00
sysctls.c
timerfd.c
userfaultfd.c	Fix userfaultfd_api to return EINVAL as expected	2024-07-18 13:18:41 +02:00
utimes.c
xattr.c	fs: don't audit the capability check in simple_xattr_list()	2022-12-31 13:31:55 +01:00