Skip to content

Commit 2b59ffa

Browse files
Zhao Mengmengkleikamp
authored andcommitted
jfs: Fix uninit-value access of new_ea in ea_buffer
syzbot reports that lzo1x_1_do_compress is using uninit-value: ===================================================== BUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178 ... Uninit was stored to memory at: ea_put fs/jfs/xattr.c:639 [inline] ... Local variable ea_buf created at: __jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662 __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934 ===================================================== The reason is ea_buf->new_ea is not initialized properly. Fix this by using memset to empty its content at the beginning in ea_get(). Reported-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=02341e0daa42a15ce130 Signed-off-by: Zhao Mengmeng <[email protected]> Signed-off-by: Dave Kleikamp <[email protected]>
1 parent d64ff0d commit 2b59ffa

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

fs/jfs/xattr.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -434,6 +434,8 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size)
434434
int rc;
435435
int quota_allocation = 0;
436436

437+
memset(&ea_buf->new_ea, 0, sizeof(ea_buf->new_ea));
438+
437439
/* When fsck.jfs clears a bad ea, it doesn't clear the size */
438440
if (ji->ea.flag == 0)
439441
ea_size = 0;

0 commit comments

Comments
 (0)