linux-kernel - Re: [syzbot] [PATCH] fs/ntfs3: Fix KMSAN warning in longest_match

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6799bc86.050a0220.ac840.02c4.GAE@google.com>
Date: Tue, 28 Jan 2025 21:28:38 -0800
From: syzbot <syzbot+08d8956768c96a2c52cf@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org
Subject: Re: [syzbot] [PATCH] fs/ntfs3: Fix KMSAN warning in longest_match_std()

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org.

***

Subject: [PATCH] fs/ntfs3: Fix KMSAN warning in longest_match_std()
Author: gauthamgujjula@...il.com

#syz test

Syzkaller reported uninitialized memory in longest_match_std(),
originating from ntfs_compress_write(). In the case where a frame's
pages are not up to date, but that frame is not read in due to the
overlapping bounds of the write, the end of the frame will remain
uninitialized if the user data copied in is not frame-aligned.

To init the memory without invoking ni_read_frame() in cases where the
data will be overwritten anyways, add an additional clause to zero out
the section of the frame from the end of the user's data to the end of
the frame.

Reported-by: syzbot+08d8956768c96a2c52cf@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=08d8956768c96a2c52cf
Signed-off-by: Gautham Gujjula <gauthamgujjula@...il.com>
---
 fs/ntfs3/file.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c
index fad68ff0b6ed..6fc4f960f4d9 100644
--- a/fs/ntfs3/file.c
+++ b/fs/ntfs3/file.c
@@ -1122,6 +1122,13 @@ static ssize_t ntfs_compress_write(struct kiocb *iocb, struct iov_iter *from)
 					}
 					goto out;
 				}
+			} else if (to & (frame_size - 1)) {
+				for (ip = to >> PAGE_SHIFT, off = offset_in_page(to);
+				     ip < pages_per_frame;
+				     ip++, off = 0) {
+					zero_user_segment(pages[ip], off, PAGE_SIZE);
+					flush_dcache_page(pages[ip]);
+				}
 			}
 		}

-- 
2.45.3