linux-kernel - Re: [PATCH v2] ntfs3: fix uninit memory after failed mi_read in mi_format

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1c018215-0ce2-48dd-aced-1fe373a42358@paragon-software.com>
Date: Thu, 20 Nov 2025 09:46:43 +0100
From: Konstantin Komarov <almaz.alexandrovich@...agon-software.com>
To: Raphael Pinsonneault-Thibeault <rpthibeault@...il.com>
CC: <ntfs3@...ts.linux.dev>, <linux-kernel@...r.kernel.org>,
	<syzbot+7a2ba6b7b66340cff225@...kaller.appspotmail.com>,
	<linux-kernel-mentees@...ts.linux.dev>, <skhan@...uxfoundation.org>,
	<david.hunter.linux@...il.com>, <khalid@...nel.org>
Subject: Re: [PATCH v2] ntfs3: fix uninit memory after failed mi_read in
 mi_format_new

On 10/12/25 22:16, Raphael Pinsonneault-Thibeault wrote:

> Fix a KMSAN un-init bug found by syzkaller.
>
> ntfs_get_bh() expects a buffer from sb_getblk(), that buffer may not be
> uptodate. We do not bring the buffer uptodate before setting it as
> uptodate. If the buffer were to not be uptodate, it could mean adding a
> buffer with un-init data to the mi record. Attempting to load that record
> will trigger KMSAN.
>
> Avoid this by setting the buffer as uptodate, if it’s not already, by
> overwriting it.
>
> Reported-by: syzbot+7a2ba6b7b66340cff225@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=7a2ba6b7b66340cff225
> Tested-by: syzbot+7a2ba6b7b66340cff225@...kaller.appspotmail.com
> Fixes: 4342306f0f0d5 ("fs/ntfs3: Add file operations and implementation")
> Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@...il.com>
> ---
>
> v1:
> https://lore.kernel.org/all/20250925203701.223744-2-rpthibeault@gmail.com/
> Differences from v1:
> In the previous version, I thought that mi_read() returning an error was
> a genuine reason to stop trying to format the record. That was wrong. If
> we find that mi_read() fails and that therefore we cannot reuse an old
> record, we should try to make a new one. It then follows that
> ntfs_get_bh() should provide an uptodate bh for the new record.
>
> On testing:
> I could not get xfstests-bld to work for ntfs3. Config nightmare. So I
> first tested with the syzkaller repro, then tested for regressions manually
> with a program that called all the syscall code paths touched by my change:
> mkdir, fallocate (FALLOC_FL_COLLAPSE_RANGE), and
> fallocate (FALLOC_FL_INSERT_RANGE).
>
>   fs/ntfs3/fsntfs.c | 9 ++++++++-
>   1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
> index 938d351ebac7..0c07502fdb0f 100644
> --- a/fs/ntfs3/fsntfs.c
> +++ b/fs/ntfs3/fsntfs.c
> @@ -1373,7 +1373,14 @@ int ntfs_get_bh(struct ntfs_sb_info *sbi, const struct runs_tree *run, u64 vbo,
>   				}
>   				if (buffer_locked(bh))
>   					__wait_on_buffer(bh);
> -				set_buffer_uptodate(bh);
> +
> +				lock_buffer(bh);
> +				if (!buffer_uptodate(bh))
> +				{
> +					memset(bh->b_data, 0, blocksize);
> +					set_buffer_uptodate(bh);
> +				}
> +				unlock_buffer(bh);
>   			} else {
>   				bh = ntfs_bread(sb, block);
>   				if (!bh) {

Applied to my tree, thanks for the patch.

Regards,
Konstantin