linux-kernel - Forwarded: [PATCH] hfsplus: add debug printk to show uninitialized values in case

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6970690b.a00a0220.3ad28e.4e2c.GAE@google.com>
Date: Tue, 20 Jan 2026 21:50:03 -0800
From: syzbot <syzbot+d80abb5b890d39261e72@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] hfsplus: add debug printk to show uninitialized
 values in case_fold

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] hfsplus: add debug printk to show uninitialized values in case_fold
Author: kartikey406@...il.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


This is a debug patch to demonstrate the uninit-value bug reported by
syzbot. Added printk in case_fold() to show what uninitialized values
are being read from the unicode array and used as array indices.

This patch intentionally does NOT include the fix (no initialization of
tmp variable) to demonstrate the bug behavior.

Link: https://syzkaller.appspot.com/bug?extid=d80abb5b890d39261e72
Signed-off-by: Deepanshu Kartikey <kartikey406@...il.com>
---
 fs/hfsplus/unicode.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/fs/hfsplus/unicode.c b/fs/hfsplus/unicode.c
index d3a142f4518b..418806c27943 100644
--- a/fs/hfsplus/unicode.c
+++ b/fs/hfsplus/unicode.c
@@ -11,7 +11,6 @@
 
 #include <linux/types.h>
 #include <linux/nls.h>
-
 #include <kunit/visibility.h>
 
 #include "hfsplus_fs.h"
@@ -22,12 +21,18 @@
 static inline u16 case_fold(u16 c)
 {
 	u16 tmp;
-
+	pr_alert("CASE_FOLD: Input c=0x%04x, c>>8=0x%02x (this is array index!)\n", c, c >> 8);
 	tmp = hfsplus_case_fold_table[c >> 8];
-	if (tmp)
+	pr_alert("CASE_FOLD: table[0x%02x]=0x%04x\n", c >> 8, tmp);
+
+	if (tmp) {
+		pr_alert("CASE_FOLD: Second lookup: table[0x%04x + 0x%02x]\n",tmp, c & 0xff);
 		tmp = hfsplus_case_fold_table[tmp + (c & 0xff)];
-	else
+	} else {
 		tmp = c;
+	}
+	pr_alert("CASE_FOLD: Final result=0x%04x\n", tmp);
+
 	return tmp;
 }
 
-- 
2.43.0