linux-kernel - Forwarded: [PATCH] jfs: fix KMSAN warning in txLock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <69730340.a70a0220.35de72.0004.GAE@google.com>
Date: Thu, 22 Jan 2026 21:12:32 -0800
From: syzbot <syzbot+d3a57c32b9112d7b01ec@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] jfs: fix KMSAN warning in txLock

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] jfs: fix KMSAN warning in txLock
Author: kartikey406@...il.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Syzbot reported a KMSAN uninit-value warning in txLock when accessing
jfs_ip->atlhead:

  BUG: KMSAN: uninit-value in txLock+0x13a2/0x2900 fs/jfs/jfs_txnmgr.c:659

This occurs because the jfs_inode_info structure is allocated from a
slab cache but not fully initialized, leaving fields like atlhead,
atltail, and anon_inode_list with garbage values from previously freed
inodes.

When txLock() attempts to traverse the anonymous transaction lock list
by reading jfs_ip->atlhead, it accesses uninitialized memory, triggering
the KMSAN warning.

Fix this by zeroing the entire jfs_inode_info structure in
jfs_alloc_inode(). This is consistent with how other filesystems handle
inode allocation and ensures all fields start with known values,
preventing this and potential similar bugs.

Reported-by: syzbot+d3a57c32b9112d7b01ec@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d3a57c32b9112d7b01ec
Signed-off-by: Deepanshu Kartikey <kartikey406@...il.com>
---
 fs/jfs/super.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index 3cfb86c5a36e..236fe8d42542 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -105,9 +105,7 @@ static struct inode *jfs_alloc_inode(struct super_block *sb)
 	jfs_inode = alloc_inode_sb(sb, jfs_inode_cachep, GFP_NOFS);
 	if (!jfs_inode)
 		return NULL;
-#ifdef CONFIG_QUOTA
-	memset(&jfs_inode->i_dquot, 0, sizeof(jfs_inode->i_dquot));
-#endif
+	memset(jfs_inode, 0, sizeof(struct jfs_inode_info));
 	return &jfs_inode->vfs_inode;
 }

-- 
2.43.0