[PATCH] hfsplus: zero-initialize data buffer in hfs_bnode_read_u16 and hfs_bnode_read_u8

[Tristan Madani <tristmd@gmail.com>]

hfs_bnode_read_u16() and hfs_bnode_read_u8() declare local data
variables without initialization, then pass them to hfs_bnode_read().

When hfs_bnode_read() returns early due to an invalid offset on a
corrupted HFS+ image (the is_bnode_offset_valid() check), the data
buffer is never written and the functions return uninitialized stack
data.  KMSAN flags this as a use of uninitialized memory.

Zero-initialize both data variables so that an early return from
hfs_bnode_read() produces a deterministic zero value instead of
stack garbage.

Reported-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=217eb327242d08197efb
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/hfsplus/bnode.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c
index 14f4995588ff..4404cd35c192 100644
--- a/fs/hfsplus/bnode.c
+++ b/fs/hfsplus/bnode.c
@@ -96,7 +96,7 @@ void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len)
 
 u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off)
 {
-	__be16 data;
+	__be16 data = 0;
 	/* TODO: optimize later... */
 	hfs_bnode_read(node, &data, off, 2);
 	return be16_to_cpu(data);
@@ -104,7 +104,7 @@ u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off)
 
 u8 hfs_bnode_read_u8(struct hfs_bnode *node, int off)
 {
-	u8 data;
+	u8 data = 0;
 	/* TODO: optimize later... */
 	hfs_bnode_read(node, &data, off, 1);
 	return data;
-- 
2.47.3