From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yw1-f174.google.com (mail-yw1-f174.google.com [209.85.128.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 176132E5B29 for ; Sun, 28 Jun 2026 09:48:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782640122; cv=none; b=uJNx7iQIuBmn1b/GXvNqU1sd6BxaRzYB991r1VkCPQpeU9xyNEKt6YtlcbWDfKtZhhuTQ/9xlbMwQ5OUk00rjLfs2EZ8JJdVnIzTivpl5jtBJ6nxMq5S+/T+EnBv/mIMZo4zeDVLkKjMbOPOlqDxO0/DnZwR9qNjTz5OeR8sbzY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782640122; c=relaxed/simple; bh=WQcQ7QnDNpj6b+N54Y8A71HMVtVxhAxt2cuaVLwotzQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=V3dWSBlY7DKBkUwgC3ebjTvmw1gOsCUtLJmzHuVsXy20nrppZ6HB4RXrYFwgn3Ed77hxSfD0FvcJ9W2t5xIuFWP6BJrYWnikirvwCLMYp/gxb6IP+snsNNh/NeTOwbKyhMz4XenvJS4P+UJa74SLNkACWS8QYY+oxNClW6xX3Ws= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=jjRe0WOa; arc=none smtp.client-ip=209.85.128.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="jjRe0WOa" Received: by mail-yw1-f174.google.com with SMTP id 00721157ae682-80dc4a68e4aso4035627b3.0 for ; Sun, 28 Jun 2026 02:48:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782640120; x=1783244920; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=BSJ5wyzaVD0AAbYArY5bvFALJrFls1U2rKAskILea1s=; b=jjRe0WOaiPoAW5lpM9LhyziJECRmQCk/Q/n15gN4aweH2esiZweNP2FGwv4bQa0O5d cMQm4CrAlLKN2idt68P5skze6G1RtSaD/uvVllMq67+is7ipFketd0iJZcSeivrzvl6C uG5VAni+1ij27pqmK8FYb+mj3OKDL2vEV8XZXc+SnzsSguCwT9sOKoYfns3Oa9ijhiuu WzucI/DEXUK60X7MBEO6iNvj83m+8m61SYu9wUANNj5ftEspXH0wYs/PkcVD5nbbcNAr uJM6RBpTkMEmvuAx6Wb4l/hQaBJxlCvr9FNnO6BPIXtc/gyimV6RAve6H6d+F9Y5rAG7 zDgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782640120; x=1783244920; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=BSJ5wyzaVD0AAbYArY5bvFALJrFls1U2rKAskILea1s=; b=Q4mFJswee/i4ct9Do6HQuVUIIb7TXtSxbXHG13djx/iZ1LjLhDOzdNOQzxLT/7zgfO J9LOeRxDBvERYMQM75MH6kZRBwwGJA7tur87svfIqbQBuCs6QRpZC35QuCQC3jIzpEK8 oYRrHnNDjHF+gTFWsadcw99f8nGu/9KQmOEdLs5l4LFS+oOM8ECsnlhhCUMAEgeZU5Fr UXd6tSBFTM0MTMJnTcuVw1trnpULwaWfyXDwMZvBLV4IGXGGHwguLJCw3y6nJEp5lppM mVV/yXHJQBag58ew3xXA5XPD/VECEoOQ6m+4rUoPlYbUu4TWzM6bOv6lNfYnwCHhsNp2 X8JA== X-Forwarded-Encrypted: i=1; AHgh+Rq3xmsc60VXte8XsRxzwpwpU9elHCFnQfz1vXeJAYVQU/73NV3GNiaRLLgx3obF/zYqGXMTmSILmLqYle4=@vger.kernel.org X-Gm-Message-State: AOJu0Yxk1/s3oYH5sY4KkXVxQHDxxBK1z54xPFDujj1y3YQgkf9SENAJ WwOgxEeQw5GnXIogNrXrukVbvFKtwW7HzonHTtKHRdQYifyu4wM9gk0J X-Gm-Gg: AfdE7clwRgNY4tkDW2p5uNv2DUgvkWebrCvTACEb/JBlY3BOEfYOl0SRgx8KTMkYKkx kPAlaYuGOk0CkLiDgpko/FWWtD6mr9A6DK9LZjQxOhdtS43CTNywIH4ktyZw+YQTy3RfEKDTpT9 tG5GrhLI12ZuLvZUsuAyk/4T3hNhteoRAB9dl+U+BEg0rk2QaZ1ZL51hStrtEVoABzNEYLAC6n3 Ml3mCXmh4dx6khy8KGLMquYxjo+7e57nJDOil+yUOjtfMyDv3waBIY+47JupDDBbMhB6SxEtj+T 3S/VKKRYp28WUjJnWxEkiaJZoI5r3xauhEQD87gTtw1996RRlZY3mQasBC5x2DPRvgUevKJkbA7 dpqZtcF+tgUYLUj7eAnTApYuyjfiDMsGPu931rdUlkGSBkmSPvL2/oJ6Mk8ADAJqMnRZHbR4P+4 F/tbETVnFwEukDKJtlHOuG9yVP7g== X-Received: by 2002:a05:690c:c6c7:b0:80a:a034:17c5 with SMTP id 00721157ae682-80aa0343466mr102014457b3.53.1782640120184; Sun, 28 Jun 2026 02:48:40 -0700 (PDT) Received: from Dev-Null-MSI ([2a0d:3344:52ac:a808:98a4:4381:be45:536f]) by smtp.gmail.com with ESMTPSA id 00721157ae682-80c211137bdsm24277057b3.12.2026.06.28.02.48.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 28 Jun 2026 02:48:39 -0700 (PDT) From: Yousef Alhouseen To: Carlos Maiolino Cc: linux-xfs@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, syzbot+97f2c05378c5d68dcb8c@syzkaller.appspotmail.com, Yousef Alhouseen Subject: [PATCH] xfs: zero newly allocated btree root space Date: Sun, 28 Jun 2026 11:47:48 +0200 Message-ID: <20260628094748.46578-1-alhouseenyousef@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit xfs_broot_realloc() preserves the existing in-inode btree root while growing its allocation, but leaves the added bytes uninitialized. The inode log formatter copies if_broot_bytes bytes into the journal, so those bytes reach the log record and its CRC calculation before every location has necessarily been overwritten by btree updates. Clear the newly allocated tail immediately after a successful growth to keep stale heap contents out of the filesystem log. Fixes: 6c1c55ac3c05 ("xfs: refactor the inode fork memory allocation functions") Reported-by: syzbot+97f2c05378c5d68dcb8c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=97f2c05378c5d68dcb8c Cc: stable@vger.kernel.org Signed-off-by: Yousef Alhouseen --- fs/xfs/libxfs/xfs_inode_fork.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/xfs/libxfs/xfs_inode_fork.c b/fs/xfs/libxfs/xfs_inode_fork.c index 606a36526ce2..0d81c78f5afe 100644 --- a/fs/xfs/libxfs/xfs_inode_fork.c +++ b/fs/xfs/libxfs/xfs_inode_fork.c @@ -398,6 +398,8 @@ xfs_broot_realloc( struct xfs_ifork *ifp, size_t new_size) { + size_t old_size = ifp->if_broot_bytes; + /* No size change? No action needed. */ if (new_size == ifp->if_broot_bytes) return ifp->if_broot; @@ -430,6 +432,7 @@ xfs_broot_realloc( */ ifp->if_broot = krealloc(ifp->if_broot, new_size, GFP_KERNEL | __GFP_NOFAIL); + memset((char *)ifp->if_broot + old_size, 0, new_size - old_size); ifp->if_broot_bytes = new_size; return ifp->if_broot; } -- 2.54.0