From: Nikita Nagornyi <nagornyi@amazon.de>
To: <stable@vger.kernel.org>,
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>,
<ntfs3@lists.linux.dev>, <linux-kernel@vger.kernel.org>
Cc: Nirbhay Sharma <nirbhay.lkd@gmail.com>,
<syzbot+83c9dd5c0dcf6184fdbf@syzkaller.appspotmail.com>
Subject: [PATCH 6.1.y 3/4] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list
Date: Thu, 1 Oct 2026 11:45:48 +0000 [thread overview]
Message-ID: <20261001114549.162469-4-nagornyi@amazon.de> (raw)
In-Reply-To: <20261001114549.162469-1-nagornyi@amazon.de>
From: Nirbhay Sharma <nirbhay.lkd@gmail.com>
[ Upstream commit 5f33da04e6ceee849e76e6592cc283c72fef7af9 ]
The call to kmalloc() to allocate the attribute list buffer is given a
size of al_aligned(rs). This size can be larger than the data
subsequently copied into the buffer, leaving trailing bytes uninitialized.
This can trigger a KMSAN "uninit-value" warning if that memory is
later accessed.
Fix this by using kzalloc() instead, which ensures the entire
allocated buffer is zero-initialized, preventing the warning.
Reported-by: syzbot+83c9dd5c0dcf6184fdbf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf
Signed-off-by: Nirbhay Sharma <nirbhay.lkd@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Backport to 6.1.y: 6.1.y's ni_create_attr_list() uses a `goto out` cleanup
convention rather than upstream's direct returns, so only kmalloc -> kzalloc
was applied; the surrounding return/error path was left as is. ]
Signed-off-by: Nikita Nagornyi <nagornyi@amazon.de>
(cherry picked from commit 5f33da04e6ceee849e76e6592cc283c72fef7af9)
---
fs/ntfs3/frecord.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index 17559fca5984..c9d0947651c4 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -819,7 +819,7 @@ int ni_create_attr_list(struct ntfs_inode *ni)
* Skip estimating exact memory requirement.
* Looks like one record_size is always enough.
*/
- le = kmalloc(al_aligned(rs), GFP_NOFS);
+ le = kzalloc(al_aligned(rs), GFP_NOFS);
if (!le) {
err = -ENOMEM;
goto out;
--
2.50.1
next prev parent reply other threads:[~2026-10-01 11:46 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-01 11:45 [PATCH 6.1.y 0/4] fs/ntfs3: backport slab-out-of-bounds fix (CVE-2026-90048) Nikita Nagornyi
2026-10-01 11:45 ` [PATCH 6.1.y 1/4] fs/ntfs3: Add more checks in mi_enum_attr (part 2) Nikita Nagornyi
2026-10-02 14:19 ` Sasha Levin
2026-10-01 11:45 ` [PATCH 6.1.y 2/4] fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr() Nikita Nagornyi
2026-10-01 11:45 ` Nikita Nagornyi [this message]
2026-10-01 11:45 ` [PATCH 6.1.y 4/4] fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() Nikita Nagornyi
2026-10-02 14:19 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261001114549.162469-4-nagornyi@amazon.de \
--to=nagornyi@amazon.de \
--cc=almaz.alexandrovich@paragon-software.com \
--cc=linux-kernel@vger.kernel.org \
--cc=nirbhay.lkd@gmail.com \
--cc=ntfs3@lists.linux.dev \
--cc=stable@vger.kernel.org \
--cc=syzbot+83c9dd5c0dcf6184fdbf@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®