[PATCH] hfsplus: zero-initialize data buffer in hfs_bnode_read_u16 and hfs_bnode_read_u8

[PATCH] hfsplus: zero-initialize data buffer in hfs_bnode_read_u16 and hfs_bnode_read_u8

[Tristan Madani]

hfs_bnode_read_u16() and hfs_bnode_read_u8() declare local data
variables without initialization, then pass them to hfs_bnode_read().

When hfs_bnode_read() returns early due to an invalid offset on a
corrupted HFS+ image (the is_bnode_offset_valid() check), the data
buffer is never written and the functions return uninitialized stack
data.  KMSAN flags this as a use of uninitialized memory.

Zero-initialize both data variables so that an early return from
hfs_bnode_read() produces a deterministic zero value instead of
stack garbage.

Reported-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=217eb327242d08197efb
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/hfsplus/bnode.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c
index 14f4995588ff..4404cd35c192 100644
--- a/fs/hfsplus/bnode.c
+++ b/fs/hfsplus/bnode.c
@@ -96,7 +96,7 @@ void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len)
 
 u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off)
 {
-	__be16 data;
+	__be16 data = 0;
 	/* TODO: optimize later... */
 	hfs_bnode_read(node, &data, off, 2);
 	return be16_to_cpu(data);
@@ -104,7 +104,7 @@ u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off)
 
 u8 hfs_bnode_read_u8(struct hfs_bnode *node, int off)
 {
-	u8 data;
+	u8 data = 0;
 	/* TODO: optimize later... */
 	hfs_bnode_read(node, &data, off, 1);
 	return data;
-- 
2.47.3

Re: [PATCH] hfsplus: zero-initialize data buffer in hfs_bnode_read_u16 and hfs_bnode_read_u8

[Viacheslav Dubeyko]

On Fri, 2026-04-17 at 19:39 +0000, Tristan Madani wrote:
> hfs_bnode_read_u16() and hfs_bnode_read_u8() declare local data
> variables without initialization, then pass them to hfs_bnode_read().
> 
> When hfs_bnode_read() returns early due to an invalid offset on a
> corrupted HFS+ image (the is_bnode_offset_valid() check), the data
> buffer is never written and the functions return uninitialized stack
> data.  KMSAN flags this as a use of uninitialized memory.
> 
> Zero-initialize both data variables so that an early return from
> hfs_bnode_read() produces a deterministic zero value instead of
> stack garbage.
> 
> Reported-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=217eb327242d08197efb
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
>  fs/hfsplus/bnode.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c
> index 14f4995588ff..4404cd35c192 100644
> --- a/fs/hfsplus/bnode.c
> +++ b/fs/hfsplus/bnode.c
> @@ -96,7 +96,7 @@ void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len)
>  
>  u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off)
>  {
> -	__be16 data;
> +	__be16 data = 0;
>  	/* TODO: optimize later... */
>  	hfs_bnode_read(node, &data, off, 2);
>  	return be16_to_cpu(data);
> @@ -104,7 +104,7 @@ u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off)
>  
>  u8 hfs_bnode_read_u8(struct hfs_bnode *node, int off)
>  {
> -	u8 data;
> +	u8 data = 0;
>  	/* TODO: optimize later... */
>  	hfs_bnode_read(node, &data, off, 1);
>  	return data;

Both methods hfs_bnode_read_u16() and hfs_bnode_read_u8() call the
hfs_bnode_read(). And it is widely used method. We need to make initialization
at all places where hfs_bnode_read() is called. Oppositely, we can initialize
buffer in hfs_bnode_read() itself.

Thanks,
Slava.