public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Xiaxi Shen <shenxiaxi26@gmail.com>,
	syzbot+eaba5abe296837a640c0@syzkaller.appspotmail.com,
	Theodore Ts'o <tytso@mit.edu>, Sasha Levin <sashal@kernel.org>,
	adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org
Subject: [PATCH AUTOSEL 6.1 14/17] ext4: fix uninitialized variable in ext4_inlinedir_to_tree
Date: Sun, 28 Jul 2024 11:47:24 -0400	[thread overview]
Message-ID: <20240728154805.2049226-14-sashal@kernel.org> (raw)
In-Reply-To: <20240728154805.2049226-1-sashal@kernel.org>

From: Xiaxi Shen <shenxiaxi26@gmail.com>

[ Upstream commit 8dc9c3da79c84b13fdb135e2fb0a149a8175bffe ]

Syzbot has found an uninit-value bug in ext4_inlinedir_to_tree

This error happens because ext4_inlinedir_to_tree does not
handle the case when ext4fs_dirhash returns an error

This can be avoided by checking the return value of ext4fs_dirhash
and propagating the error,
similar to how it's done with ext4_htree_store_dirent

Signed-off-by: Xiaxi Shen <shenxiaxi26@gmail.com>
Reported-and-tested-by: syzbot+eaba5abe296837a640c0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=eaba5abe296837a640c0
Link: https://patch.msgid.link/20240501033017.220000-1-shenxiaxi26@gmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/inline.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 3a91be1d9bbe7..ee9d2faa5218f 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1439,7 +1439,11 @@ int ext4_inlinedir_to_tree(struct file *dir_file,
 			hinfo->hash = EXT4_DIRENT_HASH(de);
 			hinfo->minor_hash = EXT4_DIRENT_MINOR_HASH(de);
 		} else {
-			ext4fs_dirhash(dir, de->name, de->name_len, hinfo);
+			err = ext4fs_dirhash(dir, de->name, de->name_len, hinfo);
+			if (err) {
+				ret = err;
+				goto out;
+			}
 		}
 		if ((hinfo->hash < start_hash) ||
 		    ((hinfo->hash == start_hash) &&
-- 
2.43.0


  parent reply	other threads:[~2024-07-28 15:49 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-07-28 15:47 [PATCH AUTOSEL 6.1 01/17] drm/amdgpu/pm: Fix the param type of set_power_profile_mode Sasha Levin
2024-07-28 15:47 ` [PATCH AUTOSEL 6.1 02/17] drm/amdgpu/pm: Fix the null pointer dereference for smu7 Sasha Levin
2024-07-28 15:47 ` [PATCH AUTOSEL 6.1 03/17] drm/amdgpu: Fix the null pointer dereference to ras_manager Sasha Levin
2024-07-28 15:47 ` [PATCH AUTOSEL 6.1 04/17] drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules Sasha Levin
2024-07-28 15:47 ` [PATCH AUTOSEL 6.1 05/17] drm/amdgpu: Add lock around VF RLCG interface Sasha Levin
2024-07-28 15:47 ` [PATCH AUTOSEL 6.1 06/17] drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr Sasha Levin
2024-07-28 15:47 ` [PATCH AUTOSEL 6.1 07/17] media: amphion: Remove lock in s_ctrl callback Sasha Levin
2024-07-28 15:47 ` [PATCH AUTOSEL 6.1 08/17] drm/amd/display: Add NULL check for 'afb' before dereferencing in amdgpu_dm_plane_handle_cursor_update Sasha Levin
2024-07-28 15:47 ` [PATCH AUTOSEL 6.1 09/17] drm/amd/display: Add null checker before passing variables Sasha Levin
2024-07-28 15:47 ` [PATCH AUTOSEL 6.1 10/17] media: uvcvideo: Ignore empty TS packets Sasha Levin
2024-07-28 15:47 ` [PATCH AUTOSEL 6.1 11/17] media: uvcvideo: Fix the bandwdith quirk on USB 3.x Sasha Levin
2024-07-28 15:47 ` [PATCH AUTOSEL 6.1 12/17] media: uvcvideo: Remove mappings form uvc_device_info Sasha Levin
2024-07-28 15:47 ` [PATCH AUTOSEL 6.1 13/17] media: xc2028: avoid use-after-free in load_firmware_cb() Sasha Levin
2024-07-28 15:47 ` Sasha Levin [this message]
2024-07-28 15:47 ` [PATCH AUTOSEL 6.1 15/17] jbd2: avoid memleak in jbd2_journal_write_metadata_buffer Sasha Levin
2024-07-28 15:47 ` [PATCH AUTOSEL 6.1 16/17] s390/sclp: Prevent release of buffer in I/O Sasha Levin
2024-07-28 15:47 ` [PATCH AUTOSEL 6.1 17/17] SUNRPC: Fix a race to wake a sync task Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240728154805.2049226-14-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=adilger.kernel@dilger.ca \
    --cc=linux-ext4@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=shenxiaxi26@gmail.com \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+eaba5abe296837a640c0@syzkaller.appspotmail.com \
    --cc=tytso@mit.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox