Re: [syzbot] [PATCH] fs/ntfs3: Fix KMSAN warning in longest_match_std()

[syzbot <syzbot+08d8956768c96a2c52cf@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] fs/ntfs3: Fix KMSAN warning in longest_match_std()
Author: gauthamgujjula@gmail.com

#syz test

Syzkaller reported uninitialized memory in longest_match_std(),
originating from ntfs_compress_write(). In the case where a frame's
pages are not up to date, but that frame is not read in due to the
overlapping bounds of the write, the end of the frame will remain
uninitialized if the user data copied in is not frame-aligned.

To init the memory without invoking ni_read_frame() in cases where the
data will be overwritten anyways, add an additional clause to zero out
the section of the frame from the end of the user's data to the end of
the frame.

Reported-by: syzbot+08d8956768c96a2c52cf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=08d8956768c96a2c52cf
Signed-off-by: Gautham Gujjula <gauthamgujjula@gmail.com>
---
 fs/ntfs3/file.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c
index fad68ff0b6ed..6fc4f960f4d9 100644
--- a/fs/ntfs3/file.c
+++ b/fs/ntfs3/file.c
@@ -1122,6 +1122,13 @@ static ssize_t ntfs_compress_write(struct kiocb *iocb, struct iov_iter *from)
 					}
 					goto out;
 				}
+			} else if (to & (frame_size - 1)) {
+				for (ip = to >> PAGE_SHIFT, off = offset_in_page(to);
+				     ip < pages_per_frame;
+				     ip++, off = 0) {
+					zero_user_segment(pages[ip], off, PAGE_SIZE);
+					flush_dcache_page(pages[ip]);
+				}
 			}
 		}
 
-- 
2.45.3