Forwarded: [PATCH] hfsplus: add debug printk to show uninitialized values in case_fold

[syzbot <syzbot+d80abb5b890d39261e72@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] hfsplus: add debug printk to show uninitialized values in case_fold
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


This is a debug patch to demonstrate the uninit-value bug reported by
syzbot. Added printk in case_fold() to show what uninitialized values
are being read from the unicode array and used as array indices.

This patch intentionally does NOT include the fix (no initialization of
tmp variable) to demonstrate the bug behavior.

Link: https://syzkaller.appspot.com/bug?extid=d80abb5b890d39261e72
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 fs/hfsplus/unicode.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/fs/hfsplus/unicode.c b/fs/hfsplus/unicode.c
index d3a142f4518b..418806c27943 100644
--- a/fs/hfsplus/unicode.c
+++ b/fs/hfsplus/unicode.c
@@ -11,7 +11,6 @@
 
 #include <linux/types.h>
 #include <linux/nls.h>
-
 #include <kunit/visibility.h>
 
 #include "hfsplus_fs.h"
@@ -22,12 +21,18 @@
 static inline u16 case_fold(u16 c)
 {
 	u16 tmp;
-
+	pr_alert("CASE_FOLD: Input c=0x%04x, c>>8=0x%02x (this is array index!)\n", c, c >> 8);
 	tmp = hfsplus_case_fold_table[c >> 8];
-	if (tmp)
+	pr_alert("CASE_FOLD: table[0x%02x]=0x%04x\n", c >> 8, tmp);
+
+	if (tmp) {
+		pr_alert("CASE_FOLD: Second lookup: table[0x%04x + 0x%02x]\n",tmp, c & 0xff);
 		tmp = hfsplus_case_fold_table[tmp + (c & 0xff)];
-	else
+	} else {
 		tmp = c;
+	}
+	pr_alert("CASE_FOLD: Final result=0x%04x\n", tmp);
+
 	return tmp;
 }
 
-- 
2.43.0