Forwarded: Re: [syzbot] KMSAN: uninit-value in hfs_bnode_read_u16

syzbot
2026-04-17T16:21:08Z

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] KMSAN: uninit-value in hfs_bnode_read_u16
Author: tristmd@gmail.com

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
>From 22a2a76dffd13b9a5bf3e41e13382714f3ffb459 Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Fri, 17 Apr 2026 16:15:17 +0000
Subject: [PATCH] hfsplus: initialize data in hfs_bnode_read_u16 and
hfs_bnode_read_u8
hfs_bnode_read_u16() and hfs_bnode_read_u8() declare local data
variables without initialization. If hfs_bnode_read() fails to
fully populate them (e.g., due to a corrupted node), the stale
stack values are returned, triggering KMSAN uninit-value.
Zero-initialize both variables.
Reported-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=217eb327242d08197efb
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/hfsplus/bnode.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c
index f8b5a8a..3579008 100644
--- a/fs/hfsplus/bnode.c
+++ b/fs/hfsplus/bnode.c
@@ -55,7 +55,7 @@ void hfs_bnode_read(struct hfs_bnode *node, void *buf, u32 off, u32 len)

u16 hfs_bnode_read_u16(struct hfs_bnode *node, u32 off)
{
- __be16 data;
+ __be16 data = 0;
/* TODO: optimize later... */
hfs_bnode_read(node, &data, off, 2);
return be16_to_cpu(data);
@@ -63,7 +63,7 @@ u16 hfs_bnode_read_u16(struct hfs_bnode *node, u32 off)

u8 hfs_bnode_read_u8(struct hfs_bnode *node, u32 off)
{
- u8 data;
+ u8 data = 0;
/* TODO: optimize later... */
hfs_bnode_read(node, &data, off, 1);
return data;
--
2.47.3