Forwarded: [PATCH] ocfs2: zero-initialize quota recovery bitmap allocation

[syzbot <syzbot+7ea0b96c4ddb49fd1a70@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] ocfs2: zero-initialize quota recovery bitmap allocation
Author: tristmd@gmail.com

From: Tristan Madani <tristan@talencesecurity.com>

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


ocfs2_add_recovery_chunk() allocates a full block-sized buffer for the
recovery bitmap with kmalloc(), but only copies the meaningful portion
of the on-disk bitmap:

    rc->rc_bitmap = kmalloc(sb->s_blocksize, GFP_NOFS);
    memcpy(rc->rc_bitmap, dchunk->dqc_bitmap,
           (ol_chunk_entries(sb) + 7) >> 3);

The remaining bytes beyond the copied region are left uninitialized.
When ocfs2_recover_local_quota_file() later passes this bitmap to
find_next_bit(), it reads the uninitialized tail bytes, which KMSAN
flags as a use of uninitialized memory.

Fix this by using kzalloc() to ensure the entire buffer is zeroed,
so that find_next_bit() sees zero bits (no recovery needed) for
entries beyond the valid bitmap portion.

Reported-by: syzbot+7ea0b96c4ddb49fd1a70@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7ea0b96c4ddb49fd1a70
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/ocfs2/quota_local.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index XXXXXXX..XXXXXXX 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -305,7 +305,7 @@ static int ocfs2_add_recovery_chunk(struct super_block *sb,
 	if (!rc)
 		return -ENOMEM;
 	rc->rc_chunk = chunk;
-	rc->rc_bitmap = kmalloc(sb->s_blocksize, GFP_NOFS);
+	rc->rc_bitmap = kzalloc(sb->s_blocksize, GFP_NOFS);
 	if (!rc->rc_bitmap) {
 		kfree(rc);
 		return -ENOMEM;
--
2.43.0