Re: [syzbot] KMSAN: uninit-value in indx_insert_into_buffer

Re: [syzbot] KMSAN: uninit-value in indx_insert_into_buffer

[syzbot]

> #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

This crash does not have a reproducer. I cannot test it.

>>From 6a686b1fe4f68f59165fc7d2d02b621331c47ca4 Mon Sep 17 00:00:00 2001
> From: Tristan Madani <tristan@talencesecurity.com>
> Date: Fri, 17 Apr 2026 16:15:17 +0000
> Subject: [PATCH] ntfs3: zero-initialize trailing VBN slot in index entry
>  allocations
> indx_insert_into_buffer() and indx_delete_entry() allocate index
> entries with an extra sizeof(u64) for the VBN slot using kmalloc.
> The VBN slot is not explicitly initialized, leaving stale heap data
> that KMSAN detects as uninit-value.
> Replace kmalloc with kzalloc at both allocation sites to ensure
> the trailing VBN slot is zero-initialized.
> Reported-by: syzbot+2472d48b2d3b2a23a570@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=2472d48b2d3b2a23a570
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
>  fs/ntfs3/index.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
> index 97f06c2..a1d8c05 100644
> --- a/fs/ntfs3/index.c
> +++ b/fs/ntfs3/index.c
> @@ -1838,7 +1838,7 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
>  		return -EINVAL;
>  
>  	sp_size = le16_to_cpu(sp->size);
> -	up_e = kmalloc(sp_size + sizeof(u64), GFP_NOFS);
> +	up_e = kzalloc(sp_size + sizeof(u64), GFP_NOFS);
>  	if (!up_e)
>  		return -ENOMEM;
>  	memcpy(up_e, sp, sp_size);
> @@ -2226,7 +2226,7 @@ static int indx_get_entry_to_replace(struct ntfs_index *indx,
>  		goto out;
>  	}
>  	/* Copy the candidate entry into the replacement entry buffer. */
> -	re = kmalloc(le16_to_cpu(te->size) + sizeof(u64), GFP_NOFS);
> +	re = kzalloc(le16_to_cpu(te->size) + sizeof(u64), GFP_NOFS);
>  	if (!re) {
>  		err = -ENOMEM;
>  		goto out;
> -- 
> 2.47.3