KMSAN: uninit-value in hfsplus_strcasecmp (2)

Status: fixed on 2026/05/21 07:50
Subsystems: hfs
[Documentation on labels]
Reported-by: syzbot+d80abb5b890d39261e72@syzkaller.appspotmail.com
Fix commit: b6b592275aef hfsplus: fix uninit-value by validating catalog record size
First crash: 198d, last: 113d
▶ ▼ Discussions (7)
Title Replies (including bot) Last reply
[PATCH v6] hfsplus: fix uninit-value by validating catalog record size 4 (4) 2026/03/19 02:52
[PATCH v5] hfsplus: fix uninit-value by validating catalog record size 6 (6) 2026/03/07 01:05
[syzbot] [hfs?] KMSAN: uninit-value in hfsplus_strcasecmp (2) 0 (11) 2026/03/07 00:25
[PATCH v4] hfsplus: fix uninit-value by validating catalog record size 6 (6) 2026/02/21 04:44
[PATCH v3] hfsplus: fix uninit-value by validating catalog record size 2 (2) 2026/02/13 00:49
[PATCH] hfsplus: fix uninit-value in hfsplus_strcasecmp 12 (12) 2026/01/29 20:56
[PATCH v2] hfsplus: fix uninit-value in hfsplus_strcasecmp 2 (2) 2026/01/21 20:14
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: uninit-value in hfsplus_strcasecmp hfs 17 syz, C 117 308d 878d 0/29 auto-obsoleted due to no activity on 2025/12/06 04:54
▶ ▼ Last patch testing requests (15)
Created Duration User Patch Repo Result
2026/04/10 11:25 25m retest repro upstream report log
2026/04/10 11:25 24m retest repro upstream report log
2026/04/10 11:17 19m retest repro upstream report log
2026/03/07 00:25 28m kartikey406@gmail.com patch upstream OK log
2026/02/21 04:59 31m kartikey406@gmail.com patch upstream OK log
2026/02/13 04:50 3h54m kartikey406@gmail.com patch upstream OK log
2026/02/11 15:05 31m kartikey406@gmail.com patch upstream OK log
2026/01/30 10:08 1h11m retest repro upstream report log
2026/01/30 10:08 50m retest repro upstream report log
2026/01/22 23:34 31m kartikey406@gmail.com patch upstream report log
2026/01/22 08:42 3m kartikey406@gmail.com patch upstream error
2026/01/21 05:50 11m kartikey406@gmail.com patch upstream error
2026/01/21 05:24 9m kartikey406@gmail.com patch upstream error
2026/01/21 05:15 1m kartikey406@gmail.com patch upstream error
2026/01/20 04:33 30m kartikey406@gmail.com patch upstream OK log

Sample crash report:
loop0: detected capacity change from 0 to 1024
=====================================================
BUG: KMSAN: uninit-value in case_fold fs/hfsplus/unicode.c:26 [inline]
BUG: KMSAN: uninit-value in hfsplus_strcasecmp+0x63a/0x980 fs/hfsplus/unicode.c:67
 case_fold fs/hfsplus/unicode.c:26 [inline]
 hfsplus_strcasecmp+0x63a/0x980 fs/hfsplus/unicode.c:67
 hfsplus_cat_case_cmp_key+0xb9/0x190 fs/hfsplus/catalog.c:26
 hfs_find_rec_by_key+0xae/0x240 fs/hfsplus/bfind.c:89
 __hfsplus_brec_find+0x274/0x840 fs/hfsplus/bfind.c:124
 hfsplus_brec_find+0x4ec/0xa10 fs/hfsplus/bfind.c:190
 hfsplus_find_cat+0x3b0/0x4f0 fs/hfsplus/catalog.c:220
 hfsplus_iget+0x815/0xc30 fs/hfsplus/super.c:96
 hfsplus_fill_super+0x1550/0x2580 fs/hfsplus/super.c:548
 get_tree_bdev_flags+0x6e6/0x920 fs/super.c:1691
 get_tree_bdev+0x38/0x50 fs/super.c:1714
 hfsplus_get_tree+0x35/0x40 fs/hfsplus/super.c:680
 vfs_get_tree+0xb3/0x5c0 fs/super.c:1751
 fc_mount fs/namespace.c:1199 [inline]
 do_new_mount_fc fs/namespace.c:3636 [inline]
 do_new_mount+0x879/0x1700 fs/namespace.c:3712
 path_mount+0x749/0x1fb0 fs/namespace.c:4022
 do_mount fs/namespace.c:4035 [inline]
 __do_sys_mount fs/namespace.c:4224 [inline]
 __se_sys_mount+0x6f7/0x7e0 fs/namespace.c:4201
 __x64_sys_mount+0xe4/0x150 fs/namespace.c:4201
 x64_sys_call+0x38cb/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 hfsplus_cat_build_key_uni fs/hfsplus/catalog.c:77 [inline]
 hfsplus_find_cat+0x356/0x4f0 fs/hfsplus/catalog.c:217
 hfsplus_iget+0x815/0xc30 fs/hfsplus/super.c:96
 hfsplus_fill_super+0x1550/0x2580 fs/hfsplus/super.c:548
 get_tree_bdev_flags+0x6e6/0x920 fs/super.c:1691
 get_tree_bdev+0x38/0x50 fs/super.c:1714
 hfsplus_get_tree+0x35/0x40 fs/hfsplus/super.c:680
 vfs_get_tree+0xb3/0x5c0 fs/super.c:1751
 fc_mount fs/namespace.c:1199 [inline]
 do_new_mount_fc fs/namespace.c:3636 [inline]
 do_new_mount+0x879/0x1700 fs/namespace.c:3712
 path_mount+0x749/0x1fb0 fs/namespace.c:4022
 do_mount fs/namespace.c:4035 [inline]
 __do_sys_mount fs/namespace.c:4224 [inline]
 __se_sys_mount+0x6f7/0x7e0 fs/namespace.c:4201
 __x64_sys_mount+0xe4/0x150 fs/namespace.c:4201
 x64_sys_call+0x38cb/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable tmp created at:
 hfsplus_find_cat+0x43/0x4f0 fs/hfsplus/catalog.c:197
 hfsplus_iget+0x815/0xc30 fs/hfsplus/super.c:96

CPU: 1 UID: 0 PID: 6037 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
=====================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/16 09:54 upstream 603c05a1639f d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kmsan-gce-root KMSAN: uninit-value in hfsplus_strcasecmp
2026/01/16 07:29 upstream 603c05a1639f d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kmsan-gce-root KMSAN: uninit-value in hfsplus_strcasecmp
2026/01/15 21:23 upstream 944aacb68baf d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in hfsplus_strcasecmp
* Struck through repros no longer work on HEAD.