CVE-2024-49900

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> jfs: Fix uninit-value access of new_ea in ea_buffer<br /> <br /> syzbot reports that lzo1x_1_do_compress is using uninit-value:<br /> <br /> =====================================================<br /> BUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178<br /> <br /> ...<br /> <br /> Uninit was stored to memory at:<br /> ea_put fs/jfs/xattr.c:639 [inline]<br /> <br /> ...<br /> <br /> Local variable ea_buf created at:<br /> __jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662<br /> __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934<br /> <br /> =====================================================<br /> <br /> The reason is ea_buf-&gt;new_ea is not initialized properly.<br /> <br /> Fix this by using memset to empty its content at the beginning<br /> in ea_get().