Patch "afs: Fix uninit var in afs_alloc_anon_key()" has been added to the 6.12-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    afs: Fix uninit var in afs_alloc_anon_key()

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     afs-fix-uninit-var-in-afs_alloc_anon_key.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From 19eef1d98eeda3745df35839190b7d4a4adea656 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells at redhat.com>
Date: Sat, 29 Nov 2025 00:40:11 +0000
Subject: afs: Fix uninit var in afs_alloc_anon_key()

From: David Howells <dhowells at redhat.com>

commit 19eef1d98eeda3745df35839190b7d4a4adea656 upstream.

Fix an uninitialised variable (key) in afs_alloc_anon_key() by setting it
to cell->anonymous_key.  Without this change, the error check may return a
false failure with a bad error number.

Most of the time this is unlikely to happen because the first encounter
with afs_alloc_anon_key() will usually be from (auto)mount, for which all
subsequent operations must wait - apart from other (auto)mounts.  Once the
call->anonymous_key is allocated, all further calls to afs_request_key()
will skip the call to afs_alloc_anon_key() for that cell.

Fixes: d27c71257825 ("afs: Fix delayed allocation of a cell's anonymous key")
Reported-by: Paulo Alcantra <pc at manguebit.org>
Signed-off-by: David Howells <dhowells at redhat.com>
Reviewed-by: Paulo Alcantara <pc at manguebit.org>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: syzbot+41c68824eefb67cdf00c at syzkaller.appspotmail.com
cc: linux-afs at lists.infradead.org
cc: linux-fsdevel at vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 fs/afs/security.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/afs/security.c
+++ b/fs/afs/security.c
@@ -26,7 +26,8 @@ static int afs_alloc_anon_key(struct afs
 	struct key *key;
 
 	mutex_lock(&afs_key_lock);
-	if (!cell->anonymous_key) {
+	key = cell->anonymous_key;
+	if (!key) {
 		key = rxrpc_get_null_key(cell->key_desc);
 		if (!IS_ERR(key))
 			cell->anonymous_key = key;


Patches currently in stable-queue which might be from dhowells at redhat.com are

queue-6.12/rxrpc-fix-notification-vs-call-release-vs-recvmsg.patch
queue-6.12/rxrpc-use-irq-disabling-spinlocks-between-app-and-i-o-thread.patch
queue-6.12/afs-fix-delayed-allocation-of-a-cell-s-anonymous-key.patch
queue-6.12/afs-simplify-cell-record-handling.patch
queue-6.12/afs-fix-lack-of-locking-around-modifications-of-net-cells_dyn_ino.patch
queue-6.12/rxrpc-pull-out-certain-app-callback-funcs-into-an-ops-table.patch
queue-6.12/rxrpc-fix-cpu-time-starvation-in-i-o-thread.patch
queue-6.12/afs-fix-dynamic-lookup-to-fail-on-cell-lookup-failure.patch
queue-6.12/afs-handle-cb.initcallbackstate3-requests-without-a-server-record.patch
queue-6.12/rxrpc-disable-irq-not-bh-to-take-the-lock-for-attend_link.patch
queue-6.12/rxrpc-fix-socket-notification-race.patch
queue-6.12/afs-fix-afs_server-ref-accounting.patch
queue-6.12/afs-fix-uninit-var-in-afs_alloc_anon_key.patch
queue-6.12/rxrpc-allow-the-app-to-store-private-data-on-peer-structs.patch
queue-6.12/rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch
queue-6.12/afs-use-the-per-peer-app-data-provided-by-rxrpc.patch
queue-6.12/afs-improve-server-refcount-active-count-tracing.patch
queue-6.12/afs-drop-the-net-parameter-from-afs_unuse_cell.patch
queue-6.12/afs-make-afs_lookup_cell-take-a-trace-note.patch
queue-6.12/rxrpc-don-t-need-barrier-for-tx_bottom-and-acks_hard_ack.patch
queue-6.12/rxrpc-fix-locking-issues-with-the-peer-record-hash.patch
queue-6.12/afs-set-vllist-to-null-if-addr-parsing-fails.patch