From: syzbot <syzbot+7add5c56bc2a14145d20@syzkaller.appspotmail.com>
To: davem@davemloft.net, ebiggers@kernel.org,
herbert@gondor.apana.org.au, jaegeuk@kernel.org,
linux-crypto@vger.kernel.org, linux-ext4@vger.kernel.org,
linux-fscrypt@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com, tytso@mit.edu
Subject: Re: [syzbot] [ext4] [fscrypt] KMSAN: uninit-value in fscrypt_crypt_data_unit
Date: Tue, 09 Dec 2025 03:08:17 -0800 [thread overview]
Message-ID: <69380321.050a0220.1ff09b.0000.GAE@google.com> (raw)
In-Reply-To: <68ee633c.050a0220.1186a4.002a.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: a110f942672c Merge tag 'pinctrl-v6.19-1' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17495992580000
kernel config: https://syzkaller.appspot.com/x/.config?x=10d58c94af5f9772
dashboard link: https://syzkaller.appspot.com/bug?extid=7add5c56bc2a14145d20
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1122aec2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14012a1a580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/905b868d0b1d/disk-a110f942.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/aa7281cd9720/vmlinux-a110f942.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1420de8a7da2/bzImage-a110f942.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/1e40f788aa89/mount_0.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=1622aec2580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7add5c56bc2a14145d20@syzkaller.appspotmail.com
=====================================================
BUG: KMSAN: uninit-value in subshift lib/crypto/aes.c:150 [inline]
BUG: KMSAN: uninit-value in aes_encrypt+0x1239/0x1960 lib/crypto/aes.c:283
subshift lib/crypto/aes.c:150 [inline]
aes_encrypt+0x1239/0x1960 lib/crypto/aes.c:283
aesti_encrypt+0x7d/0xf0 crypto/aes_ti.c:31
crypto_ecb_crypt crypto/ecb.c:23 [inline]
crypto_ecb_encrypt2+0x142/0x300 crypto/ecb.c:40
crypto_lskcipher_crypt_sg+0x3ac/0x930 crypto/lskcipher.c:188
crypto_lskcipher_encrypt_sg+0x8b/0xc0 crypto/lskcipher.c:207
crypto_skcipher_encrypt+0x111/0x1e0 crypto/skcipher.c:443
xts_encrypt+0x2e1/0x570 crypto/xts.c:269
crypto_skcipher_encrypt+0x18a/0x1e0 crypto/skcipher.c:444
fscrypt_crypt_data_unit+0x38e/0x590 fs/crypto/crypto.c:139
fscrypt_encrypt_pagecache_blocks+0x430/0x900 fs/crypto/crypto.c:197
ext4_bio_write_folio+0x1383/0x30d0 fs/ext4/page-io.c:552
mpage_submit_folio+0x399/0x3d0 fs/ext4/inode.c:2087
mpage_process_page_bufs+0xaef/0xf50 fs/ext4/inode.c:2198
mpage_prepare_extent_to_map+0x175d/0x2660 fs/ext4/inode.c:2737
ext4_do_writepages+0x1aa1/0x77a0 fs/ext4/inode.c:2930
ext4_writepages+0x338/0x870 fs/ext4/inode.c:3026
do_writepages+0x3f2/0x860 mm/page-writeback.c:2598
__writeback_single_inode+0x101/0x1190 fs/fs-writeback.c:1737
writeback_sb_inodes+0xb2d/0x1f10 fs/fs-writeback.c:2030
wb_writeback+0x4ce/0xc00 fs/fs-writeback.c:2216
wb_do_writeback fs/fs-writeback.c:2363 [inline]
wb_workfn+0x397/0x1910 fs/fs-writeback.c:2403
process_one_work kernel/workqueue.c:3257 [inline]
process_scheduled_works+0xb91/0x1d80 kernel/workqueue.c:3340
worker_thread+0xedf/0x1590 kernel/workqueue.c:3421
kthread+0xd5c/0xf00 kernel/kthread.c:463
ret_from_fork+0x208/0x710 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
Uninit was stored to memory at:
le128_xor include/crypto/b128ops.h:69 [inline]
xts_xor_tweak+0x566/0xbd0 crypto/xts.c:123
xts_xor_tweak_pre crypto/xts.c:135 [inline]
xts_encrypt+0x278/0x570 crypto/xts.c:268
crypto_skcipher_encrypt+0x18a/0x1e0 crypto/skcipher.c:444
fscrypt_crypt_data_unit+0x38e/0x590 fs/crypto/crypto.c:139
fscrypt_encrypt_pagecache_blocks+0x430/0x900 fs/crypto/crypto.c:197
ext4_bio_write_folio+0x1383/0x30d0 fs/ext4/page-io.c:552
mpage_submit_folio+0x399/0x3d0 fs/ext4/inode.c:2087
mpage_process_page_bufs+0xaef/0xf50 fs/ext4/inode.c:2198
mpage_prepare_extent_to_map+0x175d/0x2660 fs/ext4/inode.c:2737
ext4_do_writepages+0x1aa1/0x77a0 fs/ext4/inode.c:2930
ext4_writepages+0x338/0x870 fs/ext4/inode.c:3026
do_writepages+0x3f2/0x860 mm/page-writeback.c:2598
__writeback_single_inode+0x101/0x1190 fs/fs-writeback.c:1737
writeback_sb_inodes+0xb2d/0x1f10 fs/fs-writeback.c:2030
wb_writeback+0x4ce/0xc00 fs/fs-writeback.c:2216
wb_do_writeback fs/fs-writeback.c:2363 [inline]
wb_workfn+0x397/0x1910 fs/fs-writeback.c:2403
process_one_work kernel/workqueue.c:3257 [inline]
process_scheduled_works+0xb91/0x1d80 kernel/workqueue.c:3340
worker_thread+0xedf/0x1590 kernel/workqueue.c:3421
kthread+0xd5c/0xf00 kernel/kthread.c:463
ret_from_fork+0x208/0x710 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
Uninit was created at:
__alloc_frozen_pages_noprof+0x421/0xab0 mm/page_alloc.c:5233
alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2486
alloc_frozen_pages_noprof mm/mempolicy.c:2557 [inline]
alloc_pages_noprof mm/mempolicy.c:2577 [inline]
folio_alloc_noprof+0x109/0x360 mm/mempolicy.c:2587
filemap_alloc_folio_noprof+0xda/0x480 mm/filemap.c:1013
__filemap_get_folio_mpol+0xb4f/0x1960 mm/filemap.c:2006
__filemap_get_folio include/linux/pagemap.h:763 [inline]
write_begin_get_folio include/linux/pagemap.h:789 [inline]
ext4_write_begin+0x6d3/0x2d70 fs/ext4/inode.c:1323
generic_perform_write+0x365/0x1050 mm/filemap.c:4314
ext4_buffered_write_iter+0x61a/0xce0 fs/ext4/file.c:299
ext4_file_write_iter+0x2a2/0x3d90 fs/ext4/file.c:-1
aio_write+0x704/0xa10 fs/aio.c:1634
__io_submit_one fs/aio.c:-1 [inline]
io_submit_one+0x260e/0x3450 fs/aio.c:2053
__do_sys_io_submit fs/aio.c:2112 [inline]
__se_sys_io_submit+0x27c/0x6a0 fs/aio.c:2082
__x64_sys_io_submit+0x97/0xe0 fs/aio.c:2082
x64_sys_call+0x3b5f/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:210
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
CPU: 1 UID: 0 PID: 1143 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT(none)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: writeback wb_workfn (flush-7:0)
=====================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2025-12-09 11:08 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-10-14 14:50 [syzbot] [crypto?] KMSAN: uninit-value in fscrypt_crypt_data_unit syzbot
2025-10-14 14:58 ` Aleksandr Nogikh
2025-12-09 11:08 ` syzbot [this message]
2025-12-10 2:22 ` [syzbot] [ext4] [fscrypt] " Eric Biggers
2025-12-11 18:52 ` Darrick J. Wong
2025-12-11 19:45 ` Eric Biggers
2025-12-11 22:19 ` Darrick J. Wong
2025-12-12 5:16 ` Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69380321.050a0220.1ff09b.0000.GAE@google.com \
--to=syzbot+7add5c56bc2a14145d20@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=ebiggers@kernel.org \
--cc=herbert@gondor.apana.org.au \
--cc=jaegeuk@kernel.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-fscrypt@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.