Re: [PATCH v7 19/31] ext4: add block mapping tracepoints for iomap buffered I/O path

[Zhang Yi <yizhang089@gmail.com>]

On 10/9/2026 7:03 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] ext4: information leak of uninitialized map->m_pblk in trace_ext4_iomap_buffered_write_begin
> --
> 
> commit 63eb0e998a7a12aca902166168b720bc244eba71
> Author: Zhang Yi <yi.zhang@huawei.com>
> 
> ext4: add block mapping tracepoints for iomap buffered I/O path
> 
> This commit adds tracepoints for iomap buffered read, write, partial block
> zeroing, and writeback operations. This helps debug the iomap buffered I/O
> path.
> 
>> diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
>> index 35767c3a7ffff..1c7083a9293e9 100644
>> --- a/fs/ext4/inode.c
>> +++ b/fs/ext4/inode.c
> [ ... ]
>> @@ -4052,6 +4054,8 @@ static int ext4_iomap_buffered_do_write_begin(struct inode *inode,
>>   	if (ret < 0)
>>   		return ret;
>>   
>> +	trace_ext4_iomap_buffered_write_begin(inode, &map, offset, length,
>> +					      flags);
> 
> [Severity: Medium]
> Could this tracepoint leak uninitialized stack memory?
> 
> In ext4_iomap_buffered_do_write_begin(), the local variable
> struct ext4_map_blocks map is declared on the stack without
> zero-initialization.
> 
> When ext4_iomap_map_blocks() is called with EXT4_GET_BLOCKS_DELALLOC_RESERVE
> (when delalloc is true), the mapping resolution routes to ext4_da_map_blocks().
> If this hits a cached delayed extent or inserts a new one, it returns 0
> without initializing map.m_pblk.
> 

This is real, it looks like we should also initialize map->m_pblk
to 0 in ext4_da_map_blocks().

Thanks,
Yi.

>>   	ext4_set_iomap(inode, iomap, &map, offset, length, flags);
>>   	return 0;
>>   }
> 
>> diff --git a/include/trace/events/ext4.h b/include/trace/events/ext4.h
>> index 7028a28316fa3..bcf80f518e61d 100644
>> --- a/include/trace/events/ext4.h
>> +++ b/include/trace/events/ext4.h
> [ ... ]
>> +	TP_fast_assign(
>> +		__entry->dev		= inode->i_sb->s_dev;
>> +		__entry->ino		= inode->i_ino;
>> +		__entry->m_lblk		= map->m_lblk;
>> +		__entry->pblk		= map->m_pblk;
> 
> [Severity: Medium]
> Does this assignment unconditionally copy the potentially uninitialized
> map->m_pblk to the trace ring buffer?
> 
> Since ext4_fsblk_t is 8 bytes, this would leak 8 bytes of uninitialized
> kernel stack memory into the trace buffer on delayed allocation paths,
> which is accessible to users with tracing privileges.
>