From: Andrew Morton <akpm@linux-foundation.org>
To: syzbot <syzbot+8ce7f8308d91e6b8bbe2@syzkaller.appspotmail.com>
Cc: glider@google.com, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
syzkaller-bugs@googlegroups.com, willy@infradead.org,
Nicolas Pitre <nico@fluxnic.net>
Subject: Re: [syzbot] [fs?] [mm?] KMSAN: uninit-value in ondemand_readahead
Date: Sun, 26 Feb 2023 12:38:14 -0800 [thread overview]
Message-ID: <20230226123814.1d9afb8c3de438155593c378@linux-foundation.org> (raw)
In-Reply-To: <0000000000008f74e905f56df987@google.com>
On Fri, 24 Feb 2023 00:32:50 -0800 syzbot <syzbot+8ce7f8308d91e6b8bbe2@syzkaller.appspotmail.com> wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 97e36f4aa06f Revert "sched/core: kmsan: do not instrument ..
> git tree: https://github.com/google/kmsan.git master
> console output: https://syzkaller.appspot.com/x/log.txt?x=10e46944c80000
> kernel config: https://syzkaller.appspot.com/x/.config?x=46c642641b9ef616
> dashboard link: https://syzkaller.appspot.com/bug?extid=8ce7f8308d91e6b8bbe2
> compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> userspace arch: i386
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=143b8650c80000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15a22f2cc80000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/9931a9627dc6/disk-97e36f4a.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/1aafdb2fd6dc/vmlinux-97e36f4a.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/90df5872c7ff/bzImage-97e36f4a.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/ea75a01297dd/mount_0.gz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+8ce7f8308d91e6b8bbe2@syzkaller.appspotmail.com
>
> loop0: detected capacity change from 0 to 16
> =====================================================
> BUG: KMSAN: uninit-value in ondemand_readahead+0xddf/0x1720 mm/readahead.c:596
> ondemand_readahead+0xddf/0x1720 mm/readahead.c:596
> page_cache_sync_ra+0x72b/0x760 mm/readahead.c:709
> page_cache_sync_readahead include/linux/pagemap.h:1210 [inline]
> cramfs_blkdev_read fs/cramfs/inode.c:217 [inline]
> cramfs_read+0x611/0x1280 fs/cramfs/inode.c:278
> cramfs_lookup+0x1b8/0x870 fs/cramfs/inode.c:767
Thanks.
file_ra_state_init() says "Assumes that the caller has memset *ra to
zero". This should fix:
From: Andrew Morton <akpm@linux-foundation.org>
Subject: fs/cramfs/inode.c: initialize file_ra_state
Date: Sun Feb 26 12:31:11 PM PST 2023
file_ra_state_init() assumes that the file_ra_state has been zeroed out.
Fixes a KMSAN used-unintialized issue (at least).
Fixes: cf948cbc35e80 ("cramfs: read_mapping_page() is synchronous")
Reported-by: syzbot <syzbot+8ce7f8308d91e6b8bbe2@syzkaller.appspotmail.com>
Link: https://lkml.kernel.org/r/0000000000008f74e905f56df987@google.com
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Nicolas Pitre <nico@fluxnic.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
--- a/fs/cramfs/inode.c~a
+++ b/fs/cramfs/inode.c
@@ -183,7 +183,7 @@ static void *cramfs_blkdev_read(struct super_block *sb, unsigned int offset,
unsigned int len)
{
struct address_space *mapping = sb->s_bdev->bd_inode->i_mapping;
- struct file_ra_state ra;
+ struct file_ra_state ra = {};
struct page *pages[BLKS_PER_BUF];
unsigned i, blocknr, buffer;
unsigned long devsize;
_
prev parent reply other threads:[~2023-02-26 20:38 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-20 10:26 [syzbot] KMSAN: uninit-value in ondemand_readahead syzbot
2023-02-24 8:32 ` [syzbot] [fs?] [mm?] " syzbot
2023-02-26 20:38 ` Andrew Morton [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230226123814.1d9afb8c3de438155593c378@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=glider@google.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=nico@fluxnic.net \
--cc=syzbot+8ce7f8308d91e6b8bbe2@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).