[PATCH] iommufd: Initialize batch->kind in batch_clear()

[PATCH] iommufd: Initialize batch->kind in batch_clear()

[Deepanshu Kartikey]

KMSAN reported an uninitialized value when batch_add_pfn_num() reads
batch->kind. This occurs because batch_clear() does not initialize
the kind field, leaving it with garbage data when a struct pfn_batch
is declared on the stack.

When batch_add_pfn_num() checks "if (batch->kind != kind)", it reads
this uninitialized value, triggering KMSAN warnings.

Initialize batch->kind to zero in batch_clear() to ensure the field
always starts in a known state.

Reported-by: syzbot+df28076a30d726933015@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=df28076a30d726933015
Fixes: f394576eb11db ("iommufd: PFN handling for iopt_pages")
Tested-by: syzbot+df28076a30d726933015@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/iommu/iommufd/pages.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c
index dbe51ecb9a20..f606148920fa 100644
--- a/drivers/iommu/iommufd/pages.c
+++ b/drivers/iommu/iommufd/pages.c
@@ -289,6 +289,7 @@ static void batch_clear(struct pfn_batch *batch)
 	batch->end = 0;
 	batch->pfns[0] = 0;
 	batch->npfns[0] = 0;
+	batch->kind = 0;
 }
 
 /*
-- 
2.43.0

RE: [PATCH] iommufd: Initialize batch->kind in batch_clear()

[Tian, Kevin]

> From: Deepanshu Kartikey <kartikey406@gmail.com>
> Sent: Saturday, January 24, 2026 9:22 PM
> 
> 
> KMSAN reported an uninitialized value when batch_add_pfn_num() reads
> batch->kind. This occurs because batch_clear() does not initialize
> the kind field, leaving it with garbage data when a struct pfn_batch
> is declared on the stack.
> 
> When batch_add_pfn_num() checks "if (batch->kind != kind)", it reads
> this uninitialized value, triggering KMSAN warnings.
> 
> Initialize batch->kind to zero in batch_clear() to ensure the field
> always starts in a known state.
> 
> Reported-by: syzbot+df28076a30d726933015@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=df28076a30d726933015
> Fixes: f394576eb11db ("iommufd: PFN handling for iopt_pages")
> Tested-by: syzbot+df28076a30d726933015@syzkaller.appspotmail.com
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>

Reviewed-by: Kevin Tian <kevin.tian@intel.com>

Re: [PATCH] iommufd: Initialize batch->kind in batch_clear()

[Jason Gunthorpe]

On Sat, Jan 24, 2026 at 06:52:14PM +0530, Deepanshu Kartikey wrote:
> 
> KMSAN reported an uninitialized value when batch_add_pfn_num() reads
> batch->kind. This occurs because batch_clear() does not initialize
> the kind field, leaving it with garbage data when a struct pfn_batch
> is declared on the stack.
> 
> When batch_add_pfn_num() checks "if (batch->kind != kind)", it reads
> this uninitialized value, triggering KMSAN warnings.
> 
> Initialize batch->kind to zero in batch_clear() to ensure the field
> always starts in a known state.
> 
> Reported-by: syzbot+df28076a30d726933015@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=df28076a30d726933015
> Fixes: f394576eb11db ("iommufd: PFN handling for iopt_pages")
> Tested-by: syzbot+df28076a30d726933015@syzkaller.appspotmail.com
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  drivers/iommu/iommufd/pages.c | 1 +
>  1 file changed, 1 insertion(+)

Applied to for-rc, thanks

Jason