[syzbot] [gfs2?] KMSAN: uninit-value in inode_go_dump (5)

[syzbot] [gfs2?] KMSAN: uninit-value in inode_go_dump (5)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    ad46e8f95e93 Merge tag 'pm-6.12-rc1-2' of git://git.kernel..
git tree:       upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=17908d9f980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=85d8f50d88ddf2a
dashboard link: https://syzkaller.appspot.com/bug?extid=aa0730b0a42646eb1359
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10508d9f980000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=103a9e80580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/265feec46ffa/disk-ad46e8f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d0f41ea693d3/vmlinux-ad46e8f9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/45082d33d192/bzImage-ad46e8f9.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/fcd037c3d108/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+aa0730b0a42646eb1359@syzkaller.appspotmail.com

gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz"
gfs2: fsid=syz:syz: Now mounting FS (format 1801)...
gfs2: fsid=syz:syz.0: fatal: filesystem consistency error - inode = 1 19, function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 399
gfs2: fsid=syz:syz.0: G:  s:SH n:2/13 f:aqobnN t:SH d:EX/0 a:0 v:0 r:2 m:20 p:1
gfs2: fsid=syz:syz.0:  H: s:SH f:eEcH e:0 p:0 [(none)] init_inodes+0x125/0x510 fs/gfs2/ops_fstype.c:864
=====================================================
BUG: KMSAN: uninit-value in inode_go_dump+0x475/0x4b0 fs/gfs2/glops.c:541
 inode_go_dump+0x475/0x4b0 fs/gfs2/glops.c:541
 gfs2_dump_glock+0x221c/0x2340 fs/gfs2/glock.c:2436
 gfs2_consist_inode_i+0x19f/0x230 fs/gfs2/util.c:457
 gfs2_inode_refresh+0x12d7/0x1590 fs/gfs2/glops.c:482
 inode_go_instantiate+0x6e/0xc0 fs/gfs2/glops.c:501
 gfs2_instantiate+0x272/0x4c0 fs/gfs2/glock.c:468
 gfs2_glock_holder_ready fs/gfs2/glock.c:1345 [inline]
 gfs2_glock_wait+0x2a4/0x3e0 fs/gfs2/glock.c:1365
 gfs2_glock_nq+0x2777/0x34b0 fs/gfs2/glock.c:1622
 gfs2_glock_nq_init fs/gfs2/glock.h:238 [inline]
 init_journal+0x12cc/0x3a40 fs/gfs2/ops_fstype.c:770
 init_inodes+0x125/0x510 fs/gfs2/ops_fstype.c:864
 gfs2_fill_super+0x3a8b/0x45a0 fs/gfs2/ops_fstype.c:1249
 get_tree_bdev+0x684/0x890 fs/super.c:1635
 gfs2_get_tree+0x5c/0x340 fs/gfs2/ops_fstype.c:1330
 vfs_get_tree+0xb1/0x5a0 fs/super.c:1800
 do_new_mount+0x71f/0x15e0 fs/namespace.c:3507
 path_mount+0x742/0x1f10 fs/namespace.c:3834
 do_mount fs/namespace.c:3847 [inline]
 __do_sys_mount fs/namespace.c:4055 [inline]
 __se_sys_mount+0x722/0x810 fs/namespace.c:4032
 __x64_sys_mount+0xe4/0x150 fs/namespace.c:4032
 x64_sys_call+0x255a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 __alloc_pages_noprof+0x9d6/0xe70 mm/page_alloc.c:4756
 alloc_pages_mpol_noprof+0x299/0x990 mm/mempolicy.c:2265
 alloc_pages_noprof+0x1bf/0x1e0 mm/mempolicy.c:2345
 alloc_slab_page mm/slub.c:2413 [inline]
 allocate_slab+0x33a/0x1250 mm/slub.c:2579
 new_slab mm/slub.c:2632 [inline]
 ___slab_alloc+0x12ef/0x35e0 mm/slub.c:3819
 __slab_alloc mm/slub.c:3909 [inline]
 __slab_alloc_node mm/slub.c:3962 [inline]
 slab_alloc_node mm/slub.c:4123 [inline]
 kmem_cache_alloc_lru_noprof+0x584/0xb30 mm/slub.c:4154
 gfs2_alloc_inode+0x66/0x210 fs/gfs2/super.c:1536
 alloc_inode+0x86/0x460 fs/inode.c:263
 iget5_locked+0xa9/0x1d0 fs/inode.c:1333
 gfs2_inode_lookup+0xbe/0x1440 fs/gfs2/inode.c:124
 gfs2_lookup_root fs/gfs2/ops_fstype.c:440 [inline]
 init_sb+0xd71/0x1780 fs/gfs2/ops_fstype.c:507
 gfs2_fill_super+0x33f2/0x45a0 fs/gfs2/ops_fstype.c:1216
 get_tree_bdev+0x684/0x890 fs/super.c:1635
 gfs2_get_tree+0x5c/0x340 fs/gfs2/ops_fstype.c:1330
 vfs_get_tree+0xb1/0x5a0 fs/super.c:1800
 do_new_mount+0x71f/0x15e0 fs/namespace.c:3507
 path_mount+0x742/0x1f10 fs/namespace.c:3834
 do_mount fs/namespace.c:3847 [inline]
 __do_sys_mount fs/namespace.c:4055 [inline]
 __se_sys_mount+0x722/0x810 fs/namespace.c:4032
 __x64_sys_mount+0xe4/0x150 fs/namespace.c:4032
 x64_sys_call+0x255a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 5182 Comm: syz-executor574 Not tainted 6.11.0-syzkaller-11728-gad46e8f95e93 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [gfs2?] KMSAN: uninit-value in inode_go_dump (5)

[Qianqiang Liu]

#syz test

diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index 6678060ed4d2..d60d53810bc1 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -1537,11 +1537,13 @@ static struct inode *gfs2_alloc_inode(struct super_block *sb)
 	if (!ip)
 		return NULL;
 	ip->i_no_addr = 0;
+	ip->i_no_formal_ino = 0;
 	ip->i_flags = 0;
 	ip->i_gl = NULL;
 	gfs2_holder_mark_uninitialized(&ip->i_iopen_gh);
 	memset(&ip->i_res, 0, sizeof(ip->i_res));
 	RB_CLEAR_NODE(&ip->i_res.rs_node);
+	ip->i_diskflags = 0;
 	ip->i_rahead = 0;
 	return &ip->i_inode;
 }

-- 
Best,
Qianqiang Liu

Re: [syzbot] [gfs2?] KMSAN: uninit-value in inode_go_dump (5)

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+aa0730b0a42646eb1359@syzkaller.appspotmail.com
Tested-by: syzbot+aa0730b0a42646eb1359@syzkaller.appspotmail.com

Tested on:

commit:         27cc6fdf Merge tag 'linux_kselftest-fixes-6.12-rc2' of..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11923307980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=2cf7bb3f15c72e66
dashboard link: https://syzkaller.appspot.com/bug?extid=aa0730b0a42646eb1359
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=16bc7bd0580000

Note: testing is done by a robot and is best-effort only.

Re: [syzbot] [gfs2?] KMSAN: uninit-value in inode_go_dump (5)

[Andreas Gruenbacher]

On Sat, Oct 5, 2024 at 6:23 PM Qianqiang Liu <qianqiang.liu@163.com> wrote:
>
> #syz test
>
> diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
> index 6678060ed4d2..d60d53810bc1 100644
> --- a/fs/gfs2/super.c
> +++ b/fs/gfs2/super.c
> @@ -1537,11 +1537,13 @@ static struct inode *gfs2_alloc_inode(struct super_block *sb)
>         if (!ip)
>                 return NULL;
>         ip->i_no_addr = 0;
> +       ip->i_no_formal_ino = 0;
>         ip->i_flags = 0;
>         ip->i_gl = NULL;
>         gfs2_holder_mark_uninitialized(&ip->i_iopen_gh);
>         memset(&ip->i_res, 0, sizeof(ip->i_res));
>         RB_CLEAR_NODE(&ip->i_res.rs_node);
> +       ip->i_diskflags = 0;
>         ip->i_rahead = 0;
>         return &ip->i_inode;
>  }
>
> --
> Best,
> Qianqiang Liu

Added to for-next.

Thanks,
Andreas