public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [syzbot] [ntfs3?] KMSAN: uninit-value in attr_set_size
@ 2025-10-05 23:31 syzbot
  2025-10-06 12:47 ` Forwarded: [PATCH] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list syzbot
                   ` (2 more replies)
  0 siblings, 3 replies; 8+ messages in thread
From: syzbot @ 2025-10-05 23:31 UTC (permalink / raw)
  To: almaz.alexandrovich, linux-kernel, ntfs3, syzkaller-bugs

Hello,

syzbot found the following issue on:

HEAD commit:    9b0d551bcc05 Merge tag 'pull-misc' of git://git.kernel.org..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11da692f980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=50fb29d81ff5a3df
dashboard link: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=143915cd980000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13dbd334580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/90b0fb888152/disk-9b0d551b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1120c646f284/vmlinux-9b0d551b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/df9bbfa8cbe6/bzImage-9b0d551b.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/0277c876bf11/mount_8.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+83c9dd5c0dcf6184fdbf@syzkaller.appspotmail.com

ntfs3(loop0): Failed to initialize $Extend.
=====================================================
BUG: KMSAN: uninit-value in attr_set_size+0x471b/0x6740 fs/ntfs3/attrib.c:653
 attr_set_size+0x471b/0x6740 fs/ntfs3/attrib.c:653
 ntfs_set_size+0x222/0x330 fs/ntfs3/inode.c:861
 ntfs_extend+0x27c/0xf50 fs/ntfs3/file.c:359
 ntfs_file_write_iter+0x627/0x10d0 fs/ntfs3/file.c:1220
 iter_file_splice_write+0x12b2/0x2170 fs/splice.c:738
 ntfs_file_splice_write+0x21d/0x370 fs/ntfs3/file.c:1347
 do_splice_from fs/splice.c:938 [inline]
 direct_splice_actor+0x317/0x7d0 fs/splice.c:1161
 splice_direct_to_actor+0x99f/0x1550 fs/splice.c:1105
 do_splice_direct_actor fs/splice.c:1204 [inline]
 do_splice_direct+0x1e0/0x350 fs/splice.c:1230
 do_sendfile+0x9eb/0x1110 fs/read_write.c:1370
 __do_sys_sendfile64 fs/read_write.c:1431 [inline]
 __se_sys_sendfile64+0x1e3/0x280 fs/read_write.c:1417
 __x64_sys_sendfile64+0xbd/0x120 fs/read_write.c:1417
 x64_sys_call+0x36b8/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 attr_set_size+0x4714/0x6740 fs/ntfs3/attrib.c:655
 ntfs_set_size+0x222/0x330 fs/ntfs3/inode.c:861
 ntfs_extend+0x27c/0xf50 fs/ntfs3/file.c:359
 ntfs_file_write_iter+0x627/0x10d0 fs/ntfs3/file.c:1220
 iter_file_splice_write+0x12b2/0x2170 fs/splice.c:738
 ntfs_file_splice_write+0x21d/0x370 fs/ntfs3/file.c:1347
 do_splice_from fs/splice.c:938 [inline]
 direct_splice_actor+0x317/0x7d0 fs/splice.c:1161
 splice_direct_to_actor+0x99f/0x1550 fs/splice.c:1105
 do_splice_direct_actor fs/splice.c:1204 [inline]
 do_splice_direct+0x1e0/0x350 fs/splice.c:1230
 do_sendfile+0x9eb/0x1110 fs/read_write.c:1370
 __do_sys_sendfile64 fs/read_write.c:1431 [inline]
 __se_sys_sendfile64+0x1e3/0x280 fs/read_write.c:1417
 __x64_sys_sendfile64+0xbd/0x120 fs/read_write.c:1417
 x64_sys_call+0x36b8/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
 ni_create_attr_list+0x1b9b/0x1db0 fs/ntfs3/frecord.c:872
 attr_set_size+0x4174/0x6740 fs/ntfs3/attrib.c:640
 ntfs_set_size+0x222/0x330 fs/ntfs3/inode.c:861
 ntfs_extend+0x27c/0xf50 fs/ntfs3/file.c:359
 ntfs_file_write_iter+0x627/0x10d0 fs/ntfs3/file.c:1220
 iter_file_splice_write+0x12b2/0x2170 fs/splice.c:738
 ntfs_file_splice_write+0x21d/0x370 fs/ntfs3/file.c:1347
 do_splice_from fs/splice.c:938 [inline]
 direct_splice_actor+0x317/0x7d0 fs/splice.c:1161
 splice_direct_to_actor+0x99f/0x1550 fs/splice.c:1105
 do_splice_direct_actor fs/splice.c:1204 [inline]
 do_splice_direct+0x1e0/0x350 fs/splice.c:1230
 do_sendfile+0x9eb/0x1110 fs/read_write.c:1370
 __do_sys_sendfile64 fs/read_write.c:1431 [inline]
 __se_sys_sendfile64+0x1e3/0x280 fs/read_write.c:1417
 __x64_sys_sendfile64+0xbd/0x120 fs/read_write.c:1417
 x64_sys_call+0x36b8/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 slab_post_alloc_hook mm/slub.c:4953 [inline]
 slab_alloc_node mm/slub.c:5245 [inline]
 __do_kmalloc_node mm/slub.c:5602 [inline]
 __kmalloc_noprof+0xabb/0x1b40 mm/slub.c:5615
 kmalloc_noprof include/linux/slab.h:961 [inline]
 ni_create_attr_list+0x1ca/0x1db0 fs/ntfs3/frecord.c:770
 attr_set_size+0x4174/0x6740 fs/ntfs3/attrib.c:640
 ntfs_set_size+0x222/0x330 fs/ntfs3/inode.c:861
 ntfs_extend+0x27c/0xf50 fs/ntfs3/file.c:359
 ntfs_file_write_iter+0x627/0x10d0 fs/ntfs3/file.c:1220
 iter_file_splice_write+0x12b2/0x2170 fs/splice.c:738
 ntfs_file_splice_write+0x21d/0x370 fs/ntfs3/file.c:1347
 do_splice_from fs/splice.c:938 [inline]
 direct_splice_actor+0x317/0x7d0 fs/splice.c:1161
 splice_direct_to_actor+0x99f/0x1550 fs/splice.c:1105
 do_splice_direct_actor fs/splice.c:1204 [inline]
 do_splice_direct+0x1e0/0x350 fs/splice.c:1230
 do_sendfile+0x9eb/0x1110 fs/read_write.c:1370
 __do_sys_sendfile64 fs/read_write.c:1431 [inline]
 __se_sys_sendfile64+0x1e3/0x280 fs/read_write.c:1417
 __x64_sys_sendfile64+0xbd/0x120 fs/read_write.c:1417
 x64_sys_call+0x36b8/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 6199 Comm: syz.0.54 Not tainted syzkaller #0 PREEMPT(none) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

^ permalink raw reply	[flat|nested] 8+ messages in thread
[parent not found: <CABGqKE0FCWJ0EjzV5irNWtnLe5n9SGeqfmMEHPzWtsXhfUXXvg@mail.gmail.com>]
[parent not found: <CABGqKE12ATMeEx-EasTDyV-pQK9sLKKwBjhus7bMUNgRM64o_Q@mail.gmail.com>]
[parent not found: <CABGqKE03duCVamFHSXsyCrWj_esqHswu4vfb3v8uEGrUTDep2Q@mail.gmail.com>]
* [PATCH] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list
@ 2025-10-06 22:38 Nirbhay Sharma
  2025-10-07  0:47 ` [syzbot] [ntfs3?] KMSAN: uninit-value in attr_set_size syzbot
  0 siblings, 1 reply; 8+ messages in thread
From: Nirbhay Sharma @ 2025-10-06 22:38 UTC (permalink / raw)
  To: Konstantin Komarov
  Cc: david.hunter.linux, skhan, linux-kernel-mentees, khalid,
	Nirbhay Sharma, syzbot+83c9dd5c0dcf6184fdbf, ntfs3, linux-kernel

The call to kmalloc() to allocate the attribute list buffer is given a
size of al_aligned(rs). This size can be larger than the data
subsequently copied into the buffer, leaving trailing bytes uninitialized.

This can trigger a KMSAN "uninit-value" warning if that memory is
later accessed.

Fix this by using kzalloc() instead, which ensures the entire
allocated buffer is zero-initialized, preventing the warning.

Reported-by: syzbot+83c9dd5c0dcf6184fdbf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf
Signed-off-by: Nirbhay Sharma <nirbhay.lkd@gmail.com>
---
The following syzbot test commands were used to verify the fix against
both linux-next and a specific mainline commit. Both kernels were
configured with CONFIG_KMSAN=y, and no KMSAN warnings were observed
with the patch applied.

An attempt to test against the latest mainline tip failed due to an
unrelated boot failure in the SCSI subsystem (KMSAN: use-after-free in
scsi_get_vpd_buf). Therefore, testing was done on the last known-good
mainline commit below.

For mainline commit 9b0d551bcc05 ("Merge tag 'pull-misc' of..."):
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 9b0d551bcc05

For the linux-next branch:
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master

 fs/ntfs3/frecord.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index 8f9fe1d7a690..4fe8da7fc034 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -767,7 +767,7 @@ int ni_create_attr_list(struct ntfs_inode *ni)
 	 * Skip estimating exact memory requirement.
 	 * Looks like one record_size is always enough.
 	 */
-	le = kmalloc(al_aligned(rs), GFP_NOFS);
+	le = kzalloc(al_aligned(rs), GFP_NOFS);
 	if (!le)
 		return -ENOMEM;
 
-- 
2.51.0


^ permalink raw reply related	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2025-10-07  0:47 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-10-05 23:31 [syzbot] [ntfs3?] KMSAN: uninit-value in attr_set_size syzbot
2025-10-06 12:47 ` Forwarded: [PATCH] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list syzbot
2025-10-06 15:32 ` Forwarded: Re: test syzbot
2025-10-06 15:33 ` Forwarded: Re: test2 syzbot
     [not found] <CABGqKE0FCWJ0EjzV5irNWtnLe5n9SGeqfmMEHPzWtsXhfUXXvg@mail.gmail.com>
2025-10-06 14:39 ` [syzbot] [ntfs3?] KMSAN: uninit-value in attr_set_size syzbot
     [not found] <CABGqKE12ATMeEx-EasTDyV-pQK9sLKKwBjhus7bMUNgRM64o_Q@mail.gmail.com>
2025-10-06 16:22 ` syzbot
     [not found] <CABGqKE03duCVamFHSXsyCrWj_esqHswu4vfb3v8uEGrUTDep2Q@mail.gmail.com>
2025-10-06 17:15 ` syzbot
  -- strict thread matches above, loose matches on Subject: below --
2025-10-06 22:38 [PATCH] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list Nirbhay Sharma
2025-10-07  0:47 ` [syzbot] [ntfs3?] KMSAN: uninit-value in attr_set_size syzbot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox