* [syzbot] [jfs?] KMSAN: uninit-value in BT_STACK_DUMP
@ 2025-05-06 3:08 syzbot
2025-05-06 13:00 ` [syzbot] [PATCH] " syzbot
` (5 more replies)
0 siblings, 6 replies; 7+ messages in thread
From: syzbot @ 2025-05-06 3:08 UTC (permalink / raw)
To: jfs-discussion, linux-kernel, shaggy, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 02ddfb981de8 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=106abf74580000
kernel config: https://syzkaller.appspot.com/x/.config?x=9dc42c34a3f5c357
dashboard link: https://syzkaller.appspot.com/bug?extid=ba5f49027aace342d24d
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=109589b3980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15ba1f74580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5ca57f5a3f77/disk-02ddfb98.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3f23cbc11e68/vmlinux-02ddfb98.xz
kernel image: https://storage.googleapis.com/syzbot-assets/73e63afac354/bzImage-02ddfb98.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/6ef4108d05dc/mount_2.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=169bb02f980000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ba5f49027aace342d24d@syzkaller.appspotmail.com
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
bn = 0, index = 0
=====================================================
BUG: KMSAN: uninit-value in BT_STACK_DUMP+0x5e5/0x600 fs/jfs/jfs_btree.h:136
BT_STACK_DUMP+0x5e5/0x600 fs/jfs/jfs_btree.h:136
dtSearch+0x393f/0x3d30 fs/jfs/jfs_dtree.c:774
jfs_lookup+0x179/0x590 fs/jfs/namei.c:1461
lookup_one_qstr_excl_raw+0x204/0x5b0 fs/namei.c:1689
lookup_one_qstr_excl fs/namei.c:1711 [inline]
do_unlinkat+0x2e3/0xe50 fs/namei.c:4631
__do_sys_unlink fs/namei.c:4689 [inline]
__se_sys_unlink fs/namei.c:4687 [inline]
__x64_sys_unlink+0x71/0xb0 fs/namei.c:4687
x64_sys_call+0x29de/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:88
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable nd created at:
__filename_parentat+0x4c/0x990 fs/namei.c:2726
filename_parentat fs/namei.c:2749 [inline]
do_unlinkat+0xe3/0xe50 fs/namei.c:4618
CPU: 1 UID: 0 PID: 5791 Comm: syz-executor444 Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [syzbot] [PATCH] Re: [syzbot] [jfs?] KMSAN: uninit-value in BT_STACK_DUMP
2025-05-06 3:08 [syzbot] [jfs?] KMSAN: uninit-value in BT_STACK_DUMP syzbot
@ 2025-05-06 13:00 ` syzbot
2025-05-06 14:20 ` [syzbot] " syzbot
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2025-05-06 13:00 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: [PATCH] Re: [syzbot] [jfs?] KMSAN: uninit-value in BT_STACK_DUMP
Author: richard120310@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 02ddfb981de8
Signed-off-by: I Hsin Cheng <richard120310@gmail.com>
---
fs/jfs/namei.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index 65a218eba8fa..937a7fae0e31 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -1448,7 +1448,7 @@ static int jfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
static struct dentry *jfs_lookup(struct inode *dip, struct dentry *dentry, unsigned int flags)
{
- struct btstack btstack;
+ struct btstack btstack = {0};
ino_t inum;
struct inode *ip;
struct component_name key;
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [syzbot] Re: [syzbot] [jfs?] KMSAN: uninit-value in BT_STACK_DUMP
2025-05-06 3:08 [syzbot] [jfs?] KMSAN: uninit-value in BT_STACK_DUMP syzbot
2025-05-06 13:00 ` [syzbot] [PATCH] " syzbot
@ 2025-05-06 14:20 ` syzbot
2025-05-06 17:20 ` [RFC PATCH] jfs: Use zero initializer for btstack I Hsin Cheng
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2025-05-06 14:20 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [jfs?] KMSAN: uninit-value in BT_STACK_DUMP
Author: richard120310@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 02ddfb981de8
Signed-off-by: I Hsin Cheng <richard120310@gmail.com>
---
fs/jfs/jfs_dtree.c | 6 +++---
fs/jfs/jfs_xtree.c | 14 +++++++-------
fs/jfs/namei.c | 14 +++++++-------
3 files changed, 17 insertions(+), 17 deletions(-)
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 93db6eec4465..87025d832758 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -2083,7 +2083,7 @@ int dtDelete(tid_t tid,
struct metapage *mp, *imp;
dtpage_t *p;
int index;
- struct btstack btstack;
+ struct btstack btstack = {0};
struct dt_lock *dtlck;
struct tlock *tlck;
struct lv *lv;
@@ -2716,7 +2716,7 @@ int jfs_readdir(struct file *file, struct dir_context *ctx)
dtpage_t *p;
int index;
s8 *stbl;
- struct btstack btstack;
+ struct btstack btstack = {0};
int i, next;
struct ldtentry *d;
struct dtslot *t;
@@ -4237,7 +4237,7 @@ int dtModify(tid_t tid, struct inode *ip,
struct metapage *mp;
dtpage_t *p;
int index;
- struct btstack btstack;
+ struct btstack btstack = {0};
struct tlock *tlck;
struct dt_lock *dtlck;
struct lv *lv;
diff --git a/fs/jfs/jfs_xtree.c b/fs/jfs/jfs_xtree.c
index 5ee618d17e77..dd0e542a4978 100644
--- a/fs/jfs/jfs_xtree.c
+++ b/fs/jfs/jfs_xtree.c
@@ -123,7 +123,7 @@ int xtLookup(struct inode *ip, s64 lstart,
s64 llen, int *pflag, s64 * paddr, s32 * plen, int no_check)
{
int rc = 0;
- struct btstack btstack;
+ struct btstack btstack = {0};
int cmp;
s64 bn;
struct metapage *mp;
@@ -520,7 +520,7 @@ int xtInsert(tid_t tid, /* transaction id */
xtpage_t *p; /* base B+-tree index page */
s64 bn;
int index, nextindex;
- struct btstack btstack; /* traverse stack */
+ struct btstack btstack = {0}; /* traverse stack */
struct xtsplit split; /* split information */
xad_t *xad;
int cmp;
@@ -1344,7 +1344,7 @@ int xtExtend(tid_t tid, /* transaction id */
xtpage_t *p; /* base B+-tree index page */
s64 bn;
int index, nextindex, len;
- struct btstack btstack; /* traverse stack */
+ struct btstack btstack = {0}; /* traverse stack */
struct xtsplit split; /* split information */
xad_t *xad;
s64 xaddr;
@@ -1503,7 +1503,7 @@ int xtUpdate(tid_t tid, struct inode *ip, xad_t * nxad)
xtpage_t *p; /* base B+-tree index page */
s64 bn;
int index0, index, newindex, nextindex;
- struct btstack btstack; /* traverse stack */
+ struct btstack btstack = {0}; /* traverse stack */
struct xtsplit split; /* split information */
xad_t *xad, *lxad, *rxad;
int xflag;
@@ -1949,7 +1949,7 @@ int xtAppend(tid_t tid, /* transaction id */
xtpage_t *p; /* base B+-tree index page */
s64 bn, xaddr;
int index, nextindex;
- struct btstack btstack; /* traverse stack */
+ struct btstack btstack = {0}; /* traverse stack */
struct xtsplit split; /* split information */
xad_t *xad;
int cmp;
@@ -2196,7 +2196,7 @@ s64 xtTruncate(tid_t tid, struct inode *ip, s64 newsize, int flag)
xad_t *xad;
s64 xoff, xaddr;
int xlen, len, freexlen;
- struct btstack btstack;
+ struct btstack btstack = {0};
struct btframe *parent;
struct tblock *tblk = NULL;
struct tlock *tlck = NULL;
@@ -2744,7 +2744,7 @@ s64 xtTruncate(tid_t tid, struct inode *ip, s64 newsize, int flag)
s64 xtTruncate_pmap(tid_t tid, struct inode *ip, s64 committed_size)
{
s64 bn;
- struct btstack btstack;
+ struct btstack btstack = {0};
int cmp;
int index;
int locked_leaves = 0;
diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index 65a218eba8fa..d04c752823ea 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -67,7 +67,7 @@ static int jfs_create(struct mnt_idmap *idmap, struct inode *dip,
struct inode *ip = NULL; /* child directory inode */
ino_t ino;
struct component_name dname; /* child directory name */
- struct btstack btstack;
+ struct btstack btstack = {0};
struct inode *iplist[2];
struct tblock *tblk;
@@ -200,7 +200,7 @@ static struct dentry *jfs_mkdir(struct mnt_idmap *idmap, struct inode *dip,
struct inode *ip = NULL; /* child directory inode */
ino_t ino;
struct component_name dname; /* child directory name */
- struct btstack btstack;
+ struct btstack btstack = {0};
struct inode *iplist[2];
struct tblock *tblk;
@@ -791,7 +791,7 @@ static int jfs_link(struct dentry *old_dentry,
struct inode *ip = d_inode(old_dentry);
ino_t ino;
struct component_name dname;
- struct btstack btstack;
+ struct btstack btstack = {0};
struct inode *iplist[2];
jfs_info("jfs_link: %pd %pd", old_dentry, dentry);
@@ -883,7 +883,7 @@ static int jfs_symlink(struct mnt_idmap *idmap, struct inode *dip,
ino_t ino = 0;
struct component_name dname;
u32 ssize; /* source pathname size */
- struct btstack btstack;
+ struct btstack btstack = {0};
struct inode *ip;
s64 xlen = 0;
int bmask = 0, xsize;
@@ -1069,7 +1069,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
struct dentry *old_dentry, struct inode *new_dir,
struct dentry *new_dentry, unsigned int flags)
{
- struct btstack btstack;
+ struct btstack btstack = {0};
ino_t ino;
struct component_name new_dname;
struct inode *new_ip;
@@ -1356,7 +1356,7 @@ static int jfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
struct dentry *dentry, umode_t mode, dev_t rdev)
{
struct jfs_inode_info *jfs_ip;
- struct btstack btstack;
+ struct btstack btstack = {0};
struct component_name dname;
ino_t ino;
struct inode *ip;
@@ -1448,7 +1448,7 @@ static int jfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
static struct dentry *jfs_lookup(struct inode *dip, struct dentry *dentry, unsigned int flags)
{
- struct btstack btstack;
+ struct btstack btstack = {0};
ino_t inum;
struct inode *ip;
struct component_name key;
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [RFC PATCH] jfs: Use zero initializer for btstack
2025-05-06 3:08 [syzbot] [jfs?] KMSAN: uninit-value in BT_STACK_DUMP syzbot
2025-05-06 13:00 ` [syzbot] [PATCH] " syzbot
2025-05-06 14:20 ` [syzbot] " syzbot
@ 2025-05-06 17:20 ` I Hsin Cheng
2025-09-23 17:47 ` Forwarded: KMSAN: uninit-value in BT_STACK_DUMP syzbot
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: I Hsin Cheng @ 2025-05-06 17:20 UTC (permalink / raw)
To: syzbot+ba5f49027aace342d24d
Cc: shaggy, ghanshyam1898, r.smirnov, eadavis, jfs-discussion,
linux-kernel, skhan, linux-kernel-mentees, syzkaller-bugs,
I Hsin Cheng
Use C's designated zero initializer for the initialization of local
variable "btstack" to prevent KMSCAN from raising uninit-value error for
it.
Reported-by: syzbot+ba5f49027aace342d24d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ba5f49027aace342d24d
Signed-off-by: I Hsin Cheng <richard120310@gmail.com>
---
syzbot reported an uninit-value issue. [1]
We can fix this bug with the patch changes, but there's still other bug
in the code as we can see from syzbot's reply[2]. The reproducer doesn't
trigger this issue locally, I'm guessing it's the original issue why the
code jump into "BT_STACK_DUMP", it implies some memory is corrupted.
If you have any suggestion on how to reproduce that bug or look into it,
please let me know, I'll be happy to help.
Btw, I think maybe the btstack can have its own initializer macro? it'll
be more readable and maintainable for future changes if needed.
[1]:
BUG: KMSAN: uninit-value in BT_STACK_DUMP+0x5e5/0x600 fs/jfs/jfs_btree.h:136
BT_STACK_DUMP+0x5e5/0x600 fs/jfs/jfs_btree.h:136
dtSearch+0x393f/0x3d30 fs/jfs/jfs_dtree.c:774
jfs_lookup+0x179/0x590 fs/jfs/namei.c:1461
lookup_one_qstr_excl_raw+0x204/0x5b0 fs/namei.c:1689
lookup_one_qstr_excl fs/namei.c:1711 [inline]
do_unlinkat+0x2e3/0xe50 fs/namei.c:4631
__do_sys_unlink fs/namei.c:4689 [inline]
__se_sys_unlink fs/namei.c:4687 [inline]
__x64_sys_unlink+0x71/0xb0 fs/namei.c:4687
x64_sys_call+0x29de/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:88
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable nd created at:
__filename_parentat+0x4c/0x990 fs/namei.c:2726
filename_parentat fs/namei.c:2749 [inline]
do_unlinkat+0xe3/0xe50 fs/namei.c:4618
CPU: 1 UID: 0 PID: 5791 Comm: syz-executor444 Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
[2]:
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: use-after-free in dtSearch
loop0: detected capacity change from 0 to 32768
=====================================================
BUG: KMSAN: use-after-free in UniStrncmp_le fs/jfs/jfs_unicode.h:55 [inline]
BUG: KMSAN: use-after-free in dtCompare fs/jfs/jfs_dtree.c:3340 [inline]
BUG: KMSAN: use-after-free in dtSearch+0x1261/0x3d30 fs/jfs/jfs_dtree.c:650
UniStrncmp_le fs/jfs/jfs_unicode.h:55 [inline]
dtCompare fs/jfs/jfs_dtree.c:3340 [inline]
dtSearch+0x1261/0x3d30 fs/jfs/jfs_dtree.c:650
jfs_lookup+0x18b/0x5a0 fs/jfs/namei.c:1461
lookup_one_qstr_excl_raw+0x204/0x5b0 fs/namei.c:1689
lookup_one_qstr_excl fs/namei.c:1711 [inline]
do_unlinkat+0x2e3/0xe50 fs/namei.c:4631
__do_sys_unlink fs/namei.c:4689 [inline]
__se_sys_unlink fs/namei.c:4687 [inline]
__x64_sys_unlink+0x71/0xb0 fs/namei.c:4687
x64_sys_call+0x29de/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:88
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x1b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_free_hook mm/slub.c:2324 [inline]
slab_free mm/slub.c:4656 [inline]
kmem_cache_free+0x286/0xf00 mm/slub.c:4758
__d_free+0x43/0x60 fs/dcache.c:336
rcu_do_batch kernel/rcu/tree.c:2568 [inline]
rcu_core+0xa5a/0x21e0 kernel/rcu/tree.c:2824
rcu_core_si+0x12/0x20 kernel/rcu/tree.c:2841
handle_softirqs+0x166/0x6e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x66/0x180 kernel/softirq.c:680
irq_exit_rcu+0x12/0x20 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x84/0x90 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
CPU: 0 UID: 0 PID: 6979 Comm: syz.0.35 Not tainted 6.15.0-rc3-syzkaller-00094-g02ddfb981de8-dirty #0 PREEMPT(undef)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025
Best regards,
I Hsin Cheng
---
fs/jfs/jfs_dtree.c | 6 +++---
fs/jfs/jfs_xtree.c | 14 +++++++-------
fs/jfs/namei.c | 14 +++++++-------
3 files changed, 17 insertions(+), 17 deletions(-)
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 93db6eec4465..87025d832758 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -2083,7 +2083,7 @@ int dtDelete(tid_t tid,
struct metapage *mp, *imp;
dtpage_t *p;
int index;
- struct btstack btstack;
+ struct btstack btstack = {0};
struct dt_lock *dtlck;
struct tlock *tlck;
struct lv *lv;
@@ -2716,7 +2716,7 @@ int jfs_readdir(struct file *file, struct dir_context *ctx)
dtpage_t *p;
int index;
s8 *stbl;
- struct btstack btstack;
+ struct btstack btstack = {0};
int i, next;
struct ldtentry *d;
struct dtslot *t;
@@ -4237,7 +4237,7 @@ int dtModify(tid_t tid, struct inode *ip,
struct metapage *mp;
dtpage_t *p;
int index;
- struct btstack btstack;
+ struct btstack btstack = {0};
struct tlock *tlck;
struct dt_lock *dtlck;
struct lv *lv;
diff --git a/fs/jfs/jfs_xtree.c b/fs/jfs/jfs_xtree.c
index 5ee618d17e77..dd0e542a4978 100644
--- a/fs/jfs/jfs_xtree.c
+++ b/fs/jfs/jfs_xtree.c
@@ -123,7 +123,7 @@ int xtLookup(struct inode *ip, s64 lstart,
s64 llen, int *pflag, s64 * paddr, s32 * plen, int no_check)
{
int rc = 0;
- struct btstack btstack;
+ struct btstack btstack = {0};
int cmp;
s64 bn;
struct metapage *mp;
@@ -520,7 +520,7 @@ int xtInsert(tid_t tid, /* transaction id */
xtpage_t *p; /* base B+-tree index page */
s64 bn;
int index, nextindex;
- struct btstack btstack; /* traverse stack */
+ struct btstack btstack = {0}; /* traverse stack */
struct xtsplit split; /* split information */
xad_t *xad;
int cmp;
@@ -1344,7 +1344,7 @@ int xtExtend(tid_t tid, /* transaction id */
xtpage_t *p; /* base B+-tree index page */
s64 bn;
int index, nextindex, len;
- struct btstack btstack; /* traverse stack */
+ struct btstack btstack = {0}; /* traverse stack */
struct xtsplit split; /* split information */
xad_t *xad;
s64 xaddr;
@@ -1503,7 +1503,7 @@ int xtUpdate(tid_t tid, struct inode *ip, xad_t * nxad)
xtpage_t *p; /* base B+-tree index page */
s64 bn;
int index0, index, newindex, nextindex;
- struct btstack btstack; /* traverse stack */
+ struct btstack btstack = {0}; /* traverse stack */
struct xtsplit split; /* split information */
xad_t *xad, *lxad, *rxad;
int xflag;
@@ -1949,7 +1949,7 @@ int xtAppend(tid_t tid, /* transaction id */
xtpage_t *p; /* base B+-tree index page */
s64 bn, xaddr;
int index, nextindex;
- struct btstack btstack; /* traverse stack */
+ struct btstack btstack = {0}; /* traverse stack */
struct xtsplit split; /* split information */
xad_t *xad;
int cmp;
@@ -2196,7 +2196,7 @@ s64 xtTruncate(tid_t tid, struct inode *ip, s64 newsize, int flag)
xad_t *xad;
s64 xoff, xaddr;
int xlen, len, freexlen;
- struct btstack btstack;
+ struct btstack btstack = {0};
struct btframe *parent;
struct tblock *tblk = NULL;
struct tlock *tlck = NULL;
@@ -2744,7 +2744,7 @@ s64 xtTruncate(tid_t tid, struct inode *ip, s64 newsize, int flag)
s64 xtTruncate_pmap(tid_t tid, struct inode *ip, s64 committed_size)
{
s64 bn;
- struct btstack btstack;
+ struct btstack btstack = {0};
int cmp;
int index;
int locked_leaves = 0;
diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index 65a218eba8fa..d04c752823ea 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -67,7 +67,7 @@ static int jfs_create(struct mnt_idmap *idmap, struct inode *dip,
struct inode *ip = NULL; /* child directory inode */
ino_t ino;
struct component_name dname; /* child directory name */
- struct btstack btstack;
+ struct btstack btstack = {0};
struct inode *iplist[2];
struct tblock *tblk;
@@ -200,7 +200,7 @@ static struct dentry *jfs_mkdir(struct mnt_idmap *idmap, struct inode *dip,
struct inode *ip = NULL; /* child directory inode */
ino_t ino;
struct component_name dname; /* child directory name */
- struct btstack btstack;
+ struct btstack btstack = {0};
struct inode *iplist[2];
struct tblock *tblk;
@@ -791,7 +791,7 @@ static int jfs_link(struct dentry *old_dentry,
struct inode *ip = d_inode(old_dentry);
ino_t ino;
struct component_name dname;
- struct btstack btstack;
+ struct btstack btstack = {0};
struct inode *iplist[2];
jfs_info("jfs_link: %pd %pd", old_dentry, dentry);
@@ -883,7 +883,7 @@ static int jfs_symlink(struct mnt_idmap *idmap, struct inode *dip,
ino_t ino = 0;
struct component_name dname;
u32 ssize; /* source pathname size */
- struct btstack btstack;
+ struct btstack btstack = {0};
struct inode *ip;
s64 xlen = 0;
int bmask = 0, xsize;
@@ -1069,7 +1069,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
struct dentry *old_dentry, struct inode *new_dir,
struct dentry *new_dentry, unsigned int flags)
{
- struct btstack btstack;
+ struct btstack btstack = {0};
ino_t ino;
struct component_name new_dname;
struct inode *new_ip;
@@ -1356,7 +1356,7 @@ static int jfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
struct dentry *dentry, umode_t mode, dev_t rdev)
{
struct jfs_inode_info *jfs_ip;
- struct btstack btstack;
+ struct btstack btstack = {0};
struct component_name dname;
ino_t ino;
struct inode *ip;
@@ -1448,7 +1448,7 @@ static int jfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
static struct dentry *jfs_lookup(struct inode *dip, struct dentry *dentry, unsigned int flags)
{
- struct btstack btstack;
+ struct btstack btstack = {0};
ino_t inum;
struct inode *ip;
struct component_name key;
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Forwarded: KMSAN: uninit-value in BT_STACK_DUMP
2025-05-06 3:08 [syzbot] [jfs?] KMSAN: uninit-value in BT_STACK_DUMP syzbot
` (2 preceding siblings ...)
2025-05-06 17:20 ` [RFC PATCH] jfs: Use zero initializer for btstack I Hsin Cheng
@ 2025-09-23 17:47 ` syzbot
2026-04-17 10:12 ` Forwarded: [PATCH] jfs: zero-initialize btstack to fix KMSAN " syzbot
2026-04-17 16:20 ` Forwarded: Re: [syzbot] KMSAN: " syzbot
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2025-09-23 17:47 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: KMSAN: uninit-value in BT_STACK_DUMP
Author: rampxxxx@gmail.com
#syz test
---
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index ab11849cf9cc..4fbb0e39270c 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -770,6 +770,10 @@ int dtSearch(struct inode *ip, struct
component_name * key, ino_t * data,
/* Something's corrupted, mark filesystem dirty so
* chkdsk will fix it.
*/
+ btsp = btstack->top;
+ btsp->bn = 0;
+ btsp->index = 0;
+
jfs_error(sb, "stack overrun!\n");
BT_STACK_DUMP(btstack);
rc = -EIO;
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Forwarded: [PATCH] jfs: zero-initialize btstack to fix KMSAN uninit-value in BT_STACK_DUMP
2025-05-06 3:08 [syzbot] [jfs?] KMSAN: uninit-value in BT_STACK_DUMP syzbot
` (3 preceding siblings ...)
2025-09-23 17:47 ` Forwarded: KMSAN: uninit-value in BT_STACK_DUMP syzbot
@ 2026-04-17 10:12 ` syzbot
2026-04-17 16:20 ` Forwarded: Re: [syzbot] KMSAN: " syzbot
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-04-17 10:12 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] jfs: zero-initialize btstack to fix KMSAN uninit-value in BT_STACK_DUMP
Author: tristmd@gmail.com
From: Tristan Madani <tristan@talencesecurity.com>
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
BT_STACK_DUMP() unconditionally prints all MAXTREEHEIGHT entries of the
btstack->stack[] array. However, only entries between stack[0] and *top
have been written by BT_PUSH(); the rest contain uninitialized stack
data.
When dtSearch() or dtReadFirst() detect a corrupted B-tree that exceeds
MAXTREEHEIGHT, they call BT_STACK_DUMP() for diagnostic output. Reading
the uninitialized entries triggers a KMSAN uninit-value report.
Fix this by only iterating over the entries that were actually pushed
onto the stack (from stack[0] up to but not including top), rather than
blindly dumping all MAXTREEHEIGHT slots.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+ba5f49027aace342d24d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ba5f49027aace342d24d
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/jfs/jfs_btree.h | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/jfs/jfs_btree.h b/fs/jfs/jfs_btree.h
index a1312322..b6737db2 100644
--- a/fs/jfs/jfs_btree.h
+++ b/fs/jfs/jfs_btree.h
@@ -130,10 +130,12 @@ struct btstack {
static inline void BT_STACK_DUMP(struct btstack *btstack)
{
int i;
+ int depth = btstack->top - btstack->stack;
+
printk("btstack dump:\n");
- for (i = 0; i < MAXTREEHEIGHT; i++)
+ for (i = 0; i < depth; i++)
printk(KERN_ERR "bn = %Lx, index = %d\n",
(long long)btstack->stack[i].bn,
btstack->stack[i].index);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Forwarded: Re: [syzbot] KMSAN: uninit-value in BT_STACK_DUMP
2025-05-06 3:08 [syzbot] [jfs?] KMSAN: uninit-value in BT_STACK_DUMP syzbot
` (4 preceding siblings ...)
2026-04-17 10:12 ` Forwarded: [PATCH] jfs: zero-initialize btstack to fix KMSAN " syzbot
@ 2026-04-17 16:20 ` syzbot
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-04-17 16:20 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] KMSAN: uninit-value in BT_STACK_DUMP
Author: tristmd@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
>From 1f2ecf89a062d7428650e0529613f47930961464 Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Fri, 17 Apr 2026 16:15:15 +0000
Subject: [PATCH] jfs: fix uninit-value in BT_STACK_DUMP by limiting loop to
actual depth
BT_STACK_DUMP iterates over MAXTREEHEIGHT entries, but only
entries between stack and top are initialized. Reading beyond
top accesses uninitialized stack memory, triggering KMSAN.
Fix by computing the actual depth and using it as the loop bound.
Reported-by: syzbot+ba5f49027aace342d24d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ba5f49027aace342d24d
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/jfs/jfs_btree.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/jfs/jfs_btree.h b/fs/jfs/jfs_btree.h
index ce055ef..26dd5ac 100644
--- a/fs/jfs/jfs_btree.h
+++ b/fs/jfs/jfs_btree.h
@@ -131,8 +131,10 @@ struct btstack {
static inline void BT_STACK_DUMP(struct btstack *btstack)
{
int i;
+ int depth = btstack->top - btstack->stack;
+
printk("btstack dump:\n");
- for (i = 0; i < MAXTREEHEIGHT; i++)
+ for (i = 0; i < depth; i++)
printk(KERN_ERR "bn = %Lx, index = %d\n",
(long long)btstack->stack[i].bn,
btstack->stack[i].index);
--
2.47.3
^ permalink raw reply related [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-04-17 16:20 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-05-06 3:08 [syzbot] [jfs?] KMSAN: uninit-value in BT_STACK_DUMP syzbot
2025-05-06 13:00 ` [syzbot] [PATCH] " syzbot
2025-05-06 14:20 ` [syzbot] " syzbot
2025-05-06 17:20 ` [RFC PATCH] jfs: Use zero initializer for btstack I Hsin Cheng
2025-09-23 17:47 ` Forwarded: KMSAN: uninit-value in BT_STACK_DUMP syzbot
2026-04-17 10:12 ` Forwarded: [PATCH] jfs: zero-initialize btstack to fix KMSAN " syzbot
2026-04-17 16:20 ` Forwarded: Re: [syzbot] KMSAN: " syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox