From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F35121339B1 for ; Wed, 13 May 2026 06:06:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.171 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778652372; cv=none; b=GciaRdlfGGBwPPz4qxtdkM4Ayqbvyih7JThlRmWVHUC8UAmjiRN7I+s49SfH3ZFm0IabF4TsG0/9L5Osgi6M3GufHrZQanV/mmUVhWsqNI3aOmmZcx5K55iQUs+VAbGe9kBcwV/LiGJ1kvU8GoVKqyvaftXHOTjXklNx/kh73pA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778652372; c=relaxed/simple; bh=SL81OneJmwOgNH4ypoXvIn2vagARdPwfcB/9rKvqR4g=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=MwiiFHeX0ydqCzT7fYjSE/6YYcxIuo3zfNqTBenimRea0IofM3gx4OGeRbdQjJv1ioFsTf7Ri99I3W1bupRXpMgceuap1+g5SINfu+03UhRrFrKFjf94Kac+UjtKqVyrVNsDz/sEDuOLaRv3D3vubYBdmGCS+SZTHPB6UDwbUuM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org; spf=pass smtp.mailfrom=chromium.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b=IgHGQ6a1; arc=none smtp.client-ip=209.85.214.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=chromium.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="IgHGQ6a1" Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-2adff872068so34293545ad.1 for ; Tue, 12 May 2026 23:06:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1778652370; x=1779257170; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=xJMt9eiXDN18Dn/IZDF5sRaVqP4gFjNnQ5yKAIkeCXE=; b=IgHGQ6a1ySnr9ccLE9v1k/612QK81A4FjfxXN08TWqAsfdM777RsK1+psrsyQhVxI9 plo3T7g72iRtMrPtRMGtWS+fuzz2C9PABV/mpKfVq506ntS5L6yx/DrOQi77Zk/F+tix /kfJPQFdkZ39DH8gdZ0Yucw14z1NDibz1OiZ8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778652370; x=1779257170; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=xJMt9eiXDN18Dn/IZDF5sRaVqP4gFjNnQ5yKAIkeCXE=; b=UO/Vgu+34sFpLVapffm+1F1ge7VIopjbGQux2KeHfh5bhn69+CzyLV3EI+/2bdCadb t9O1MICz9XvB57CdxLJxM2VSn+RUriWZCBvxRytAI5K7z0phcGZxH+5kcnqR4c78SUfZ fplf1xxDfWINEl0ZRH/aWqtNeyidl0c9dMU3dld3hSnjZZI1UL4pc8Gx6cUQJXfA1HQK G6hkzXg/0LWPSRWWkoDlOfU5T6gmESbjUbtDky6sgSwe5tYOeUx8fcf359Fgcf21sAvj 5wh/QCCeOiy2XrjbMlk3WyuGy6F+zRsBCKnmOOdFUMqwQngcZUn9hE1AtTTsDPbeas2p yhLA== X-Forwarded-Encrypted: i=1; AFNElJ8vR8ip5/tNDaoRF0CqJ34hWSF5R87WIu48KMnWe/e+ABgcMZ1GEVZQKPrIjLm5vCbyOPU779htA2Je3B4=@vger.kernel.org X-Gm-Message-State: AOJu0YzWslc4v3IAV8ETBfboqLsUnNw7OyY4TYLzSp0sJZVSBfvzgaFl YbpmCBohok/6fislbsT+7fgd2oPwi4GvQW3l+BUkddR7hJ1ADRMFqjvg7pKnVSsUiA== X-Gm-Gg: Acq92OEKM9C0JH6neocX+1kf7N2iPvl0cMLRYWmGspZsIGrMKT4eUV29X0PFCDXaCXY kboOJ0JUNEYF26JAyAd9dcwI8mVGIib4R1VJvaogtUW3LZ988CKH5GYrXc4Reth/roziLDDm9uS 0ntWJ7eVycxTnxl3TWuP44+aIBBqNanoCm0Xp9YDpAYfO0MnV+snhfkob1ES/Un01vIB15Jr5RG f9ECsUu21rum/xUv1ZZxv+jIRM8ltNsHcGnuZry12eiAXrIu9wX93FPIVWpKuKsvu0l+7+hg0t3 AyhOecsRsVFFJRlt6h9f03v6bvuh03LcZBwODFP+psC3duXjGHXXSjThF4FzKGVXeZshnDqEVKj edtM/BlJxIyntbbJ5e9VXJXWJ8fxhc+TKRfFplv+/vIySCu0nyhIEk1rHlJZooZ98EHL+N5rrYF Ku4ziOa0Rp5FKfdJBb7DTp1I9aIhO6ZlKlsAgSZtRNrJYL92RWPSfKeSe1PJtI4l4= X-Received: by 2002:a17:903:249:b0:2b2:5314:e96a with SMTP id d9443c01a7336-2bd276e7a13mr21751955ad.34.1778652370167; Tue, 12 May 2026 23:06:10 -0700 (PDT) Received: from google.com ([2a00:79e0:2031:6:e541:a7ed:e8ee:843c]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2baf1e8df57sm158567615ad.64.2026.05.12.23.06.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 12 May 2026 23:06:09 -0700 (PDT) Date: Wed, 13 May 2026 15:06:06 +0900 From: Sergey Senozhatsky To: Herbert Xu Cc: Sergey Senozhatsky , Andrew Morton , Yosry Ahmed , Kartik Nair , minchan@kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, syzbot+8f77ff6144a73f0cf71b@syzkaller.appspotmail.com, Nhat Pham Subject: Re: [PATCH] zsmalloc: zero-initialize zspage memory to prevent KMSAN uninit reads Message-ID: References: <20260511213658.25273-1-contact.kartikn@gmail.com> <20260512144733.9132c83e392a109743e92f71@linux-foundation.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On (26/05/13 13:43), Herbert Xu wrote: > On Wed, May 13, 2026 at 11:47:41AM +0900, Sergey Senozhatsky wrote: > > Adding Yosry and Herbert, > > > > On (26/05/12 14:47), Andrew Morton wrote: > > > > Pages allocated via alloc_zpdesc() use alloc_pages_node() without > > > > __GFP_ZERO, leaving physical memory uninitialized. When a compressed > > > > object spans two physical pages in a zspage, zs_obj_read_sg_begin() > > > > sets up a scatterlist pointing directly at the raw second page. If the > > > > second page was freshly allocated and never written beyond the object > > > > boundary, KMSAN detects reads of uninitialized memory downstream in > > > > the decompressor (e.g. sw842_decompress reading the CRC trailer). > > > > I don't get this. How can sw842_decompress() read more bytes than > > it's told to decompress. We first compress and store the object, > > before we load and decompress, reading past the known compressed > > object size (which we pass to decompress function) should not happen. > > Yosry, Herbert, any ideas? > > It sounds like a bug in 842. I'll look into it. Thanks! The report doesn't have a reproducer, that is always alarming, a big red flag. Might be entirely unrelated to 842/zsmalloc/zswap.