Re: + zsmalloc-zero-initialize-zspage-memory-to-prevent-kmsan-uninit-reads.patch added to mm-hotfixes-unstable branch

[Sergey Senozhatsky <senozhatsky@chromium.org>]

On (26/05/12 14:48), Andrew Morton wrote:
> The patch titled
>      Subject: zsmalloc: zero-initialize zspage memory to prevent KMSAN uninit reads
> has been added to the -mm mm-hotfixes-unstable branch.  Its filename is
>      zsmalloc-zero-initialize-zspage-memory-to-prevent-kmsan-uninit-reads.patch
> 
> This patch will shortly appear at
>      https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/zsmalloc-zero-initialize-zspage-memory-to-prevent-kmsan-uninit-reads.patch
> 
> This patch will later appear in the mm-hotfixes-unstable branch at
>     git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> 
> Before you just go and hit "reply", please:
>    a) Consider who else should be cc'ed
>    b) Prefer to cc a suitable mailing list as well
>    c) Ideally: find the original patch on the mailing list and do a
>       reply-to-all to that, adding suitable additional cc's
> 
> *** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
> 
> The -mm tree is included into linux-next via various
> branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> and is updated there most days
> 
> ------------------------------------------------------
> From: Kartik Nair <contact.kartikn@gmail.com>
> Subject: zsmalloc: zero-initialize zspage memory to prevent KMSAN uninit reads
> Date: Tue, 12 May 2026 03:06:58 +0530
> 
> Pages allocated via alloc_zpdesc() use alloc_pages_node() without
> __GFP_ZERO, leaving physical memory uninitialized.  When a compressed
> object spans two physical pages in a zspage, zs_obj_read_sg_begin() sets
> up a scatterlist pointing directly at the raw second page.  If the second
> page was freshly allocated and never written beyond the object boundary,
> KMSAN detects reads of uninitialized memory downstream in the decompressor
> (e.g.  sw842_decompress reading the CRC trailer).
> 
> Fix this by passing __GFP_ZERO to alloc_zpdesc() in alloc_zspage() so
> all pages backing a zspage are zero-initialized at allocation time.

This is very unlikely to fix anything, we should not have out-of-bounds
reads in the first place.