On Fri, 24 Feb 2023 00:32:50 -0800 syzbot <syzbot+8ce7f8308d91e6b8bbe2@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote: > syzbot has found a reproducer for the following issue on: > > HEAD commit: 97e36f4aa06f Revert "sched/core: kmsan: do not instrument .. > git tree: https://github.com/google/kmsan.git master > console output: https://syzkaller.appspot.com/x/log.txt?x=10e46944c80000 > kernel config: https://syzkaller.appspot.com/x/.config?x=46c642641b9ef616 > dashboard link: https://syzkaller.appspot.com/bug?extid=8ce7f8308d91e6b8bbe2 > compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2 > userspace arch: i386 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=143b8650c80000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15a22f2cc80000 > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/9931a9627dc6/disk-97e36f4a.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/1aafdb2fd6dc/vmlinux-97e36f4a.xz > kernel image: https://storage.googleapis.com/syzbot-assets/90df5872c7ff/bzImage-97e36f4a.xz > mounted in repro: https://storage.googleapis.com/syzbot-assets/ea75a01297dd/mount_0.gz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+8ce7f8308d91e6b8bbe2@xxxxxxxxxxxxxxxxxxxxxxxxx > > loop0: detected capacity change from 0 to 16 > ===================================================== > BUG: KMSAN: uninit-value in ondemand_readahead+0xddf/0x1720 mm/readahead.c:596 > ondemand_readahead+0xddf/0x1720 mm/readahead.c:596 > page_cache_sync_ra+0x72b/0x760 mm/readahead.c:709 > page_cache_sync_readahead include/linux/pagemap.h:1210 [inline] > cramfs_blkdev_read fs/cramfs/inode.c:217 [inline] > cramfs_read+0x611/0x1280 fs/cramfs/inode.c:278 > cramfs_lookup+0x1b8/0x870 fs/cramfs/inode.c:767 Thanks. file_ra_state_init() says "Assumes that the caller has memset *ra to zero". This should fix: From: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> Subject: fs/cramfs/inode.c: initialize file_ra_state Date: Sun Feb 26 12:31:11 PM PST 2023 file_ra_state_init() assumes that the file_ra_state has been zeroed out. Fixes a KMSAN used-unintialized issue (at least). Fixes: cf948cbc35e80 ("cramfs: read_mapping_page() is synchronous") Reported-by: syzbot <syzbot+8ce7f8308d91e6b8bbe2@xxxxxxxxxxxxxxxxxxxxxxxxx> Link: https://lkml.kernel.org/r/0000000000008f74e905f56df987@xxxxxxxxxx Cc: Matthew Wilcox <willy@xxxxxxxxxxxxx> Cc: Nicolas Pitre <nico@xxxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- --- a/fs/cramfs/inode.c~a +++ b/fs/cramfs/inode.c @@ -183,7 +183,7 @@ static void *cramfs_blkdev_read(struct super_block *sb, unsigned int offset, unsigned int len) { struct address_space *mapping = sb->s_bdev->bd_inode->i_mapping; - struct file_ra_state ra; + struct file_ra_state ra = {}; struct page *pages[BLKS_PER_BUF]; unsigned i, blocknr, buffer; unsigned long devsize; _
