Re: [syzbot] [fs?] [mm?] KMSAN: uninit-value in ondemand_readahead

[Andrew Morton]

On Fri, 24 Feb 2023 00:32:50 -0800 syzbot <syzbot+8ce7f8308d91e6b8bbe2@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    97e36f4aa06f Revert "sched/core: kmsan: do not instrument ..
> git tree:       https://github.com/google/kmsan.git master
> console output: https://syzkaller.appspot.com/x/log.txt?x=10e46944c80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=46c642641b9ef616
> dashboard link: https://syzkaller.appspot.com/bug?extid=8ce7f8308d91e6b8bbe2
> compiler:       Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> userspace arch: i386
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=143b8650c80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15a22f2cc80000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/9931a9627dc6/disk-97e36f4a.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/1aafdb2fd6dc/vmlinux-97e36f4a.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/90df5872c7ff/bzImage-97e36f4a.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/ea75a01297dd/mount_0.gz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+8ce7f8308d91e6b8bbe2@xxxxxxxxxxxxxxxxxxxxxxxxx
> 
> loop0: detected capacity change from 0 to 16
> =====================================================
> BUG: KMSAN: uninit-value in ondemand_readahead+0xddf/0x1720 mm/readahead.c:596
>  ondemand_readahead+0xddf/0x1720 mm/readahead.c:596
>  page_cache_sync_ra+0x72b/0x760 mm/readahead.c:709
>  page_cache_sync_readahead include/linux/pagemap.h:1210 [inline]
>  cramfs_blkdev_read fs/cramfs/inode.c:217 [inline]
>  cramfs_read+0x611/0x1280 fs/cramfs/inode.c:278
>  cramfs_lookup+0x1b8/0x870 fs/cramfs/inode.c:767

Thanks.

file_ra_state_init() says "Assumes that the caller has memset *ra to
zero".  This should fix:


From: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Subject: fs/cramfs/inode.c: initialize file_ra_state
Date: Sun Feb 26 12:31:11 PM PST 2023

file_ra_state_init() assumes that the file_ra_state has been zeroed out. 
Fixes a KMSAN used-unintialized issue (at least).

Fixes: cf948cbc35e80 ("cramfs: read_mapping_page() is synchronous")
Reported-by: syzbot <syzbot+8ce7f8308d91e6b8bbe2@xxxxxxxxxxxxxxxxxxxxxxxxx>
  Link: https://lkml.kernel.org/r/0000000000008f74e905f56df987@xxxxxxxxxx
Cc: Matthew Wilcox <willy@xxxxxxxxxxxxx>
Cc: Nicolas Pitre <nico@xxxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---


--- a/fs/cramfs/inode.c~a
+++ b/fs/cramfs/inode.c
@@ -183,7 +183,7 @@ static void *cramfs_blkdev_read(struct super_block *sb, unsigned int offset,
 				unsigned int len)
 {
 	struct address_space *mapping = sb->s_bdev->bd_inode->i_mapping;
-	struct file_ra_state ra;
+	struct file_ra_state ra = {};
 	struct page *pages[BLKS_PER_BUF];
 	unsigned i, blocknr, buffer;
 	unsigned long devsize;
_