linux-kernel - Re: [syzbot] [fs?] [mm?] KMSAN: uninit-value in ondemand

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20230226123814.1d9afb8c3de438155593c378@linux-foundation.org>
Date:   Sun, 26 Feb 2023 12:38:14 -0800
From:   Andrew Morton <akpm@...ux-foundation.org>
To:     syzbot <syzbot+8ce7f8308d91e6b8bbe2@...kaller.appspotmail.com>
Cc:     glider@...gle.com, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-mm@...ck.org,
        syzkaller-bugs@...glegroups.com, willy@...radead.org,
        Nicolas Pitre <nico@...xnic.net>
Subject: Re: [syzbot] [fs?] [mm?] KMSAN: uninit-value in ondemand_readahead

On Fri, 24 Feb 2023 00:32:50 -0800 syzbot <syzbot+8ce7f8308d91e6b8bbe2@...kaller.appspotmail.com> wrote:

> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    97e36f4aa06f Revert "sched/core: kmsan: do not instrument ..
> git tree:       https://github.com/google/kmsan.git master
> console output: https://syzkaller.appspot.com/x/log.txt?x=10e46944c80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=46c642641b9ef616
> dashboard link: https://syzkaller.appspot.com/bug?extid=8ce7f8308d91e6b8bbe2
> compiler:       Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> userspace arch: i386
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=143b8650c80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15a22f2cc80000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/9931a9627dc6/disk-97e36f4a.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/1aafdb2fd6dc/vmlinux-97e36f4a.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/90df5872c7ff/bzImage-97e36f4a.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/ea75a01297dd/mount_0.gz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+8ce7f8308d91e6b8bbe2@...kaller.appspotmail.com
> 
> loop0: detected capacity change from 0 to 16
> =====================================================
> BUG: KMSAN: uninit-value in ondemand_readahead+0xddf/0x1720 mm/readahead.c:596
>  ondemand_readahead+0xddf/0x1720 mm/readahead.c:596
>  page_cache_sync_ra+0x72b/0x760 mm/readahead.c:709
>  page_cache_sync_readahead include/linux/pagemap.h:1210 [inline]
>  cramfs_blkdev_read fs/cramfs/inode.c:217 [inline]
>  cramfs_read+0x611/0x1280 fs/cramfs/inode.c:278
>  cramfs_lookup+0x1b8/0x870 fs/cramfs/inode.c:767

Thanks.

file_ra_state_init() says "Assumes that the caller has memset *ra to
zero".  This should fix:


From: Andrew Morton <akpm@...ux-foundation.org>
Subject: fs/cramfs/inode.c: initialize file_ra_state
Date: Sun Feb 26 12:31:11 PM PST 2023

file_ra_state_init() assumes that the file_ra_state has been zeroed out. 
Fixes a KMSAN used-unintialized issue (at least).

Fixes: cf948cbc35e80 ("cramfs: read_mapping_page() is synchronous")
Reported-by: syzbot <syzbot+8ce7f8308d91e6b8bbe2@...kaller.appspotmail.com>
  Link: https://lkml.kernel.org/r/0000000000008f74e905f56df987@google.com
Cc: Matthew Wilcox <willy@...radead.org>
Cc: Nicolas Pitre <nico@...xnic.net>
Cc: <stable@...r.kernel.org>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
---


--- a/fs/cramfs/inode.c~a
+++ b/fs/cramfs/inode.c
@@ -183,7 +183,7 @@ static void *cramfs_blkdev_read(struct super_block *sb, unsigned int offset,
 				unsigned int len)
 {
 	struct address_space *mapping = sb->s_bdev->bd_inode->i_mapping;
-	struct file_ra_state ra;
+	struct file_ra_state ra = {};
 	struct page *pages[BLKS_PER_BUF];
 	unsigned i, blocknr, buffer;
 	unsigned long devsize;
_