linux-kernel - Re: [syzbot] Re: KMSAN: uninit-value in ocfs2_file_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6720c41e.050a0220.11b624.04bf.GAE@google.com>
Date: Tue, 29 Oct 2024 04:16:46 -0700
From: syzbot <syzbot+a73e253cca4f0230a5a5@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] Re: KMSAN: uninit-value in ocfs2_file_read_iter

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: Re: KMSAN: uninit-value in ocfs2_file_read_iter
Author: dmantipov@...dex.ru

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git e42b1a9a2557aa94fee47f078633677198386a52

diff --git a/fs/ocfs2/aops.h b/fs/ocfs2/aops.h
index 45db1781ea73..1d1b4b7edba0 100644
--- a/fs/ocfs2/aops.h
+++ b/fs/ocfs2/aops.h
@@ -70,6 +70,8 @@ enum ocfs2_iocb_lock_bits {
  	OCFS2_IOCB_NUM_LOCKS
  };

+#define ocfs2_iocb_init_rw_locked(iocb) \
+	(iocb->private = NULL)
  #define ocfs2_iocb_clear_rw_locked(iocb) \
  	clear_bit(OCFS2_IOCB_RW_LOCK, (unsigned long *)&iocb->private)
  #define ocfs2_iocb_rw_locked_level(iocb) \
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 58887456e3c5..1e37176ac405 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -2390,6 +2390,8 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb,
  	} else
  		inode_lock(inode);

+	ocfs2_iocb_init_rw_locked(iocb);
+
  	/*
  	 * Concurrent O_DIRECT writes are allowed with
  	 * mount_option "coherency=buffered".
@@ -2536,6 +2538,8 @@ static ssize_t ocfs2_file_read_iter(struct kiocb *iocb,
  	if (!direct_io && nowait)
  		return -EOPNOTSUPP;

+	ocfs2_iocb_init_rw_locked(iocb);
+
  	/*
  	 * buffered reads protect themselves in ->read_folio().  O_DIRECT reads
  	 * need locks to protect pending reads from racing with truncate.