linux-kernel - Re: [syzbot] [mm?] KMSAN: uninit-value in swap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGsJ_4w3FQXS4YvRjfjRQrzjjVT3Z7WtvQLJdy76k-yBZ2es6A@mail.gmail.com>
Date: Wed, 24 Dec 2025 11:46:44 +1300
From: Barry Song <21cnbao@...il.com>
To: syzbot <syzbot+178fff6149127421c2cc@...kaller.appspotmail.com>, 
	Baolin Wang <baolin.wang@...ux.alibaba.com>, Hugh Dickins <hughd@...gle.com>
Cc: akpm@...ux-foundation.org, bhe@...hat.com, chrisl@...nel.org, 
	kasong@...cent.com, linux-kernel@...r.kernel.org, linux-mm@...ck.org, 
	nphamcs@...il.com, shikemeng@...weicloud.com, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [mm?] KMSAN: uninit-value in swap_writeout

>
> Uninit was created at:
>  __alloc_frozen_pages_noprof+0x421/0xab0 mm/page_alloc.c:5233
>  alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2486
>  folio_alloc_mpol_noprof+0x56/0x1d0 mm/mempolicy.c:2505
>  shmem_alloc_folio mm/shmem.c:1890 [inline]
>  shmem_alloc_and_add_folio+0xc56/0x1bd0 mm/shmem.c:1932
>  shmem_get_folio_gfp+0xad3/0x1fc0 mm/shmem.c:2556
>  shmem_get_folio mm/shmem.c:2662 [inline]
>  shmem_symlink+0x562/0xad0 mm/shmem.c:4129
>  vfs_symlink+0x42f/0x4c0 fs/namei.c:5514
>  do_symlinkat+0x2ae/0xbb0 fs/namei.c:5541

+Hugh and Baolin.

This happens in the shmem symlink path, where newly allocated
folios are not cleared for some reason. As a result,
is_folio_zero_filled() ends up reading uninitialized data.

Clearing newly allocated folios in shmem_get_folio_gfp() would
fix the issue, but it may not be the proper solution. We will
need Hugh and Baolin’s guidance to recommend an appropriate fix.

>  __do_sys_symlinkat fs/namei.c:5562 [inline]
>  __se_sys_symlinkat fs/namei.c:5559 [inline]
>  __ia32_sys_symlinkat+0xf5/0x180 fs/namei.c:5559
>  ia32_sys_call+0x385e/0x4340 arch/x86/include/generated/asm/syscalls_32.h:305
>  do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
>  __do_fast_syscall_32+0x15a/0x330 arch/x86/entry/syscall_32.c:307
>  do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:332
>  do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:370
>  entry_SYSENTER_compat_after_hwframe+0x84/0x8e
>
> CPU: 0 UID: 0 PID: 7862 Comm: syz.2.517 Tainted: G             L      syzkaller #0 PREEMPT(none)
> Tainted: [L]=SOFTLOCKUP
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
> =====================================================

Thanks
Barry