| Message ID | 20241204060934.697070-1-dmantipov@yandex.ru (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [f2fs-dev] f2fs: ensure that node info flags are always initialized | expand |
On 2024/12/4 14:09, Dmitry Antipov wrote: > Syzbot has reported the following KMSAN splat: > > BUG: KMSAN: uninit-value in f2fs_new_node_page+0x1494/0x1630 > f2fs_new_node_page+0x1494/0x1630 > f2fs_new_inode_page+0xb9/0x100 > f2fs_init_inode_metadata+0x176/0x1e90 > f2fs_add_inline_entry+0x723/0xc90 > f2fs_do_add_link+0x48f/0xa70 > f2fs_symlink+0x6af/0xfc0 > vfs_symlink+0x1f1/0x470 > do_symlinkat+0x471/0xbc0 > __x64_sys_symlink+0xcf/0x140 > x64_sys_call+0x2fcc/0x3d90 > do_syscall_64+0xd9/0x1b0 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > Local variable new_ni created at: > f2fs_new_node_page+0x9d/0x1630 > f2fs_new_inode_page+0xb9/0x100 > > So adjust 'f2fs_new_node_page()' to ensure that 'flag' field of on-stack > 'struct node_info' is always zeroed just like if it was allocated within > 'struct nat_entry' via 'f2fs_kmem_cache_alloc(..., GFP_F2FS_ZERO, ...)' > in '__alloc_nat_entry()'. > > Reported-by: syzbot+5141f6db57a2f7614352@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=5141f6db57a2f7614352 > Fixes: e05df3b115e7 ("f2fs: add node operations") > Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> > --- > fs/f2fs/node.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c > index 0b900a7a48e5..5103cc0d95c4 100644 > --- a/fs/f2fs/node.c > +++ b/fs/f2fs/node.c > @@ -1314,7 +1314,7 @@ struct page *f2fs_new_inode_page(struct inode *inode) > struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs) > { > struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode); > - struct node_info new_ni; > + struct node_info new_ni = { .flag = 0 }; We can initialize new_ni.flag in f2fs_get_node_info() to cover all similar cases? Thanks, > struct page *page; > int err; >
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c index 0b900a7a48e5..5103cc0d95c4 100644 --- a/fs/f2fs/node.c +++ b/fs/f2fs/node.c @@ -1314,7 +1314,7 @@ struct page *f2fs_new_inode_page(struct inode *inode) struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs) { struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode); - struct node_info new_ni; + struct node_info new_ni = { .flag = 0 }; struct page *page; int err;
Syzbot has reported the following KMSAN splat: BUG: KMSAN: uninit-value in f2fs_new_node_page+0x1494/0x1630 f2fs_new_node_page+0x1494/0x1630 f2fs_new_inode_page+0xb9/0x100 f2fs_init_inode_metadata+0x176/0x1e90 f2fs_add_inline_entry+0x723/0xc90 f2fs_do_add_link+0x48f/0xa70 f2fs_symlink+0x6af/0xfc0 vfs_symlink+0x1f1/0x470 do_symlinkat+0x471/0xbc0 __x64_sys_symlink+0xcf/0x140 x64_sys_call+0x2fcc/0x3d90 do_syscall_64+0xd9/0x1b0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable new_ni created at: f2fs_new_node_page+0x9d/0x1630 f2fs_new_inode_page+0xb9/0x100 So adjust 'f2fs_new_node_page()' to ensure that 'flag' field of on-stack 'struct node_info' is always zeroed just like if it was allocated within 'struct nat_entry' via 'f2fs_kmem_cache_alloc(..., GFP_F2FS_ZERO, ...)' in '__alloc_nat_entry()'. Reported-by: syzbot+5141f6db57a2f7614352@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5141f6db57a2f7614352 Fixes: e05df3b115e7 ("f2fs: add node operations") Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> --- fs/f2fs/node.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)