From patchwork Thu Dec 22 12:30:15 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Potapenko X-Patchwork-Id: 9484795 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C3F98601D5 for ; Thu, 22 Dec 2016 12:31:25 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B0D5828179 for ; Thu, 22 Dec 2016 12:31:25 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A511E2842D; Thu, 22 Dec 2016 12:31:25 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 439DA2818E for ; Thu, 22 Dec 2016 12:31:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S938889AbcLVMbU (ORCPT ); Thu, 22 Dec 2016 07:31:20 -0500 Received: from mail-wm0-f43.google.com ([74.125.82.43]:33432 "EHLO mail-wm0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934641AbcLVMa6 (ORCPT ); Thu, 22 Dec 2016 07:30:58 -0500 Received: by mail-wm0-f43.google.com with SMTP id g23so8882717wme.0 for ; Thu, 22 Dec 2016 04:30:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=GTpoPZlLfC34dwjb8XGHOhX7YTDi4JxZ0OGweafmccc=; b=GizBU0v+e2bVNYhTva2grs++w+7xJ9uW3+s5i+PRvDiDszQlKhxueIROFPFLTssBd+ iPP50XcgpocYXtToXwswclNbvnm1cU/XdRS3kic3+sHRa/xmG2TiiaP1SBzPKZtj7XIO UxX83YXaWHtPQ800E8H3lA7avlUstyzCxa5jjBf8G277a6VdXdfGtKFqra+oz97hM7HN u3OvUz+mDLBtoEc8cF6Tt8+klLZP42xisqxsfI3k7LJXaqghzqYOC3J2lR58TowZI0WK eOJ9Zpv4UPx0aOlLbDfIWqZ3XiqFOFSZIfWohjZWlxZIGRgh9LPLI98aIaAl1x6/cJjG oO8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=GTpoPZlLfC34dwjb8XGHOhX7YTDi4JxZ0OGweafmccc=; b=uflL8zzZXYwGXJVzSsyFvibu0jmPVtvBjbfyIUTT817kDfn5r2GPU0STlIw5WYlDjU gJBdsjyUBbZ4tsS+IPlLSkCox6MymG0w4PQaldoVs5IXWXr2QETZHfkIiopjtp7kCmUm SIQqaY3l5QXx1ckqN4OQ89D2wRvkK1/SOTiAk5oZ9Eddfwk5Mkal2ePPqvCQEmJYVldp owfhXNjMDGp2YOpui4wyD2zsf2odMkbB+q7me+LKJBaPp2yc0GC8idzqkB75VhvmlLPx ulR8CLxqCdxk+VYWZsGAEfOrSo181uPGkizpourusaD/QJMNgqKpzchJ3IPe9/Daga0A OQgg== X-Gm-Message-State: AIkVDXLbn/DI88cHOHicNNgn2WgzNac7prPO0A/3DAwBwS6+fot9MU+z/PbBZGgIEpli0qQ2 X-Received: by 10.28.97.139 with SMTP id v133mr11059417wmb.117.1482409823008; Thu, 22 Dec 2016 04:30:23 -0800 (PST) Received: from glider0.muc.corp.google.com ([100.105.28.21]) by smtp.gmail.com with ESMTPSA id lr10sm4029018wjb.6.2016.12.22.04.30.22 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 22 Dec 2016 04:30:22 -0800 (PST) From: Alexander Potapenko To: dvyukov@google.com, kcc@google.com, tytso@mit.edu, viro@zeniv.linux.org.uk Cc: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org Subject: [PATCH] fs: Initialize tmp.b_page in generic_block_bmap() Date: Thu, 22 Dec 2016 13:30:15 +0100 Message-Id: <1482409815-89034-1-git-send-email-glider@google.com> X-Mailer: git-send-email 2.8.0.rc3.226.g39d4020 Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP KMSAN (KernelMemorySanitizer, a new error detection tool) reports use of uninitialized memory in ext4_update_bh_state(): ================================================================== BUG: KMSAN: use of unitialized memory CPU: 3 PID: 1 Comm: swapper/0 Tainted: G B 4.8.0-rc6+ #597 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 0000000000000282 ffff88003cc96f68 ffffffff81f30856 0000003000000008 ffff88003cc96f78 0000000000000096 ffffffff8169742a ffff88003cc96ff8 ffffffff812fc1fc 0000000000000008 ffff88003a1980e8 0000000100000000 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [] dump_stack+0xa6/0xc0 lib/dump_stack.c:51 [] kmsan_report+0x1ec/0x300 mm/kmsan/kmsan.c:? [] __msan_warning+0x2b/0x40 ??:? [< inline >] ext4_update_bh_state fs/ext4/inode.c:727 [] _ext4_get_block+0x6ca/0x8a0 fs/ext4/inode.c:759 [] ext4_get_block+0x8c/0xa0 fs/ext4/inode.c:769 [] generic_block_bmap+0x246/0x2b0 fs/buffer.c:2991 [] ext4_bmap+0x5ee/0x660 fs/ext4/inode.c:3177 ... origin description: ----tmp@generic_block_bmap ================================================================== (the line numbers are relative to 4.8-rc6, but the bug persists upstream) The local |tmp| is created in generic_block_bmap() and then passed into ext4_bmap() => ext4_get_block() => _ext4_get_block() => ext4_update_bh_state(). Along the way tmp.b_page is never initialized before ext4_update_bh_state() checks its value. Signed-off-by: Alexander Potapenko --- fs/buffer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/buffer.c b/fs/buffer.c index d21771f..3fb104e 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -3029,6 +3029,7 @@ sector_t generic_block_bmap(struct address_space *mapping, sector_t block, tmp.b_state = 0; tmp.b_blocknr = 0; tmp.b_size = 1 << inode->i_blkbits; + tmp.b_page = NULL; get_block(inode, block, &tmp, 0); return tmp.b_blocknr; }