From: Pedro Falcato <pfalcato@suse.de>
To: Barry Song <21cnbao@gmail.com>
Cc: syzbot <syzbot+178fff6149127421c2cc@syzkaller.appspotmail.com>,
Baolin Wang <baolin.wang@linux.alibaba.com>,
Hugh Dickins <hughd@google.com>,
akpm@linux-foundation.org, bhe@redhat.com, chrisl@kernel.org,
kasong@tencent.com, linux-kernel@vger.kernel.org,
linux-mm@kvack.org, nphamcs@gmail.com, shikemeng@huaweicloud.com,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [mm?] KMSAN: uninit-value in swap_writeout
Date: Tue, 23 Dec 2025 23:43:32 +0000 [thread overview]
Message-ID: <7ng6tntadu62ls32r54aetyevgbghta4oufyzxtq5ym6bprjai@hc2ozb2mbcyb> (raw)
In-Reply-To: <CAGsJ_4w3FQXS4YvRjfjRQrzjjVT3Z7WtvQLJdy76k-yBZ2es6A@mail.gmail.com>
On Wed, Dec 24, 2025 at 11:46:44AM +1300, Barry Song wrote:
> >
> > Uninit was created at:
> > __alloc_frozen_pages_noprof+0x421/0xab0 mm/page_alloc.c:5233
> > alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2486
> > folio_alloc_mpol_noprof+0x56/0x1d0 mm/mempolicy.c:2505
> > shmem_alloc_folio mm/shmem.c:1890 [inline]
> > shmem_alloc_and_add_folio+0xc56/0x1bd0 mm/shmem.c:1932
> > shmem_get_folio_gfp+0xad3/0x1fc0 mm/shmem.c:2556
> > shmem_get_folio mm/shmem.c:2662 [inline]
> > shmem_symlink+0x562/0xad0 mm/shmem.c:4129
> > vfs_symlink+0x42f/0x4c0 fs/namei.c:5514
> > do_symlinkat+0x2ae/0xbb0 fs/namei.c:5541
>
> +Hugh and Baolin.
>
> This happens in the shmem symlink path, where newly allocated
> folios are not cleared for some reason. As a result,
> is_folio_zero_filled() ends up reading uninitialized data.
>
I'm not Hugh nor Baolin, but I would guess that letting
is_folio_zero_filled() skip/disable KMSAN would also work. Since all we want
is to skip writeout if the folio is zero, whether it is incidentally zero, or not,
does not really matter, I think.
--
Pedro
next prev parent reply other threads:[~2025-12-23 23:43 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-22 12:18 syzbot
2025-12-23 22:46 ` Barry Song
2025-12-23 23:43 ` Pedro Falcato [this message]
2025-12-24 0:16 ` Barry Song
2025-12-24 1:43 ` Baolin Wang
2025-12-24 2:04 ` Barry Song
2025-12-24 3:53 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7ng6tntadu62ls32r54aetyevgbghta4oufyzxtq5ym6bprjai@hc2ozb2mbcyb \
--to=pfalcato@suse.de \
--cc=21cnbao@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=baolin.wang@linux.alibaba.com \
--cc=bhe@redhat.com \
--cc=chrisl@kernel.org \
--cc=hughd@google.com \
--cc=kasong@tencent.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=nphamcs@gmail.com \
--cc=shikemeng@huaweicloud.com \
--cc=syzbot+178fff6149127421c2cc@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox