syzbot


KMSAN: uninit-value in __folio_cancel_dirty

Status: moderation: reported on 2025/05/08 02:28
Subsystems: fs mm
[Documentation on labels]
Reported-by: syzbot+3bd1e5b3f5e4ae82f527@syzkaller.appspotmail.com
First crash: 4d12h, last: 4d12h

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in mapping_can_writeback include/linux/backing-dev.h:148 [inline]
BUG: KMSAN: uninit-value in __folio_cancel_dirty+0x300/0x3e0 mm/page-writeback.c:2919
 mapping_can_writeback include/linux/backing-dev.h:148 [inline]
 __folio_cancel_dirty+0x300/0x3e0 mm/page-writeback.c:2919
 folio_cancel_dirty include/linux/pagemap.h:1236 [inline]
 truncate_cleanup_folio+0x46c/0x4b0 mm/truncate.c:167
 truncate_inode_folio+0x6f/0xa0 mm/truncate.c:175
 shmem_undo_range+0x4f2/0x2060 mm/shmem.c:1121
 shmem_truncate_range mm/shmem.c:1237 [inline]
 shmem_evict_inode+0x232/0xed0 mm/shmem.c:1365
 evict+0x6fd/0xd00 fs/inode.c:810
 iput_final fs/inode.c:1898 [inline]
 iput+0x996/0xdd0 fs/inode.c:1924
 dentry_unlink_inode+0x5ce/0x6d0 fs/dcache.c:457
 __dentry_kill+0x340/0xbf0 fs/dcache.c:660
 dput+0xdd/0x240 fs/dcache.c:902
 __fput+0xb0a/0x1040 fs/file_table.c:473
 fput_close_sync+0x1e4/0x290 fs/file_table.c:570
 __do_sys_close fs/open.c:1581 [inline]
 __se_sys_close fs/open.c:1566 [inline]
 __ia32_sys_close+0xf0/0x2c0 fs/open.c:1566
 ia32_sys_call+0x3106/0x42c0 arch/x86/include/generated/asm/syscalls_32.h:7
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/syscall_32.c:306
 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331
 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e

Uninit was created at:
 __netns_tracker_alloc include/net/net_namespace.h:357 [inline]
 sk_alloc+0x5de/0x8a0 net/core/sock.c:2270
 __netlink_create net/netlink/af_netlink.c:629 [inline]
 __netlink_kernel_create+0x19b/0xcc0 net/netlink/af_netlink.c:2007
 netlink_kernel_create include/linux/netlink.h:62 [inline]
 iscsi_transport_init+0x355/0x5b0 drivers/scsi/scsi_transport_iscsi.c:4982
 do_one_initcall+0x234/0xb60 init/main.c:1257
 do_initcall_level+0x166/0x380 init/main.c:1319
 do_initcalls+0x1b5/0x350 init/main.c:1335
 do_basic_setup+0x22/0x30 init/main.c:1354
 kernel_init_freeable+0x2fe/0x4d0 init/main.c:1567
 kernel_init+0x2f/0x5e0 init/main.c:1457
 ret_from_fork+0x6e/0x90 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

CPU: 1 UID: 0 PID: 30136 Comm: syz.9.7839 Tainted: G        W           6.15.0-rc3-syzkaller-00094-g02ddfb981de8 #0 PREEMPT(undef) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/05/04 02:26 upstream 02ddfb981de8 b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-386-root KMSAN: uninit-value in __folio_cancel_dirty
* Struck through repros no longer work on HEAD.