syzbot


KMSAN: uninit-value in xfs_dialloc_ag_inobt

Status: upstream: reported on 2025/04/24 02:02
Subsystems: xfs
[Documentation on labels]
Reported-by: syzbot+b4a84825ea149bb99bfc@syzkaller.appspotmail.com
First crash: 4d13h, last: 4d13h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [xfs?] KMSAN: uninit-value in xfs_dialloc_ag_inobt 1 (2) 2025/04/24 08:59

Sample crash report:
=====================================================
BUG: KMSAN: uninit-value in xfs_dialloc_ag_inobt+0x99b/0x2550 fs/xfs/libxfs/xfs_ialloc.c:1173
 xfs_dialloc_ag_inobt+0x99b/0x2550 fs/xfs/libxfs/xfs_ialloc.c:1173
 xfs_dialloc_ag fs/xfs/libxfs/xfs_ialloc.c:1585 [inline]
 xfs_dialloc_try_ag fs/xfs/libxfs/xfs_ialloc.c:1835 [inline]
 xfs_dialloc+0x14c4/0x3470 fs/xfs/libxfs/xfs_ialloc.c:1945
 xfs_create_tmpfile+0x496/0x12c0 fs/xfs/xfs_inode.c:827
 xfs_generic_create+0x65c/0x1610 fs/xfs/xfs_iops.c:227
 xfs_vn_tmpfile+0x6b/0x140 fs/xfs/xfs_iops.c:1194
 vfs_tmpfile+0x5e4/0xe40 fs/namei.c:3896
 do_tmpfile+0x19d/0x460 fs/namei.c:3961
 path_openat+0x4837/0x6280 fs/namei.c:3995
 do_filp_open+0x26b/0x610 fs/namei.c:4031
 io_openat2+0x5d5/0xa50 io_uring/openclose.c:140
 io_openat+0x35/0x40 io_uring/openclose.c:177
 __io_issue_sqe io_uring/io_uring.c:1734 [inline]
 io_issue_sqe+0x394/0x1de0 io_uring/io_uring.c:1753
 io_wq_submit_work+0xaf8/0xde0 io_uring/io_uring.c:1868
 io_worker_handle_work+0xc4d/0x2090 io_uring/io-wq.c:615
 io_wq_worker+0x403/0x1470 io_uring/io-wq.c:669
 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Uninit was stored to memory at:
 xfs_dialloc_ag_inobt+0x1cc1/0x2550 fs/xfs/libxfs/xfs_ialloc.c:1227
 xfs_dialloc_ag fs/xfs/libxfs/xfs_ialloc.c:1585 [inline]
 xfs_dialloc_try_ag fs/xfs/libxfs/xfs_ialloc.c:1835 [inline]
 xfs_dialloc+0x14c4/0x3470 fs/xfs/libxfs/xfs_ialloc.c:1945
 xfs_create_tmpfile+0x496/0x12c0 fs/xfs/xfs_inode.c:827
 xfs_generic_create+0x65c/0x1610 fs/xfs/xfs_iops.c:227
 xfs_vn_tmpfile+0x6b/0x140 fs/xfs/xfs_iops.c:1194
 vfs_tmpfile+0x5e4/0xe40 fs/namei.c:3896
 do_tmpfile+0x19d/0x460 fs/namei.c:3961
 path_openat+0x4837/0x6280 fs/namei.c:3995
 do_filp_open+0x26b/0x610 fs/namei.c:4031
 io_openat2+0x5d5/0xa50 io_uring/openclose.c:140
 io_openat+0x35/0x40 io_uring/openclose.c:177
 __io_issue_sqe io_uring/io_uring.c:1734 [inline]
 io_issue_sqe+0x394/0x1de0 io_uring/io_uring.c:1753
 io_wq_submit_work+0xaf8/0xde0 io_uring/io_uring.c:1868
 io_worker_handle_work+0xc4d/0x2090 io_uring/io-wq.c:615
 io_wq_worker+0x403/0x1470 io_uring/io-wq.c:669
 ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Local variable trec created at:
 xfs_dialloc_ag_inobt+0x139/0x2550 fs/xfs/libxfs/xfs_ialloc.c:1101
 xfs_dialloc_ag fs/xfs/libxfs/xfs_ialloc.c:1585 [inline]
 xfs_dialloc_try_ag fs/xfs/libxfs/xfs_ialloc.c:1835 [inline]
 xfs_dialloc+0x14c4/0x3470 fs/xfs/libxfs/xfs_ialloc.c:1945

CPU: 1 UID: 0 PID: 7854 Comm: iou-wrk-7829 Not tainted 6.15.0-rc2-syzkaller-00404-g8560697b23dc #0 PREEMPT(undef) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
=====================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/20 01:51 upstream 8560697b23dc 2a20f901 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in xfs_dialloc_ag_inobt
* Struck through repros no longer work on HEAD.