[syzbot] KMSAN: uninit-value in ondemand_readahead

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 8f4ae27df775 Revert "Revert "crypto: kmsan: disable accele..
git tree: https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=10b5e0f8880000
kernel config: https://syzkaller.appspot.com/x/.config?x=121c7ef28ec597bd
dashboard link: https://syzkaller.appspot.com/bug?extid=8ce7f8308d91e6b8bbe2
compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project.git 610139d2d9ce6746b3c617fb3e2f7886272d26ff), GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: i386

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/4cf4e5a58eb8/disk-8f4ae27d.raw.xz
vmlinux: https://storage.googleapis.com/82e5fbbe1600/vmlinux-8f4ae27d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8ce7f8...@syzkaller.appspotmail.com

=====================================================
BUG: KMSAN: uninit-value in ondemand_readahead+0x9de/0x1930 mm/readahead.c:586
ondemand_readahead+0x9de/0x1930 mm/readahead.c:586
page_cache_sync_ra+0x733/0x770 mm/readahead.c:699
page_cache_sync_readahead include/linux/pagemap.h:1215 [inline]
cramfs_blkdev_read+0x5fb/0x12b0 fs/cramfs/inode.c:217
cramfs_read fs/cramfs/inode.c:278 [inline]
cramfs_read_folio+0x21e/0x11e0 fs/cramfs/inode.c:827
read_pages+0x1217/0x16b0 mm/readahead.c:178
page_cache_ra_unbounded+0x7bf/0x880 mm/readahead.c:263
do_page_cache_ra mm/readahead.c:293 [inline]
page_cache_ra_order+0xf50/0x1000 mm/readahead.c:550
ondemand_readahead+0x10f3/0x1930 mm/readahead.c:672
page_cache_sync_ra+0x733/0x770 mm/readahead.c:699
page_cache_sync_readahead include/linux/pagemap.h:1215 [inline]
filemap_get_pages mm/filemap.c:2566 [inline]
filemap_read+0xa07/0x3f80 mm/filemap.c:2660
generic_file_read_iter+0x128/0xaa0 mm/filemap.c:2806
__kernel_read+0x3c1/0xaa0 fs/read_write.c:428
integrity_kernel_read+0x80/0xb0 security/integrity/iint.c:199
ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:485 [inline]
ima_calc_file_shash security/integrity/ima/ima_crypto.c:516 [inline]
ima_calc_file_hash+0x18b6/0x3e30 security/integrity/ima/ima_crypto.c:573
ima_collect_measurement+0x42f/0xb50 security/integrity/ima/ima_api.c:292
process_measurement+0x208a/0x3680 security/integrity/ima/ima_main.c:337
ima_file_check+0xbc/0x120 security/integrity/ima/ima_main.c:517
do_open fs/namei.c:3559 [inline]
path_openat+0x497c/0x5600 fs/namei.c:3691
do_filp_open+0x249/0x660 fs/namei.c:3718
do_sys_openat2+0x1f0/0x910 fs/open.c:1311
do_sys_open fs/open.c:1327 [inline]
__do_compat_sys_openat fs/open.c:1387 [inline]
__se_compat_sys_openat fs/open.c:1385 [inline]
__ia32_compat_sys_openat+0x2a7/0x330 fs/open.c:1385
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82

Local variable ra created at:
cramfs_blkdev_read+0xbe/0x12b0 fs/cramfs/inode.c:186
cramfs_read fs/cramfs/inode.c:278 [inline]
cramfs_read_folio+0x21e/0x11e0 fs/cramfs/inode.c:827

CPU: 0 PID: 4115 Comm: syz-executor.2 Not tainted 6.0.0-rc5-syzkaller-48538-g8f4ae27df775 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 97e36f4aa06f Revert "sched/core: kmsan: do not instrument ..

git tree: https://github.com/google/kmsan.git master

console output: https://syzkaller.appspot.com/x/log.txt?x=10e46944c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=46c642641b9ef616
dashboard link: https://syzkaller.appspot.com/bug?extid=8ce7f8308d91e6b8bbe2
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=143b8650c80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15a22f2cc80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9931a9627dc6/disk-97e36f4a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1aafdb2fd6dc/vmlinux-97e36f4a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/90df5872c7ff/bzImage-97e36f4a.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/ea75a01297dd/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8ce7f8...@syzkaller.appspotmail.com

loop0: detected capacity change from 0 to 16
=====================================================
BUG: KMSAN: uninit-value in ondemand_readahead+0xddf/0x1720 mm/readahead.c:596
ondemand_readahead+0xddf/0x1720 mm/readahead.c:596
page_cache_sync_ra+0x72b/0x760 mm/readahead.c:709
page_cache_sync_readahead include/linux/pagemap.h:1210 [inline]
cramfs_blkdev_read fs/cramfs/inode.c:217 [inline]
cramfs_read+0x611/0x1280 fs/cramfs/inode.c:278
cramfs_lookup+0x1b8/0x870 fs/cramfs/inode.c:767
__lookup_slow+0x528/0x730 fs/namei.c:1685
lookup_slow+0x6a/0xc0 fs/namei.c:1702
walk_component fs/namei.c:1993 [inline]
link_path_walk+0xe9a/0x1620 fs/namei.c:2320
path_openat+0x333/0x5750 fs/namei.c:3710
do_filp_open+0x24d/0x660 fs/namei.c:3741
do_sys_openat2+0x1f0/0x910 fs/open.c:1310
do_sys_open fs/open.c:1326 [inline]
__do_compat_sys_openat fs/open.c:1386 [inline]
__se_compat_sys_openat fs/open.c:1384 [inline]
__ia32_compat_sys_openat+0x2ab/0x330 fs/open.c:1384

do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178

do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82

Local variable ra.i created at:
cramfs_blkdev_read fs/cramfs/inode.c:186 [inline]
cramfs_read+0xc0/0x1280 fs/cramfs/inode.c:278
cramfs_lookup+0x1b8/0x870 fs/cramfs/inode.c:767

CPU: 1 PID: 5017 Comm: syz-executor948 Not tainted 6.2.0-syzkaller-81152-g97e36f4aa06f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
=====================================================

[Andrew Morton]

Thanks.

file_ra_state_init() says "Assumes that the caller has memset *ra to
zero". This should fix:


From: Andrew Morton <ak...@linux-foundation.org>
Subject: fs/cramfs/inode.c: initialize file_ra_state
Date: Sun Feb 26 12:31:11 PM PST 2023

file_ra_state_init() assumes that the file_ra_state has been zeroed out.
Fixes a KMSAN used-unintialized issue (at least).

Fixes: cf948cbc35e80 ("cramfs: read_mapping_page() is synchronous")
Reported-by: syzbot <syzbot+8ce7f8...@syzkaller.appspotmail.com>
Link: https://lkml.kernel.org/r/0000000000008f...@google.com
Cc: Matthew Wilcox <wi...@infradead.org>
Cc: Nicolas Pitre <ni...@fluxnic.net>
Cc: <sta...@vger.kernel.org>
Signed-off-by: Andrew Morton <ak...@linux-foundation.org>
---


--- a/fs/cramfs/inode.c~a
+++ b/fs/cramfs/inode.c
@@ -183,7 +183,7 @@ static void *cramfs_blkdev_read(struct super_block *sb, unsigned int offset,
unsigned int len)
{
struct address_space *mapping = sb->s_bdev->bd_inode->i_mapping;
- struct file_ra_state ra;
+ struct file_ra_state ra = {};
struct page *pages[BLKS_PER_BUF];
unsigned i, blocknr, buffer;
unsigned long devsize;
_