[syzbot] [gfs2?] KMSAN: uninit-value in inode_go_dump (5)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: ad46e8f95e93 Merge tag 'pm-6.12-rc1-2' of git://git.kernel..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=17908d9f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=85d8f50d88ddf2a
dashboard link: https://syzkaller.appspot.com/bug?extid=aa0730b0a42646eb1359
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10508d9f980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=103a9e80580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/265feec46ffa/disk-ad46e8f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d0f41ea693d3/vmlinux-ad46e8f9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/45082d33d192/bzImage-ad46e8f9.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/fcd037c3d108/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+aa0730...@syzkaller.appspotmail.com

gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz"
gfs2: fsid=syz:syz: Now mounting FS (format 1801)...
gfs2: fsid=syz:syz.0: fatal: filesystem consistency error - inode = 1 19, function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 399
gfs2: fsid=syz:syz.0: G: s:SH n:2/13 f:aqobnN t:SH d:EX/0 a:0 v:0 r:2 m:20 p:1
gfs2: fsid=syz:syz.0: H: s:SH f:eEcH e:0 p:0 [(none)] init_inodes+0x125/0x510 fs/gfs2/ops_fstype.c:864
=====================================================
BUG: KMSAN: uninit-value in inode_go_dump+0x475/0x4b0 fs/gfs2/glops.c:541
inode_go_dump+0x475/0x4b0 fs/gfs2/glops.c:541
gfs2_dump_glock+0x221c/0x2340 fs/gfs2/glock.c:2436
gfs2_consist_inode_i+0x19f/0x230 fs/gfs2/util.c:457
gfs2_inode_refresh+0x12d7/0x1590 fs/gfs2/glops.c:482
inode_go_instantiate+0x6e/0xc0 fs/gfs2/glops.c:501
gfs2_instantiate+0x272/0x4c0 fs/gfs2/glock.c:468
gfs2_glock_holder_ready fs/gfs2/glock.c:1345 [inline]
gfs2_glock_wait+0x2a4/0x3e0 fs/gfs2/glock.c:1365
gfs2_glock_nq+0x2777/0x34b0 fs/gfs2/glock.c:1622
gfs2_glock_nq_init fs/gfs2/glock.h:238 [inline]
init_journal+0x12cc/0x3a40 fs/gfs2/ops_fstype.c:770
init_inodes+0x125/0x510 fs/gfs2/ops_fstype.c:864
gfs2_fill_super+0x3a8b/0x45a0 fs/gfs2/ops_fstype.c:1249
get_tree_bdev+0x684/0x890 fs/super.c:1635
gfs2_get_tree+0x5c/0x340 fs/gfs2/ops_fstype.c:1330
vfs_get_tree+0xb1/0x5a0 fs/super.c:1800
do_new_mount+0x71f/0x15e0 fs/namespace.c:3507
path_mount+0x742/0x1f10 fs/namespace.c:3834
do_mount fs/namespace.c:3847 [inline]
__do_sys_mount fs/namespace.c:4055 [inline]
__se_sys_mount+0x722/0x810 fs/namespace.c:4032
__x64_sys_mount+0xe4/0x150 fs/namespace.c:4032
x64_sys_call+0x255a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:166
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
__alloc_pages_noprof+0x9d6/0xe70 mm/page_alloc.c:4756
alloc_pages_mpol_noprof+0x299/0x990 mm/mempolicy.c:2265
alloc_pages_noprof+0x1bf/0x1e0 mm/mempolicy.c:2345
alloc_slab_page mm/slub.c:2413 [inline]
allocate_slab+0x33a/0x1250 mm/slub.c:2579
new_slab mm/slub.c:2632 [inline]
___slab_alloc+0x12ef/0x35e0 mm/slub.c:3819
__slab_alloc mm/slub.c:3909 [inline]
__slab_alloc_node mm/slub.c:3962 [inline]
slab_alloc_node mm/slub.c:4123 [inline]
kmem_cache_alloc_lru_noprof+0x584/0xb30 mm/slub.c:4154
gfs2_alloc_inode+0x66/0x210 fs/gfs2/super.c:1536
alloc_inode+0x86/0x460 fs/inode.c:263
iget5_locked+0xa9/0x1d0 fs/inode.c:1333
gfs2_inode_lookup+0xbe/0x1440 fs/gfs2/inode.c:124
gfs2_lookup_root fs/gfs2/ops_fstype.c:440 [inline]
init_sb+0xd71/0x1780 fs/gfs2/ops_fstype.c:507
gfs2_fill_super+0x33f2/0x45a0 fs/gfs2/ops_fstype.c:1216
get_tree_bdev+0x684/0x890 fs/super.c:1635
gfs2_get_tree+0x5c/0x340 fs/gfs2/ops_fstype.c:1330
vfs_get_tree+0xb1/0x5a0 fs/super.c:1800
do_new_mount+0x71f/0x15e0 fs/namespace.c:3507
path_mount+0x742/0x1f10 fs/namespace.c:3834
do_mount fs/namespace.c:3847 [inline]
__do_sys_mount fs/namespace.c:4055 [inline]
__se_sys_mount+0x722/0x810 fs/namespace.c:4032
__x64_sys_mount+0xe4/0x150 fs/namespace.c:4032
x64_sys_call+0x255a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:166
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 5182 Comm: syz-executor574 Not tainted 6.11.0-syzkaller-11728-gad46e8f95e93 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Qianqiang Liu]

#syz test

diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index 6678060ed4d2..d60d53810bc1 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -1537,11 +1537,13 @@ static struct inode *gfs2_alloc_inode(struct super_block *sb)
if (!ip)
return NULL;
ip->i_no_addr = 0;
+ ip->i_no_formal_ino = 0;
ip->i_flags = 0;
ip->i_gl = NULL;
gfs2_holder_mark_uninitialized(&ip->i_iopen_gh);
memset(&ip->i_res, 0, sizeof(ip->i_res));
RB_CLEAR_NODE(&ip->i_res.rs_node);
+ ip->i_diskflags = 0;
ip->i_rahead = 0;
return &ip->i_inode;
}

--
Best,
Qianqiang Liu

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+aa0730...@syzkaller.appspotmail.com
Tested-by: syzbot+aa0730...@syzkaller.appspotmail.com

Tested on:

commit: 27cc6fdf Merge tag 'linux_kselftest-fixes-6.12-rc2' of..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11923307980000
kernel config: https://syzkaller.appspot.com/x/.config?x=2cf7bb3f15c72e66

dashboard link: https://syzkaller.appspot.com/bug?extid=aa0730b0a42646eb1359
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=16bc7bd0580000

Note: testing is done by a robot and is best-effort only.

[Andreas Gruenbacher]

Added to for-next.

Thanks,
Andreas