[syzbot] [ntfs3?] KMSAN: uninit-value in attr_set_size

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 9b0d551bcc05 Merge tag 'pull-misc' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11da692f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=50fb29d81ff5a3df
dashboard link: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=143915cd980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13dbd334580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/90b0fb888152/disk-9b0d551b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1120c646f284/vmlinux-9b0d551b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/df9bbfa8cbe6/bzImage-9b0d551b.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/0277c876bf11/mount_8.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+83c9dd...@syzkaller.appspotmail.com

ntfs3(loop0): Failed to initialize $Extend.
=====================================================
BUG: KMSAN: uninit-value in attr_set_size+0x471b/0x6740 fs/ntfs3/attrib.c:653
attr_set_size+0x471b/0x6740 fs/ntfs3/attrib.c:653
ntfs_set_size+0x222/0x330 fs/ntfs3/inode.c:861
ntfs_extend+0x27c/0xf50 fs/ntfs3/file.c:359
ntfs_file_write_iter+0x627/0x10d0 fs/ntfs3/file.c:1220
iter_file_splice_write+0x12b2/0x2170 fs/splice.c:738
ntfs_file_splice_write+0x21d/0x370 fs/ntfs3/file.c:1347
do_splice_from fs/splice.c:938 [inline]
direct_splice_actor+0x317/0x7d0 fs/splice.c:1161
splice_direct_to_actor+0x99f/0x1550 fs/splice.c:1105
do_splice_direct_actor fs/splice.c:1204 [inline]
do_splice_direct+0x1e0/0x350 fs/splice.c:1230
do_sendfile+0x9eb/0x1110 fs/read_write.c:1370
__do_sys_sendfile64 fs/read_write.c:1431 [inline]
__se_sys_sendfile64+0x1e3/0x280 fs/read_write.c:1417
__x64_sys_sendfile64+0xbd/0x120 fs/read_write.c:1417
x64_sys_call+0x36b8/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:41
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
attr_set_size+0x4714/0x6740 fs/ntfs3/attrib.c:655
ntfs_set_size+0x222/0x330 fs/ntfs3/inode.c:861
ntfs_extend+0x27c/0xf50 fs/ntfs3/file.c:359
ntfs_file_write_iter+0x627/0x10d0 fs/ntfs3/file.c:1220
iter_file_splice_write+0x12b2/0x2170 fs/splice.c:738
ntfs_file_splice_write+0x21d/0x370 fs/ntfs3/file.c:1347
do_splice_from fs/splice.c:938 [inline]
direct_splice_actor+0x317/0x7d0 fs/splice.c:1161
splice_direct_to_actor+0x99f/0x1550 fs/splice.c:1105
do_splice_direct_actor fs/splice.c:1204 [inline]
do_splice_direct+0x1e0/0x350 fs/splice.c:1230
do_sendfile+0x9eb/0x1110 fs/read_write.c:1370
__do_sys_sendfile64 fs/read_write.c:1431 [inline]
__se_sys_sendfile64+0x1e3/0x280 fs/read_write.c:1417
__x64_sys_sendfile64+0xbd/0x120 fs/read_write.c:1417
x64_sys_call+0x36b8/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:41
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
ni_create_attr_list+0x1b9b/0x1db0 fs/ntfs3/frecord.c:872
attr_set_size+0x4174/0x6740 fs/ntfs3/attrib.c:640
ntfs_set_size+0x222/0x330 fs/ntfs3/inode.c:861
ntfs_extend+0x27c/0xf50 fs/ntfs3/file.c:359
ntfs_file_write_iter+0x627/0x10d0 fs/ntfs3/file.c:1220
iter_file_splice_write+0x12b2/0x2170 fs/splice.c:738
ntfs_file_splice_write+0x21d/0x370 fs/ntfs3/file.c:1347
do_splice_from fs/splice.c:938 [inline]
direct_splice_actor+0x317/0x7d0 fs/splice.c:1161
splice_direct_to_actor+0x99f/0x1550 fs/splice.c:1105
do_splice_direct_actor fs/splice.c:1204 [inline]
do_splice_direct+0x1e0/0x350 fs/splice.c:1230
do_sendfile+0x9eb/0x1110 fs/read_write.c:1370
__do_sys_sendfile64 fs/read_write.c:1431 [inline]
__se_sys_sendfile64+0x1e3/0x280 fs/read_write.c:1417
__x64_sys_sendfile64+0xbd/0x120 fs/read_write.c:1417
x64_sys_call+0x36b8/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:41
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
slab_post_alloc_hook mm/slub.c:4953 [inline]
slab_alloc_node mm/slub.c:5245 [inline]
__do_kmalloc_node mm/slub.c:5602 [inline]
__kmalloc_noprof+0xabb/0x1b40 mm/slub.c:5615
kmalloc_noprof include/linux/slab.h:961 [inline]
ni_create_attr_list+0x1ca/0x1db0 fs/ntfs3/frecord.c:770
attr_set_size+0x4174/0x6740 fs/ntfs3/attrib.c:640
ntfs_set_size+0x222/0x330 fs/ntfs3/inode.c:861
ntfs_extend+0x27c/0xf50 fs/ntfs3/file.c:359
ntfs_file_write_iter+0x627/0x10d0 fs/ntfs3/file.c:1220
iter_file_splice_write+0x12b2/0x2170 fs/splice.c:738
ntfs_file_splice_write+0x21d/0x370 fs/ntfs3/file.c:1347
do_splice_from fs/splice.c:938 [inline]
direct_splice_actor+0x317/0x7d0 fs/splice.c:1161
splice_direct_to_actor+0x99f/0x1550 fs/splice.c:1105
do_splice_direct_actor fs/splice.c:1204 [inline]
do_splice_direct+0x1e0/0x350 fs/splice.c:1230
do_sendfile+0x9eb/0x1110 fs/read_write.c:1370
__do_sys_sendfile64 fs/read_write.c:1431 [inline]
__se_sys_sendfile64+0x1e3/0x280 fs/read_write.c:1417
__x64_sys_sendfile64+0xbd/0x120 fs/read_write.c:1417
x64_sys_call+0x36b8/0x3e30 arch/x86/include/generated/asm/syscalls_64.h:41
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 6199 Comm: syz.0.54 Not tainted syzkaller #0 PREEMPT(none)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list
Author: nirbh...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

dule.
[ 8.288207][ T1] RPC: Registered udp transport module.
[ 8.289931][ T1] RPC: Registered tcp transport module.
[ 8.291845][ T1] RPC: Registered tcp-with-tls transport module.
[ 8.293772][ T1] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 8.331348][ T1] NET: Registered PF_XDP protocol family
[ 8.333135][ T1] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window]
[ 8.336032][ T1] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window]
[ 8.338411][ T1] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window]
[ 8.340200][ T1] pci_bus 0000:00: resource 7 [mem 0xc0000000-0xfebfefff window]
[ 8.347159][ T1] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
[ 8.350898][ T1] PCI: CLS 0 bytes, default 64
[ 8.352908][ T1] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[ 8.355024][ T1] software IO TLB: mapped [mem 0x00000000bbffd000-0x00000000bfffd000] (64MB)
[ 8.358033][ T1] ACPI: bus type thunderbolt registered
[ 8.387288][ T61] kworker/u8:1 (61) used greatest stack depth: 11960 bytes left
[ 8.495149][ T1] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[ 8.648953][ T1] kvm_amd: CPU 1 isn't AMD or Hygon
[ 8.650444][ T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x1fb6c80a799, max_idle_ns: 440795272342 ns
[ 9.016382][ T1] clocksource: Switched to clocksource tsc
[ 9.019550][ T62] kworker/u8:3 (62) used greatest stack depth: 11816 bytes left
[ 34.691907][ T1] Initialise system trusted keyrings
[ 34.701905][ T1] workingset: timestamp_bits=40 max_order=21 bucket_order=0
[ 34.713356][ T1] DLM installed
[ 34.727734][ T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 34.757434][ T1] NFS: Registering the id_resolver key type
[ 34.763850][ T1] Key type id_resolver registered
[ 34.768945][ T1] Key type id_legacy registered
[ 34.774737][ T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 34.782570][ T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[ 34.816751][ T1] Key type cifs.spnego registered
[ 34.822596][ T1] Key type cifs.idmap registered
[ 34.835867][ T1] ntfs3: Enabled Linux POSIX ACLs support
[ 34.841823][ T1] ntfs3: Read-only LZX/Xpress compression included
[ 34.848915][ T1] efs: 1.0a - http://aeschi.ch.eu.org/efs/
[ 34.855288][ T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
[ 34.861326][ T1] QNX4 filesystem 0.2.3 registered.
[ 34.867988][ T1] qnx6: QNX6 filesystem 1.0.0 registered.
[ 34.875504][ T1] fuse: init (API version 7.45)
[ 34.886866][ T1] orangefs_debugfs_init: called with debug mask: :none: :0:
[ 34.895794][ T1] orangefs_init: module version upstream loaded
[ 34.904152][ T1] JFS: nTxBlock = 8192, nTxLock = 65536
[ 34.948833][ T1] SGI XFS with ACLs, security attributes, realtime, quota, no debug enabled
[ 34.965946][ T1] 9p: Installing v9fs 9p2000 file system support
[ 34.973347][ T1] NILFS version 2 loaded
[ 34.977862][ T1] befs: version: 0.9.3
[ 34.983005][ T1] ocfs2: Registered cluster interface o2cb
[ 34.991273][ T1] ocfs2: Registered cluster interface user
[ 34.998495][ T1] OCFS2 User DLM kernel interface loaded
[ 35.017803][ T1] gfs2: GFS2 installed
[ 35.059251][ T1] ceph: loaded (mds proto 32)
[ 35.806968][ T1] NET: Registered PF_ALG protocol family
[ 35.813312][ T1] xor: automatically using best checksumming function avx
[ 35.821495][ T1] async_tx: api initialized (async)
[ 35.826889][ T1] Key type asymmetric registered
[ 35.831892][ T1] Asymmetric key parser 'x509' registered
[ 35.837768][ T1] Asymmetric key parser 'pkcs8' registered
[ 35.843909][ T1] Key type pkcs7_test registered
[ 35.850310][ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 239)
[ 35.860582][ T1] io scheduler mq-deadline registered
[ 35.866502][ T1] io scheduler kyber registered
[ 35.871959][ T1] io scheduler bfq registered
[ 35.891367][ T1] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0
[ 35.902076][ T140] kworker/u8:2 (140) used greatest stack depth: 10968 bytes left
[ 35.911355][ T1] ACPI: button: Power Button [PWRF]
[ 35.919612][ T1] input: Sleep Button as /devices/LNXSYSTM:00/LNXSLPBN:00/input/input1
[ 35.930796][ T1] ACPI: button: Sleep Button [SLPF]
[ 35.957609][ T1] ioatdma: Intel(R) QuickData Technology Driver 5.00
[ 36.038568][ T1] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[ 36.044867][ T1] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
[ 36.123929][ T1] ACPI: \_SB_.LNKD: Enabled at IRQ 10
[ 36.129736][ T1] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[ 36.208303][ T1] ACPI: \_SB_.LNKB: Enabled at IRQ 10
[ 36.214188][ T1] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
[ 36.273080][ T1] virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver
[ 37.416353][ T1] N_HDLC line discipline registered with maxframe=4096
[ 37.425415][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[ 37.437763][ T1] 00:03: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 37.472838][ T1] 00:04: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A
[ 37.510114][ T1] 00:05: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A
[ 37.542088][ T1] 00:06: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A
[ 37.596348][ T1] Non-volatile memory driver v1.3
[ 37.622619][ T1] Linux agpgart interface v0.103
[ 37.636015][ T1] usbcore: registered new interface driver xillyusb
[ 37.652287][ T1] ACPI: bus type drm_connector registered
[ 37.677443][ T1] [drm] Initialized vgem 1.0.0 for vgem on minor 0
[ 37.700372][ T1] [drm] Initialized vkms 1.0.0 for vkms on minor 1
[ 38.011203][ T1] Console: switching to colour frame buffer device 128x48
[ 38.099833][ T1] faux_driver vkms: [drm] fb0: vkmsdrmfb frame buffer device
[ 38.108152][ T1] usbcore: registered new interface driver udl
[ 38.119676][ T1] usbcore: registered new interface driver gm12u320
[ 38.127305][ T1] usbcore: registered new interface driver gud
[ 38.279542][ T1] brd: module loaded
[ 38.672678][ T1] loop: module loaded
[ 38.970689][ T1] zram: Added device: zram0
[ 38.996271][ T1] null_blk: disk nullb0 created
[ 39.001274][ T1] null_blk: module loaded
[ 39.008475][ T1] Guest personality initialized and is inactive
[ 39.016196][ T1] VMCI host device registered (name=vmci, major=10, minor=265)
[ 39.024148][ T1] Initialized host personality
[ 39.029706][ T1] usbcore: registered new interface driver rtsx_usb
[ 39.042104][ T1] usbcore: registered new interface driver viperboard
[ 39.050349][ T1] usbcore: registered new interface driver dln2
[ 39.058525][ T1] usbcore: registered new interface driver pn533_usb
[ 39.072218][ T1] nfcsim 0.2 initialized
[ 39.077348][ T1] usbcore: registered new interface driver port100
[ 39.084860][ T1] usbcore: registered new interface driver nfcmrvl
[ 39.102738][ T1] Loading iSCSI transport class v2.0-870.
[ 39.144075][ T1] virtio_scsi virtio0: 1/0/0 default/read/poll queues
[ 39.180630][ T1] scsi host0: Virtio SCSI HBA
[ 39.707208][ T1] st: Version 20160209, fixed bufsize 32768, s/g segs 256
[ 39.726184][ T35] scsi 0:0:1:0: Direct-Access Google PersistentDisk 1 PQ: 0 ANSI: 6
[ 39.759242][ T35] =====================================================
[ 39.767633][ T35] BUG: KMSAN: use-after-free in scsi_get_vpd_buf+0x4cc/0x720
[ 39.776263][ T35] scsi_get_vpd_buf+0x4cc/0x720
[ 39.781276][ T35] scsi_attach_vpd+0x974/0xe70
[ 39.787803][ T35] scsi_probe_and_add_lun+0x6933/0x7f20
[ 39.788235][ T1] Rounding down aligned max_sectors from 4294967295 to 4294967288
[ 39.795150][ T35] __scsi_scan_target+0x2fb/0x2050
[ 39.804255][ T1] db_root: cannot open: /etc/target
[ 39.806728][ T35] scsi_scan_host_selected+0x68f/0x9a0
[ 39.817463][ T35] do_scan_async+0x1ad/0xdc0
[ 39.822216][ T35] async_run_entry_fn+0x90/0x570
[ 39.827441][ T35] process_scheduled_works+0xb91/0x1d80
[ 39.833182][ T35] worker_thread+0xedf/0x1590
[ 39.838088][ T35] kthread+0xd59/0xf00
[ 39.842300][ T35] ret_from_fork+0x230/0x380
[ 39.847156][ T35] ret_from_fork_asm+0x1a/0x30
[ 39.852097][ T35]
[ 39.854573][ T35] Uninit was created at:
[ 39.859003][ T35] kfree+0x254/0x1460
[ 39.863131][ T35] call_usermodehelper_exec_async+0x666/0x6f0
[ 39.869451][ T35] ret_from_fork+0x230/0x380
[ 39.874294][ T35] ret_from_fork_asm+0x1a/0x30
[ 39.879336][ T35]
[ 39.881773][ T35] CPU: 1 UID: 0 PID: 35 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(none)
[ 39.891297][ T35] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
[ 39.891399][ T1] eql: Equalizer2002: Simon Janes (si...@ncm.com) and David S. Miller (da...@redhat.com)
[ 39.901579][ T35] Workqueue: async async_run_entry_fn
[ 39.917166][ T35] =====================================================
[ 39.924258][ T35] Disabling lock debugging due to kernel taint
[ 39.930495][ T35] Kernel panic - not syncing: kmsan.panic set ...
[ 39.934188][ T35] CPU: 1 UID: 0 PID: 35 Comm: kworker/u8:2 Tainted: G B syzkaller #0 PREEMPT(none)
[ 39.934188][ T35] Tainted: [B]=BAD_PAGE
[ 39.934188][ T35] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
[ 39.954023][ T35] Workqueue: async async_run_entry_fn
[ 39.954023][ T35] Call Trace:
[ 39.954023][ T35] <TASK>
[ 39.954023][ T35] __dump_stack+0x26/0x30
[ 39.954023][ T35] dump_stack_lvl+0x53/0x270
[ 39.983756][ T35] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0
[ 39.984028][ T35] dump_stack+0x1e/0x25
[ 39.984028][ T35] vpanic+0x435/0xd30
[ 39.984028][ T35] panic+0x15d/0x160
[ 39.984028][ T35] kmsan_report+0x31c/0x320
[ 39.984028][ T35] ? __msan_warning+0x1b/0x30
[ 39.984028][ T35] ? scsi_get_vpd_buf+0x4cc/0x720
[ 39.984028][ T35] ? scsi_attach_vpd+0x974/0xe70
[ 39.984028][ T35] ? scsi_probe_and_add_lun+0x6933/0x7f20
[ 40.024987][ T35] ? __scsi_scan_target+0x2fb/0x2050
[ 40.031990][ T35] ? scsi_scan_host_selected+0x68f/0x9a0
[ 40.031990][ T35] ? do_scan_async+0x1ad/0xdc0
[ 40.031990][ T35] ? async_run_entry_fn+0x90/0x570
[ 40.031990][ T35] ? process_scheduled_works+0xb91/0x1d80
[ 40.031990][ T35] ? worker_thread+0xedf/0x1590
[ 40.031990][ T35] ? kthread+0xd59/0xf00
[ 40.031990][ T35] ? ret_from_fork+0x230/0x380
[ 40.031990][ T35] ? ret_from_fork_asm+0x1a/0x30
[ 40.074129][ T35] ? blk_mq_free_request+0x3b6/0x600
[ 40.074129][ T35] ? scsi_execute_cmd+0x1add/0x1c70
[ 40.074129][ T35] ? kmsan_get_metadata+0xfb/0x160
[ 40.103719][ T35] __msan_warning+0x1b/0x30
[ 40.103719][ T35] scsi_get_vpd_buf+0x4cc/0x720
[ 40.103719][ T35] scsi_attach_vpd+0x974/0xe70
[ 40.103719][ T35] scsi_probe_and_add_lun+0x6933/0x7f20
[ 40.133877][ T35] __scsi_scan_target+0x2fb/0x2050
[ 40.133877][ T35] ? kmsan_internal_set_shadow_origin+0x7a/0x110
[ 40.133877][ T35] ? _raw_spin_unlock_irqrestore+0x3f/0x60
[ 40.133877][ T35] ? __pm_runtime_resume+0x1f7/0x230
[ 40.133877][ T35] ? kmsan_get_metadata+0xfb/0x160
[ 40.163605][ T35] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0
[ 40.163605][ T35] scsi_scan_host_selected+0x68f/0x9a0
[ 40.163605][ T35] do_scan_async+0x1ad/0xdc0
[ 40.163605][ T35] ? ktime_get+0x530/0x590
[ 40.163605][ T35] ? kmsan_get_metadata+0xfb/0x160
[ 40.163605][ T35] async_run_entry_fn+0x90/0x570
[ 40.193576][ T35] ? kmsan_get_metadata+0xfb/0x160
[ 40.193576][ T35] ? __pfx_do_scan_async+0x10/0x10
[ 40.193576][ T35] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0
[ 40.193576][ T35] ? __pfx_async_run_entry_fn+0x10/0x10
[ 40.193576][ T35] process_scheduled_works+0xb91/0x1d80
[ 40.223593][ T35] worker_thread+0xedf/0x1590
[ 40.223593][ T35] kthread+0xd59/0xf00
[ 40.223593][ T35] ? __pfx_worker_thread+0x10/0x10
[ 40.223593][ T35] ? __pfx_kthread+0x10/0x10
[ 40.223593][ T35] ret_from_fork+0x230/0x380
[ 40.223593][ T35] ? __pfx_kthread+0x10/0x10
[ 40.223593][ T35] ret_from_fork_asm+0x1a/0x30
[ 40.223593][ T35] </TASK>
[ 40.223593][ T35] Kernel Offset: disabled
[ 40.223593][ T35] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build4190601459=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 49379ee008e
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=49379ee008e5f2af6e551c2e23fcd6b1ebb4d5c2 -X github.com/google/syzkaller/prog.gitRevisionDate=20251002-084935" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=49379ee008e5f2af6e551c2e23fcd6b1ebb4d5c2 -X github.com/google/syzkaller/prog.gitRevisionDate=20251002-084935" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=49379ee008e5f2af6e551c2e23fcd6b1ebb4d5c2 -X github.com/google/syzkaller/prog.gitRevisionDate=20251002-084935" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"49379ee008e5f2af6e551c2e23fcd6b1ebb4d5c2\"
/usr/bin/ld: /tmp/ccqyzhm0.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12999a7c580000


Tested on:

commit: fd94619c Merge tag 'zonefs-6.18-rc1' of git://git.kern..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=ad506767107aacda

dashboard link: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=122bd092580000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: Re: test
Author: nirbh...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
master

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: Re: test2
Author: nirbh...@gmail.com

#syz test:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
9b0d551bcc05

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+83c9dd...@syzkaller.appspotmail.com
Tested-by: syzbot+83c9dd...@syzkaller.appspotmail.com

Tested on:

commit: 4a715314 Add linux-next specific files for 20251006
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=15612304580000
kernel config: https://syzkaller.appspot.com/x/.config?x=78e3a0444ed8b621

dashboard link: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=16e395cd980000

Note: testing is done by a robot and is best-effort only.

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+83c9dd...@syzkaller.appspotmail.com
Tested-by: syzbot+83c9dd...@syzkaller.appspotmail.com

Tested on:

commit: 9b0d551b Merge tag 'pull-misc' of git://git.kernel.org..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=15492304580000
kernel config: https://syzkaller.appspot.com/x/.config?x=50fb29d81ff5a3df

dashboard link: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=17eab334580000

[syzbot]

For archival purposes, forwarding an incoming command email to

syzkall...@googlegroups.com.

***

Subject: [PATCH] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list
Author: nirbh...@gmail.com

The call to kmalloc() to allocate the attribute list buffer is given a
size of al_aligned(rs). This size can be larger than the data
subsequently copied into the buffer, leaving trailing bytes uninitialized.

This can trigger a KMSAN "uninit-value" warning if that memory is
later accessed.

Fix this by using kzalloc() instead, which ensures the entire
allocated buffer is zero-initialized, preventing the warning.

Reported-by: syzbot+83c9dd...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf
Signed-off-by: Nirbhay Sharma <nirbh...@gmail.com>
---
The following syzbot test commands were used to verify the fix against
both linux-next and a specific mainline commit. Both kernels were
configured with CONFIG_KMSAN=y, and no KMSAN warnings were observed
with the patch applied.

An attempt to test against the latest mainline tip failed due to an
unrelated boot failure in the SCSI subsystem (KMSAN: use-after-free in
scsi_get_vpd_buf). Therefore, testing was done on the last known-good
mainline commit below.

For mainline commit 9b0d551bcc05 ("Merge tag 'pull-misc' of..."):

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 9b0d551bcc05

For the linux-next branch:
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master

fs/ntfs3/frecord.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index 8f9fe1d7a690..4fe8da7fc034 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -767,7 +767,7 @@ int ni_create_attr_list(struct ntfs_inode *ni)
* Skip estimating exact memory requirement.
* Looks like one record_size is always enough.
*/
- le = kmalloc(al_aligned(rs), GFP_NOFS);
+ le = kzalloc(al_aligned(rs), GFP_NOFS);
if (!le)
return -ENOMEM;

--
2.51.0

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+83c9dd...@syzkaller.appspotmail.com
Tested-by: syzbot+83c9dd...@syzkaller.appspotmail.com

Tested on:

commit: 9b0d551b Merge tag 'pull-misc' of git://git.kernel.org..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=17a855cd980000

kernel config: https://syzkaller.appspot.com/x/.config?x=50fb29d81ff5a3df
dashboard link: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=1609f942580000