[syzbot] [exfat?] KMSAN: uninit-value in __exfat_get_dentry_set

43 views
Skip to first unread message

syzbot

unread,
Oct 5, 2024, 10:32:25 AMOct 5
to linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com, yuezh...@sony.com
Hello,

syzbot found the following issue on:

HEAD commit: e32cde8d2bd7 Merge tag 'sched_ext-for-6.12-rc1-fixes-1' of..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=16cf7dd0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b1fd45f2013d812f
dashboard link: https://syzkaller.appspot.com/bug?extid=01218003be74b5e1213a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11cf7dd0580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d06580580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/16d4da549bf4/disk-e32cde8d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a01bc9a0e174/vmlinux-e32cde8d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/93f4dfad6909/bzImage-e32cde8d.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/433ba0700154/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+012180...@syzkaller.appspotmail.com

exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x726052d3, utbl_chksum : 0xe619d30d)
=====================================================
BUG: KMSAN: uninit-value in __exfat_get_dentry_set+0x10ca/0x14d0 fs/exfat/dir.c:804
__exfat_get_dentry_set+0x10ca/0x14d0 fs/exfat/dir.c:804
exfat_get_dentry_set+0x58/0xec0 fs/exfat/dir.c:859
__exfat_write_inode+0x3c1/0xe30 fs/exfat/inode.c:46
__exfat_truncate+0x7f3/0xbb0 fs/exfat/file.c:211
exfat_truncate+0xee/0x2a0 fs/exfat/file.c:257
exfat_write_failed fs/exfat/inode.c:421 [inline]
exfat_direct_IO+0x5a3/0x900 fs/exfat/inode.c:485
generic_file_direct_write+0x275/0x6a0 mm/filemap.c:3977
__generic_file_write_iter+0x242/0x460 mm/filemap.c:4141
exfat_file_write_iter+0x894/0xfb0 fs/exfat/file.c:598
do_iter_readv_writev+0x88a/0xa30
vfs_writev+0x56a/0x14f0 fs/read_write.c:1064
do_pwritev fs/read_write.c:1165 [inline]
__do_sys_pwritev2 fs/read_write.c:1224 [inline]
__se_sys_pwritev2+0x280/0x470 fs/read_write.c:1215
__x64_sys_pwritev2+0x11f/0x1a0 fs/read_write.c:1215
x64_sys_call+0x2edb/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:329
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
memcpy_to_iter lib/iov_iter.c:65 [inline]
iterate_bvec include/linux/iov_iter.h:123 [inline]
iterate_and_advance2 include/linux/iov_iter.h:304 [inline]
iterate_and_advance include/linux/iov_iter.h:328 [inline]
_copy_to_iter+0xe53/0x2b30 lib/iov_iter.c:185
copy_page_to_iter+0x419/0x880 lib/iov_iter.c:362
shmem_file_read_iter+0xa09/0x12b0 mm/shmem.c:3167
do_iter_readv_writev+0x88a/0xa30
vfs_iter_read+0x278/0x760 fs/read_write.c:923
lo_read_simple drivers/block/loop.c:283 [inline]
do_req_filebacked drivers/block/loop.c:516 [inline]
loop_handle_cmd drivers/block/loop.c:1910 [inline]
loop_process_work+0x20fc/0x3750 drivers/block/loop.c:1945
loop_rootcg_workfn+0x2b/0x40 drivers/block/loop.c:1976
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was stored to memory at:
memcpy_from_iter lib/iov_iter.c:73 [inline]
iterate_bvec include/linux/iov_iter.h:123 [inline]
iterate_and_advance2 include/linux/iov_iter.h:304 [inline]
iterate_and_advance include/linux/iov_iter.h:328 [inline]
__copy_from_iter lib/iov_iter.c:249 [inline]
copy_page_from_iter_atomic+0x12b7/0x3100 lib/iov_iter.c:481
copy_folio_from_iter_atomic include/linux/uio.h:201 [inline]
generic_perform_write+0x8d1/0x1080 mm/filemap.c:4066
shmem_file_write_iter+0x2ba/0x2f0 mm/shmem.c:3221
do_iter_readv_writev+0x88a/0xa30
vfs_iter_write+0x44d/0xd40 fs/read_write.c:988
lo_write_bvec drivers/block/loop.c:243 [inline]
lo_write_simple drivers/block/loop.c:264 [inline]
do_req_filebacked drivers/block/loop.c:511 [inline]
loop_handle_cmd drivers/block/loop.c:1910 [inline]
loop_process_work+0x15e6/0x3750 drivers/block/loop.c:1945
loop_rootcg_workfn+0x2b/0x40 drivers/block/loop.c:1976
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
__alloc_pages_noprof+0x9d6/0xe70 mm/page_alloc.c:4756
alloc_pages_mpol_noprof+0x299/0x990 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2345 [inline]
folio_alloc_noprof+0x1db/0x310 mm/mempolicy.c:2352
filemap_alloc_folio_noprof+0xa6/0x440 mm/filemap.c:1010
__filemap_get_folio+0xac4/0x1550 mm/filemap.c:1952
block_write_begin+0x6e/0x2b0 fs/buffer.c:2226
exfat_write_begin+0xfb/0x400 fs/exfat/inode.c:434
exfat_extend_valid_size fs/exfat/file.c:553 [inline]
exfat_file_write_iter+0x474/0xfb0 fs/exfat/file.c:588
do_iter_readv_writev+0x88a/0xa30
vfs_writev+0x56a/0x14f0 fs/read_write.c:1064
do_pwritev fs/read_write.c:1165 [inline]
__do_sys_pwritev2 fs/read_write.c:1224 [inline]
__se_sys_pwritev2+0x280/0x470 fs/read_write.c:1215
__x64_sys_pwritev2+0x11f/0x1a0 fs/read_write.c:1215
x64_sys_call+0x2edb/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:329
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 5188 Comm: syz-executor221 Not tainted 6.12.0-rc1-syzkaller-00031-ge32cde8d2bd7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Nihar Chaithanya

unread,
Oct 10, 2024, 8:39:35 AMOct 10
to syzbot+012180...@syzkaller.appspotmail.com, syzkall...@googlegroups.com
#syz test
0001-exfat-fix-uninit-value-in-__exfat_write_inode.patch

syzbot

unread,
Oct 10, 2024, 9:52:05 AMOct 10
to linux-...@vger.kernel.org, niharch...@gmail.com, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in __exfat_get_dentry_set

=====================================================
BUG: KMSAN: uninit-value in __exfat_get_dentry_set+0x10ca/0x14d0 fs/exfat/dir.c:804
__exfat_get_dentry_set+0x10ca/0x14d0 fs/exfat/dir.c:804
exfat_get_dentry_set+0x58/0xec0 fs/exfat/dir.c:859
__exfat_write_inode+0x3d3/0xe40 fs/exfat/inode.c:46
loop_workfn+0x48/0x60 drivers/block/loop.c:1969
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was stored to memory at:
memcpy_from_iter lib/iov_iter.c:73 [inline]
iterate_bvec include/linux/iov_iter.h:123 [inline]
iterate_and_advance2 include/linux/iov_iter.h:304 [inline]
iterate_and_advance include/linux/iov_iter.h:328 [inline]
__copy_from_iter lib/iov_iter.c:249 [inline]
copy_page_from_iter_atomic+0x12b7/0x3100 lib/iov_iter.c:481
copy_folio_from_iter_atomic include/linux/uio.h:201 [inline]
generic_perform_write+0x8d1/0x1080 mm/filemap.c:4066
shmem_file_write_iter+0x2ba/0x2f0 mm/shmem.c:3221
do_iter_readv_writev+0x88a/0xa30
vfs_iter_write+0x44d/0xd40 fs/read_write.c:988
lo_write_bvec drivers/block/loop.c:243 [inline]
lo_write_simple drivers/block/loop.c:264 [inline]
do_req_filebacked drivers/block/loop.c:511 [inline]
loop_handle_cmd drivers/block/loop.c:1910 [inline]
loop_process_work+0x15e6/0x3750 drivers/block/loop.c:1945
loop_workfn+0x48/0x60 drivers/block/loop.c:1969
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
__alloc_pages_noprof+0x9a7/0xe00 mm/page_alloc.c:4756
alloc_pages_mpol_noprof+0x299/0x990 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2345 [inline]
folio_alloc_noprof+0x1db/0x310 mm/mempolicy.c:2352
filemap_alloc_folio_noprof+0xa6/0x440 mm/filemap.c:1010
__filemap_get_folio+0xac4/0x1550 mm/filemap.c:1952
block_write_begin+0x6e/0x2b0 fs/buffer.c:2226
exfat_write_begin+0xfb/0x400 fs/exfat/inode.c:434
exfat_extend_valid_size fs/exfat/file.c:553 [inline]
exfat_file_write_iter+0x474/0xfb0 fs/exfat/file.c:588
do_iter_readv_writev+0x88a/0xa30
vfs_writev+0x56a/0x14f0 fs/read_write.c:1064
do_pwritev fs/read_write.c:1165 [inline]
__do_sys_pwritev2 fs/read_write.c:1224 [inline]
__se_sys_pwritev2+0x280/0x470 fs/read_write.c:1215
__x64_sys_pwritev2+0x11f/0x1a0 fs/read_write.c:1215
x64_sys_call+0x2edb/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:329
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 6060 Comm: syz.0.15 Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
=====================================================


Tested on:

commit: d3d15566 Merge tag 'mm-hotfixes-stable-2024-10-09-15-4..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12785040580000
kernel config: https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a
dashboard link: https://syzkaller.appspot.com/bug?extid=01218003be74b5e1213a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=13e16fd0580000

Nihar Chaithanya

unread,
Oct 10, 2024, 10:01:52 AMOct 10
to syzbot+012180...@syzkaller.appspotmail.com, syzkall...@googlegroups.com
#syz test
0001-exfat-fix-uninit-value-in-exfat_get_dentry_set.patch

syzbot

unread,
Oct 10, 2024, 10:40:06 AMOct 10
to linux-...@vger.kernel.org, niharch...@gmail.com, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in __exfat_get_dentry_set

loop0: detected capacity change from 0 to 256
exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x726052d3, utbl_chksum : 0xe619d30d)
=====================================================
BUG: KMSAN: uninit-value in __exfat_get_dentry_set+0x10ca/0x14d0 fs/exfat/dir.c:804
__exfat_get_dentry_set+0x10ca/0x14d0 fs/exfat/dir.c:804
exfat_get_dentry_set+0x58/0xec0 fs/exfat/dir.c:859
__exfat_write_inode+0x3c1/0xe30 fs/exfat/inode.c:47
__exfat_truncate+0x7f3/0xbb0 fs/exfat/file.c:211
exfat_truncate+0xee/0x2a0 fs/exfat/file.c:257
exfat_write_failed fs/exfat/inode.c:423 [inline]
exfat_direct_IO+0x5a3/0x900 fs/exfat/inode.c:487
exfat_write_begin+0xfb/0x400 fs/exfat/inode.c:436
exfat_extend_valid_size fs/exfat/file.c:553 [inline]
exfat_file_write_iter+0x474/0xfb0 fs/exfat/file.c:588
do_iter_readv_writev+0x88a/0xa30
vfs_writev+0x56a/0x14f0 fs/read_write.c:1064
do_pwritev fs/read_write.c:1165 [inline]
__do_sys_pwritev2 fs/read_write.c:1224 [inline]
__se_sys_pwritev2+0x280/0x470 fs/read_write.c:1215
__x64_sys_pwritev2+0x11f/0x1a0 fs/read_write.c:1215
x64_sys_call+0x2edb/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:329
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 5969 Comm: syz.0.15 Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
=====================================================


Tested on:

commit: d3d15566 Merge tag 'mm-hotfixes-stable-2024-10-09-15-4..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10e36fd0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a
dashboard link: https://syzkaller.appspot.com/bug?extid=01218003be74b5e1213a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=16e45040580000

Sarvesh

unread,
Oct 11, 2024, 8:34:23 AMOct 11
to syzbot+012180...@syzkaller.appspotmail.com, syzkall...@googlegroups.com
#syz test
0001-uninit-value-in-exfat-dentry_set.patch

syzbot

unread,
Oct 11, 2024, 8:41:05 AMOct 11
to linux-...@vger.kernel.org, sarves...@gmail.com, syzkall...@googlegroups.com
Hello,

syzbot tried to test the proposed patch but the build/boot failed:

fs/exfat/dir.c:747:17: error: no member named 'data' in 'struct buffer_head'


Tested on:

commit: 1d227fcc Merge tag 'net-6.12-rc3' of git://git.kernel...
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=b1fd45f2013d812f
dashboard link: https://syzkaller.appspot.com/bug?extid=01218003be74b5e1213a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=105c9fd0580000

Sarvesh

unread,
Oct 11, 2024, 9:04:34 AMOct 11
to syzbot+012180...@syzkaller.appspotmail.com, syzkall...@googlegroups.com
#syz test
0001-uninit-value-in-exfat-dentry_set.patch

syzbot

unread,
Oct 11, 2024, 9:28:04 AMOct 11
to linux-...@vger.kernel.org, sarves...@gmail.com, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in __exfat_get_dentry_set

loop0: detected capacity change from 0 to 256
exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x726052d3, utbl_chksum : 0xe619d30d)
=====================================================
BUG: KMSAN: uninit-value in __exfat_get_dentry_set+0x1128/0x1570 fs/exfat/dir.c:809
__exfat_get_dentry_set+0x1128/0x1570 fs/exfat/dir.c:809
exfat_get_dentry_set+0x5a/0xf30 fs/exfat/dir.c:864
__exfat_write_inode+0x3c1/0xe30 fs/exfat/inode.c:46
__exfat_truncate+0x7f3/0xbb0 fs/exfat/file.c:211
exfat_truncate+0xee/0x2a0 fs/exfat/file.c:257
exfat_write_failed fs/exfat/inode.c:421 [inline]
exfat_direct_IO+0x5a3/0x900 fs/exfat/inode.c:485
exfat_write_begin+0xfb/0x400 fs/exfat/inode.c:434
exfat_extend_valid_size fs/exfat/file.c:553 [inline]
exfat_file_write_iter+0x474/0xfb0 fs/exfat/file.c:588
do_iter_readv_writev+0x88a/0xa30
vfs_writev+0x56a/0x14f0 fs/read_write.c:1064
do_pwritev fs/read_write.c:1165 [inline]
__do_sys_pwritev2 fs/read_write.c:1224 [inline]
__se_sys_pwritev2+0x280/0x470 fs/read_write.c:1215
__x64_sys_pwritev2+0x11f/0x1a0 fs/read_write.c:1215
x64_sys_call+0x2edb/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:329
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 6039 Comm: syz.0.15 Not tainted 6.12.0-rc2-syzkaller-00205-g1d227fcc7222-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
=====================================================


Tested on:

commit: 1d227fcc Merge tag 'net-6.12-rc3' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17f02840580000
kernel config: https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a
dashboard link: https://syzkaller.appspot.com/bug?extid=01218003be74b5e1213a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=11d26b27980000

syzbot

unread,
Oct 12, 2024, 3:48:44 AMOct 12
to linux-...@vger.kernel.org, syzkall...@googlegroups.com
For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: Re: [syzbot] [exfat?] KMSAN: uninit-value in __exfat_get_dentry_set
Author: surajson...@gmail.com

#syz test
> --
> You received this message because you are subscribed to the Google Groups
> "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/syzkaller-bugs/67014df7.050a0220.49194.04c0.GAE%40google.com
> .
>

syzbot

unread,
Oct 12, 2024, 4:11:05 AMOct 12
to linux-...@vger.kernel.org, surajson...@gmail.com, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in __exfat_get_dentry_set

loop0: detected capacity change from 0 to 256
exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x726052d3, utbl_chksum : 0xe619d30d)
=====================================================
BUG: KMSAN: uninit-value in __exfat_get_dentry_set+0x10db/0x14d0 fs/exfat/dir.c:805
__exfat_get_dentry_set+0x10db/0x14d0 fs/exfat/dir.c:805
exfat_get_dentry_set+0x58/0xec0 fs/exfat/dir.c:860
loop_workfn+0x48/0x60 drivers/block/loop.c:1969
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was stored to memory at:
memcpy_from_iter lib/iov_iter.c:73 [inline]
iterate_bvec include/linux/iov_iter.h:123 [inline]
iterate_and_advance2 include/linux/iov_iter.h:304 [inline]
iterate_and_advance include/linux/iov_iter.h:328 [inline]
__copy_from_iter lib/iov_iter.c:249 [inline]
copy_page_from_iter_atomic+0x12b7/0x3100 lib/iov_iter.c:481
copy_folio_from_iter_atomic include/linux/uio.h:201 [inline]
generic_perform_write+0x8d1/0x1080 mm/filemap.c:4066
shmem_file_write_iter+0x2ba/0x2f0 mm/shmem.c:3221
do_iter_readv_writev+0x88a/0xa30
vfs_iter_write+0x44d/0xd40 fs/read_write.c:988
lo_write_bvec drivers/block/loop.c:243 [inline]
lo_write_simple drivers/block/loop.c:264 [inline]
do_req_filebacked drivers/block/loop.c:511 [inline]
loop_handle_cmd drivers/block/loop.c:1910 [inline]
loop_process_work+0x15e6/0x3750 drivers/block/loop.c:1945
loop_workfn+0x48/0x60 drivers/block/loop.c:1969
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
__alloc_pages_noprof+0x9a7/0xe00 mm/page_alloc.c:4756
alloc_pages_mpol_noprof+0x299/0x990 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2345 [inline]
folio_alloc_noprof+0x1db/0x310 mm/mempolicy.c:2352
filemap_alloc_folio_noprof+0xa6/0x440 mm/filemap.c:1010
__filemap_get_folio+0xac4/0x1550 mm/filemap.c:1952
block_write_begin+0x6e/0x2b0 fs/buffer.c:2226
exfat_write_begin+0xfb/0x400 fs/exfat/inode.c:434
exfat_extend_valid_size fs/exfat/file.c:553 [inline]
exfat_file_write_iter+0x474/0xfb0 fs/exfat/file.c:588
do_iter_readv_writev+0x88a/0xa30
vfs_writev+0x56a/0x14f0 fs/read_write.c:1064
do_pwritev fs/read_write.c:1165 [inline]
__do_sys_pwritev2 fs/read_write.c:1224 [inline]
__se_sys_pwritev2+0x280/0x470 fs/read_write.c:1215
__x64_sys_pwritev2+0x11f/0x1a0 fs/read_write.c:1215
x64_sys_call+0x2edb/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:329
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 5987 Comm: syz.0.15 Not tainted 6.12.0-rc2-syzkaller-00291-g09f6b0c8904b-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
=====================================================


Tested on:

commit: 09f6b0c8 Merge tag 'linux_kselftest-fixes-6.12-rc3' of..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=121adfd0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a
dashboard link: https://syzkaller.appspot.com/bug?extid=01218003be74b5e1213a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=14b2dfd0580000

Suraj Sonawane

unread,
Oct 12, 2024, 11:39:20 AMOct 12
to syzbot, linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com, yuezh...@sony.com
#syz test

On Sat, Oct 5, 2024 at 8:02 PM syzbot <syzbot+012180...@syzkaller.appspotmail.com> wrote:
0001-fs-fix-uinit.patch

syzbot

unread,
Oct 12, 2024, 2:23:03 PMOct 12
to linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, surajson...@gmail.com, syzkall...@googlegroups.com, yuezh...@sony.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in __exfat_get_dentry_set

loop0: detected capacity change from 0 to 256
exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x726052d3, utbl_chksum : 0xe619d30d)
=====================================================
BUG: KMSAN: uninit-value in __exfat_get_dentry_set+0x1148/0x1540 fs/exfat/dir.c:811
__exfat_get_dentry_set+0x1148/0x1540 fs/exfat/dir.c:811
exfat_get_dentry_set+0x58/0xec0 fs/exfat/dir.c:866
loop_workfn+0x48/0x60 drivers/block/loop.c:1969
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was stored to memory at:
memcpy_from_iter lib/iov_iter.c:73 [inline]
iterate_bvec include/linux/iov_iter.h:123 [inline]
iterate_and_advance2 include/linux/iov_iter.h:304 [inline]
iterate_and_advance include/linux/iov_iter.h:328 [inline]
__copy_from_iter lib/iov_iter.c:249 [inline]
copy_page_from_iter_atomic+0x12b7/0x3100 lib/iov_iter.c:481
copy_folio_from_iter_atomic include/linux/uio.h:201 [inline]
generic_perform_write+0x8d1/0x1080 mm/filemap.c:4066
shmem_file_write_iter+0x2ba/0x2f0 mm/shmem.c:3221
do_iter_readv_writev+0x88a/0xa30
vfs_iter_write+0x44d/0xd40 fs/read_write.c:988
lo_write_bvec drivers/block/loop.c:243 [inline]
lo_write_simple drivers/block/loop.c:264 [inline]
do_req_filebacked drivers/block/loop.c:511 [inline]
loop_handle_cmd drivers/block/loop.c:1910 [inline]
loop_process_work+0x15e6/0x3750 drivers/block/loop.c:1945
loop_workfn+0x48/0x60 drivers/block/loop.c:1969
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
__alloc_pages_noprof+0x9a7/0xe00 mm/page_alloc.c:4756
alloc_pages_mpol_noprof+0x299/0x990 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2345 [inline]
folio_alloc_noprof+0x1db/0x310 mm/mempolicy.c:2352
filemap_alloc_folio_noprof+0xa6/0x440 mm/filemap.c:1010
__filemap_get_folio+0xac4/0x1550 mm/filemap.c:1952
block_write_begin+0x6e/0x2b0 fs/buffer.c:2226
exfat_write_begin+0xfb/0x400 fs/exfat/inode.c:434
exfat_extend_valid_size fs/exfat/file.c:553 [inline]
exfat_file_write_iter+0x474/0xfb0 fs/exfat/file.c:588
do_iter_readv_writev+0x88a/0xa30
vfs_writev+0x56a/0x14f0 fs/read_write.c:1064
do_pwritev fs/read_write.c:1165 [inline]
__do_sys_pwritev2 fs/read_write.c:1224 [inline]
__se_sys_pwritev2+0x280/0x470 fs/read_write.c:1215
__x64_sys_pwritev2+0x11f/0x1a0 fs/read_write.c:1215
x64_sys_call+0x2edb/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:329
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 5959 Comm: syz.0.15 Not tainted 6.12.0-rc2-syzkaller-00305-g7234e2ea0edd-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
=====================================================


Tested on:

commit: 7234e2ea Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1552705f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=981fe2ff8a1e457a
dashboard link: https://syzkaller.appspot.com/bug?extid=01218003be74b5e1213a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=16ebf840580000

Yuezh...@sony.com

unread,
Oct 14, 2024, 3:14:44 AMOct 14
to syzbot, linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com
#syz test

On Sat, Oct 5, 2024 at 8:02 PM syzbot <syzbot+012180...@syzkaller.appspotmail.com> wrote:
>

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: e32cde8d2bd7 Merge tag 'sched_ext-for-6.12-rc1-fixes-1'
> of..
> git tree: upstream
> console+strace:

> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/log.txt?x=16cf7d
> d0580000__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBXZY
> WyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwVy5
> 7mr5yQIbTA6$
> kernel config:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/.config?x=b1fd45
> f2013d812f__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBX
> ZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwV
> y57mr50IfSXOd$
> dashboard link:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/bug?extid=012180
> 03be74b5e1213a__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8U
> UVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2h
> OwVy57mr5-IoYOKx$


> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian)
> 2.40
> syz repro:

> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/repro.syz?x=11cf
> 7dd0580000__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVB
> XZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOw
> Vy57mr58TvVCus$
> C reproducer:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/repro.c?x=11d06
> 580580000__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBXZ
> YWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwVy
> 57mr5w2Sgp57$
>
> Downloadable assets:
> disk image:
> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/16
> d4da549bf4/disk-e32cde8d.raw.xz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6
> NhWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0
> CGeGE0kSF4M2hOwVy57mr54CRCyjy$
> vmlinux:
> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/a01
> bc9a0e174/vmlinux-e32cde8d.xz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6N
> hWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0C
> GeGE0kSF4M2hOwVy57mr5_9fwsZ2$
> kernel image:
> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/93f
> 4dfad6909/bzImage-e32cde8d.xz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6N
> hWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0C
> GeGE0kSF4M2hOwVy57mr54HU84Yj$
> mounted in repro:
> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/43
> 3ba0700154/mount_0.gz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWI
> Wcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0k
> SF4M2hOwVy57mr51x55siW$


>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by:

> mailto:syzbot+012180...@syzkaller.appspotmail.com

> https://urldefense.com/v3/__https://goo.gl/tpsmEJ__;!!JmoZiZGBv3RvKRSx!_E
> FM31JxDI_sBC6NhWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-
> btBmzePMIOD0CGeGE0kSF4M2hOwVy57mr50hLBEHu$ for more information
> about syzbot.
> syzbot engineers can be reached at mailto:syzk...@googlegroups.com.


>
> syzbot will keep track of this issue. See:

> https://urldefense.com/v3/__https://goo.gl/tpsmEJ*status__;Iw!!JmoZiZGBv3R
> vKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4Tu
> epNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwVy57mr55Eybub8$ for how to

0001-exfat-do-not-update-valid_size-in-exfat_get_block-if.patch

syzbot

unread,
Oct 14, 2024, 3:51:08 AMOct 14
to linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com, yuezh...@sony.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in __exfat_get_dentry_set

loop0: detected capacity change from 0 to 256
exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x726052d3, utbl_chksum : 0xe619d30d)
=====================================================
BUG: KMSAN: uninit-value in __exfat_get_dentry_set+0x10ca/0x14d0 fs/exfat/dir.c:804
__exfat_get_dentry_set+0x10ca/0x14d0 fs/exfat/dir.c:804
exfat_get_dentry_set+0x58/0xec0 fs/exfat/dir.c:859
__exfat_write_inode+0x3c1/0xe30 fs/exfat/inode.c:46
__exfat_truncate+0x7f3/0xbb0 fs/exfat/file.c:211
exfat_truncate+0xee/0x2a0 fs/exfat/file.c:257
exfat_write_failed fs/exfat/inode.c:435 [inline]
exfat_direct_IO+0x5a3/0x900 fs/exfat/inode.c:499
loop_workfn+0x48/0x60 drivers/block/loop.c:1969
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was stored to memory at:
memcpy_from_iter lib/iov_iter.c:73 [inline]
iterate_bvec include/linux/iov_iter.h:123 [inline]
iterate_and_advance2 include/linux/iov_iter.h:304 [inline]
iterate_and_advance include/linux/iov_iter.h:328 [inline]
__copy_from_iter lib/iov_iter.c:249 [inline]
copy_page_from_iter_atomic+0x12b7/0x3100 lib/iov_iter.c:481
copy_folio_from_iter_atomic include/linux/uio.h:201 [inline]
generic_perform_write+0x8d1/0x1080 mm/filemap.c:4066
shmem_file_write_iter+0x2ba/0x2f0 mm/shmem.c:3221
do_iter_readv_writev+0x88a/0xa30
vfs_iter_write+0x44d/0xd40 fs/read_write.c:988
lo_write_bvec drivers/block/loop.c:243 [inline]
lo_write_simple drivers/block/loop.c:264 [inline]
do_req_filebacked drivers/block/loop.c:511 [inline]
loop_handle_cmd drivers/block/loop.c:1910 [inline]
loop_process_work+0x15e6/0x3750 drivers/block/loop.c:1945
loop_workfn+0x48/0x60 drivers/block/loop.c:1969
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
__alloc_pages_noprof+0x9a7/0xe00 mm/page_alloc.c:4756
alloc_pages_mpol_noprof+0x299/0x990 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2345 [inline]
folio_alloc_noprof+0x1db/0x310 mm/mempolicy.c:2352
filemap_alloc_folio_noprof+0xa6/0x440 mm/filemap.c:1010
__filemap_get_folio+0xac4/0x1550 mm/filemap.c:1952
block_write_begin+0x6e/0x2b0 fs/buffer.c:2226
exfat_write_begin+0xfb/0x400 fs/exfat/inode.c:448
exfat_extend_valid_size fs/exfat/file.c:553 [inline]
exfat_file_write_iter+0x474/0xfb0 fs/exfat/file.c:588
do_iter_readv_writev+0x88a/0xa30
vfs_writev+0x56a/0x14f0 fs/read_write.c:1064
do_pwritev fs/read_write.c:1165 [inline]
__do_sys_pwritev2 fs/read_write.c:1224 [inline]
__se_sys_pwritev2+0x280/0x470 fs/read_write.c:1215
__x64_sys_pwritev2+0x11f/0x1a0 fs/read_write.c:1215
x64_sys_call+0x2edb/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:329
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 5987 Comm: syz.0.15 Not tainted 6.12.0-rc3-syzkaller-g6485cf5ea253-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
=====================================================


Tested on:

commit: 6485cf5e Merge tag 'hid-for-linus-2024101301' of git:/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1012d85f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=5242e0e980477c72
dashboard link: https://syzkaller.appspot.com/bug?extid=01218003be74b5e1213a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=154ac727980000

Yuezh...@sony.com

unread,
Oct 14, 2024, 5:00:12 AMOct 14
to syzbot, linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com
#syz test

On Sat, Oct 5, 2024 at 8:02 PM syzbot <syzbot+012180...@syzkaller.appspotmail.com> wrote:
>

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: e32cde8d2bd7 Merge tag 'sched_ext-for-6.12-rc1-fixes-1'
> of..
> git tree: upstream
> console+strace:

> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/log.txt?x=16cf7d
> d0580000__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBXZY
> WyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwVy5
> 7mr5yQIbTA6$
> kernel config:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/.config?x=b1fd45
> f2013d812f__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBX
> ZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwV
> y57mr50IfSXOd$
> dashboard link:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/bug?extid=012180
> 03be74b5e1213a__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8U
> UVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2h
> OwVy57mr5-IoYOKx$

> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian)
> 2.40
> syz repro:

> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/repro.syz?x=11cf
> 7dd0580000__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVB
> XZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOw
> Vy57mr58TvVCus$
> C reproducer:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/repro.c?x=11d06
> 580580000__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBXZ
> YWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwVy
> 57mr5w2Sgp57$
>

> Downloadable assets:
> disk image:


> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/16
> d4da549bf4/disk-e32cde8d.raw.xz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6
> NhWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0
> CGeGE0kSF4M2hOwVy57mr54CRCyjy$
> vmlinux:
> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/a01
> bc9a0e174/vmlinux-e32cde8d.xz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6N
> hWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0C
> GeGE0kSF4M2hOwVy57mr5_9fwsZ2$
> kernel image:
> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/93f
> 4dfad6909/bzImage-e32cde8d.xz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6N
> hWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0C
> GeGE0kSF4M2hOwVy57mr54HU84Yj$
> mounted in repro:
> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/43
> 3ba0700154/mount_0.gz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWI
> Wcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0k
> SF4M2hOwVy57mr51x55siW$
>

> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by:

> mailto:syzbot+012180...@syzkaller.appspotmail.com

> https://urldefense.com/v3/__https://goo.gl/tpsmEJ__;!!JmoZiZGBv3RvKRSx!_E
> FM31JxDI_sBC6NhWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-

> btBmzePMIOD0CGeGE0kSF4M2hOwVy57mr50hLBEHu$ for more information
> about syzbot.
> syzbot engineers can be reached at mailto:syzk...@googlegroups.com.


>
> syzbot will keep track of this issue. See:

> https://urldefense.com/v3/__https://goo.gl/tpsmEJ*status__;Iw!!JmoZiZGBv3R
> vKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4Tu

> epNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwVy57mr55Eybub8$ for how to

0001-exfat-check-shutdown-flag-before-truncate.patch

syzbot

unread,
Oct 14, 2024, 6:33:04 AMOct 14
to linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com, yuezh...@sony.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in __exfat_get_dentry_set

loop0: detected capacity change from 0 to 256
exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x726052d3, utbl_chksum : 0xe619d30d)
=====================================================
BUG: KMSAN: uninit-value in __exfat_get_dentry_set+0x10ca/0x14d0 fs/exfat/dir.c:804
__exfat_get_dentry_set+0x10ca/0x14d0 fs/exfat/dir.c:804
exfat_get_dentry_set+0x58/0xec0 fs/exfat/dir.c:859
__exfat_write_inode+0x3c1/0xe30 fs/exfat/inode.c:46
__exfat_truncate+0x7f3/0xbb0 fs/exfat/file.c:211
exfat_truncate+0x154/0x330 fs/exfat/file.c:260
exfat_write_failed fs/exfat/inode.c:421 [inline]
exfat_direct_IO+0x5a3/0x900 fs/exfat/inode.c:485
generic_file_direct_write+0x275/0x6a0 mm/filemap.c:3977
__generic_file_write_iter+0x242/0x460 mm/filemap.c:4141
exfat_file_write_iter+0x894/0xfb0 fs/exfat/file.c:601
do_iter_readv_writev+0x88a/0xa30
vfs_writev+0x56a/0x14f0 fs/read_write.c:1064
do_pwritev fs/read_write.c:1165 [inline]
__do_sys_pwritev2 fs/read_write.c:1224 [inline]
__se_sys_pwritev2+0x280/0x470 fs/read_write.c:1215
__x64_sys_pwritev2+0x11f/0x1a0 fs/read_write.c:1215
x64_sys_call+0x2edb/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:329
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
memcpy_to_iter lib/iov_iter.c:65 [inline]
iterate_bvec include/linux/iov_iter.h:123 [inline]
iterate_and_advance2 include/linux/iov_iter.h:304 [inline]
iterate_and_advance include/linux/iov_iter.h:328 [inline]
_copy_to_iter+0xe53/0x2b30 lib/iov_iter.c:185
copy_page_to_iter+0x419/0x880 lib/iov_iter.c:362
shmem_file_read_iter+0xa09/0x12b0 mm/shmem.c:3167
do_iter_readv_writev+0x88a/0xa30
vfs_iter_read+0x278/0x760 fs/read_write.c:923
lo_read_simple drivers/block/loop.c:283 [inline]
do_req_filebacked drivers/block/loop.c:516 [inline]
loop_handle_cmd drivers/block/loop.c:1910 [inline]
loop_process_work+0x20fc/0x3750 drivers/block/loop.c:1945
loop_workfn+0x48/0x60 drivers/block/loop.c:1969
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was stored to memory at:
memcpy_from_iter lib/iov_iter.c:73 [inline]
iterate_bvec include/linux/iov_iter.h:123 [inline]
iterate_and_advance2 include/linux/iov_iter.h:304 [inline]
iterate_and_advance include/linux/iov_iter.h:328 [inline]
__copy_from_iter lib/iov_iter.c:249 [inline]
copy_page_from_iter_atomic+0x12b7/0x3100 lib/iov_iter.c:481
copy_folio_from_iter_atomic include/linux/uio.h:201 [inline]
generic_perform_write+0x8d1/0x1080 mm/filemap.c:4066
shmem_file_write_iter+0x2ba/0x2f0 mm/shmem.c:3221
do_iter_readv_writev+0x88a/0xa30
vfs_iter_write+0x44d/0xd40 fs/read_write.c:988
lo_write_bvec drivers/block/loop.c:243 [inline]
lo_write_simple drivers/block/loop.c:264 [inline]
do_req_filebacked drivers/block/loop.c:511 [inline]
loop_handle_cmd drivers/block/loop.c:1910 [inline]
loop_process_work+0x15e6/0x3750 drivers/block/loop.c:1945
loop_workfn+0x48/0x60 drivers/block/loop.c:1969
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
__alloc_pages_noprof+0x9a7/0xe00 mm/page_alloc.c:4756
alloc_pages_mpol_noprof+0x299/0x990 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2345 [inline]
folio_alloc_noprof+0x1db/0x310 mm/mempolicy.c:2352
filemap_alloc_folio_noprof+0xa6/0x440 mm/filemap.c:1010
__filemap_get_folio+0xac4/0x1550 mm/filemap.c:1952
block_write_begin+0x6e/0x2b0 fs/buffer.c:2226
exfat_write_begin+0xfb/0x400 fs/exfat/inode.c:434
exfat_extend_valid_size fs/exfat/file.c:556 [inline]
exfat_file_write_iter+0x474/0xfb0 fs/exfat/file.c:591
do_iter_readv_writev+0x88a/0xa30
vfs_writev+0x56a/0x14f0 fs/read_write.c:1064
do_pwritev fs/read_write.c:1165 [inline]
__do_sys_pwritev2 fs/read_write.c:1224 [inline]
__se_sys_pwritev2+0x280/0x470 fs/read_write.c:1215
__x64_sys_pwritev2+0x11f/0x1a0 fs/read_write.c:1215
x64_sys_call+0x2edb/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:329
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 6021 Comm: syz.0.15 Not tainted 6.12.0-rc3-syzkaller-g6485cf5ea253-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
=====================================================


Tested on:

commit: 6485cf5e Merge tag 'hid-for-linus-2024101301' of git:/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13b50030580000
kernel config: https://syzkaller.appspot.com/x/.config?x=5242e0e980477c72
dashboard link: https://syzkaller.appspot.com/bug?extid=01218003be74b5e1213a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1151c727980000

Yuezh...@sony.com

unread,
Oct 16, 2024, 10:20:41 PMOct 16
to syzbot, linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com
#syz test

On Sat, Oct 5, 2024 at 8:02 PM syzbot <syzbot+012180...@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: e32cde8d2bd7 Merge tag 'sched_ext-for-6.12-rc1-fixes-1'
> of..
> git tree: upstream
> console+strace:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/log.txt?x=16cf7d
> d0580000__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBXZY
> WyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwVy5
> 7mr5yQIbTA6$
> kernel config:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/.config?x=b1fd45
> f2013d812f__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBX
> ZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwV
> y57mr50IfSXOd$
> dashboard link:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/bug?extid=012180
> 03be74b5e1213a__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8U
> UVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2h
> OwVy57mr5-IoYOKx$
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian)
> 2.40
> syz repro:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/repro.syz?x=11cf
> 7dd0580000__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVB
> XZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOw
> Vy57mr58TvVCus$
> C reproducer:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/repro.c?x=11d06
> 580580000__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBXZ
> YWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwVy
> 57mr5w2Sgp57$
>
> Downloadable assets:
> disk image:
> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/16
> d4da549bf4/disk-e32cde8d.raw.xz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6
> NhWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0
> CGeGE0kSF4M2hOwVy57mr54CRCyjy$
> vmlinux:
> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/a01
> bc9a0e174/vmlinux-e32cde8d.xz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6N
> hWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0C
> GeGE0kSF4M2hOwVy57mr5_9fwsZ2$
> kernel image:
> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/93f
> 4dfad6909/bzImage-e32cde8d.xz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6N
> hWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0C
> GeGE0kSF4M2hOwVy57mr54HU84Yj$
> mounted in repro:
> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/43
> 3ba0700154/mount_0.gz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWI
> Wcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0k
> SF4M2hOwVy57mr51x55siW$
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by:
> mailto:syzbot+012180...@syzkaller.appspotmail.com
> https://urldefense.com/v3/__https://goo.gl/tpsmEJ__;!!JmoZiZGBv3RvKRSx!_E
> FM31JxDI_sBC6NhWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-
> btBmzePMIOD0CGeGE0kSF4M2hOwVy57mr50hLBEHu$ for more information
> about syzbot.
> syzbot engineers can be reached at mailto:syzk...@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://urldefense.com/v3/__https://goo.gl/tpsmEJ*status__;Iw!!JmoZiZGBv3R
> vKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4Tu
> epNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwVy57mr55Eybub8$ for how to
0001-exfat-check-alignment-before-extending-valid_size.patch

syzbot

unread,
Oct 16, 2024, 10:57:05 PMOct 16
to linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com, yuezh...@sony.com
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+012180...@syzkaller.appspotmail.com
Tested-by: syzbot+012180...@syzkaller.appspotmail.com

Tested on:

commit: c964ced7 Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12c43030580000
kernel config: https://syzkaller.appspot.com/x/.config?x=5242e0e980477c72
dashboard link: https://syzkaller.appspot.com/bug?extid=01218003be74b5e1213a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1738345f980000

Note: testing is done by a robot and is best-effort only.

Yuezh...@sony.com

unread,
Oct 16, 2024, 11:33:01 PMOct 16
to syzbot, linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com
#syz test

On Sat, Oct 5, 2024 at 8:02 PM syzbot <syzbot+012180...@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: e32cde8d2bd7 Merge tag 'sched_ext-for-6.12-rc1-fixes-1'
> of..
> git tree: upstream
> console+strace:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/log.txt?x=16cf7d
> d0580000__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBXZY
> WyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwVy5
> 7mr5yQIbTA6$
> kernel config:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/.config?x=b1fd45
> f2013d812f__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBX
> ZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwV
> y57mr50IfSXOd$
> dashboard link:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/bug?extid=012180
> 03be74b5e1213a__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8U
> UVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2h
> OwVy57mr5-IoYOKx$
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian)
> 2.40
0001-exfat-use-sync_inode_metadata-to-writeback-inode.patch

syzbot

unread,
Oct 17, 2024, 12:18:04 AMOct 17
to linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com, yuezh...@sony.com
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+012180...@syzkaller.appspotmail.com
Tested-by: syzbot+012180...@syzkaller.appspotmail.com

Tested on:

commit: c964ced7 Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15ce345f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=5242e0e980477c72
dashboard link: https://syzkaller.appspot.com/bug?extid=01218003be74b5e1213a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=15ca345f980000

Yuezh...@sony.com

unread,
Oct 17, 2024, 5:49:36 AMOct 17
to syzbot, linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com
#syz test

On Sat, Oct 5, 2024 at 8:02 PM syzbot <syzbot+012180...@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: e32cde8d2bd7 Merge tag 'sched_ext-for-6.12-rc1-fixes-1'
> of..
> git tree: upstream
> console+strace:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/log.txt?x=16cf7d
> d0580000__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBXZY
> WyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwVy5
> 7mr5yQIbTA6$
> kernel config:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/.config?x=b1fd45
> f2013d812f__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBX
> ZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwV
> y57mr50IfSXOd$
> dashboard link:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/bug?extid=012180
> 03be74b5e1213a__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8U
> UVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2h
> OwVy57mr5-IoYOKx$
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian)
> 2.40
> syz repro:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/repro.syz?x=11cf
> 7dd0580000__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVB
> XZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOw
> Vy57mr58TvVCus$
> C reproducer:
> https://urldefense.com/v3/__https://syzkaller.appspot.com/x/repro.c?x=11d06
> 580580000__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBXZ
> YWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwVy
> 57mr5w2Sgp57$
>
> Downloadable assets:
> disk image:
> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/16
> d4da549bf4/disk-e32cde8d.raw.xz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6
> NhWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0
> CGeGE0kSF4M2hOwVy57mr54CRCyjy$
> vmlinux:
> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/a01
> bc9a0e174/vmlinux-e32cde8d.xz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6N
> hWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0C
> GeGE0kSF4M2hOwVy57mr5_9fwsZ2$
> kernel image:
> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/93f
> 4dfad6909/bzImage-e32cde8d.xz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6N
> hWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0C
> GeGE0kSF4M2hOwVy57mr54HU84Yj$
> mounted in repro:
> https://urldefense.com/v3/__https://storage.googleapis.com/syzbot-assets/43
> 3ba0700154/mount_0.gz__;!!JmoZiZGBv3RvKRSx!_EFM31JxDI_sBC6NhWwWI
> Wcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-btBmzePMIOD0CGeGE0k
> SF4M2hOwVy57mr51x55siW$
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by:
> mailto:syzbot+012180...@syzkaller.appspotmail.com
> https://urldefense.com/v3/__https://goo.gl/tpsmEJ__;!!JmoZiZGBv3RvKRSx!_E
> FM31JxDI_sBC6NhWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4TuepNTA3X-
> btBmzePMIOD0CGeGE0kSF4M2hOwVy57mr50hLBEHu$ for more information
> about syzbot.
> syzbot engineers can be reached at mailto:syzk...@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://urldefense.com/v3/__https://goo.gl/tpsmEJ*status__;Iw!!JmoZiZGBv3R
> vKRSx!_EFM31JxDI_sBC6NhWwWIWcja8UUVBXZYWyhK0O9vUuSsqy-ZOla4Tu
> epNTA3X-btBmzePMIOD0CGeGE0kSF4M2hOwVy57mr55Eybub8$ for how to
v2-0001-exfat-use-sync_inode_metadata-to-writeback-inode.patch

syzbot

unread,
Oct 17, 2024, 6:11:03 AMOct 17
to linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com, yuezh...@sony.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in __exfat_get_dentry_set

loop0: detected capacity change from 0 to 256
exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x726052d3, utbl_chksum : 0xe619d30d)
=====================================================
BUG: KMSAN: uninit-value in __exfat_get_dentry_set+0x10ca/0x14d0 fs/exfat/dir.c:804
__exfat_get_dentry_set+0x10ca/0x14d0 fs/exfat/dir.c:804
exfat_get_dentry_set+0x58/0xec0 fs/exfat/dir.c:859
__exfat_write_inode+0x3c1/0xe30 fs/exfat/inode.c:46
exfat_write_inode+0x15f/0x250 fs/exfat/inode.c:109
write_inode fs/fs-writeback.c:1503 [inline]
__writeback_single_inode+0x8da/0x1290 fs/fs-writeback.c:1723
writeback_single_inode+0x32f/0x9c0 fs/fs-writeback.c:1779
sync_inode_metadata+0xa4/0xe0 fs/fs-writeback.c:2849
exfat_truncate+0x839/0xd00 fs/exfat/file.c:212
exfat_write_failed fs/exfat/inode.c:421 [inline]
exfat_direct_IO+0x5ae/0x910 fs/exfat/inode.c:485
generic_file_direct_write+0x275/0x6a0 mm/filemap.c:3977
__generic_file_write_iter+0x242/0x460 mm/filemap.c:4141
exfat_file_write_iter+0x894/0xfb0 fs/exfat/file.c:576
do_iter_readv_writev+0x88a/0xa30
vfs_writev+0x56a/0x14f0 fs/read_write.c:1064
do_pwritev fs/read_write.c:1165 [inline]
__do_sys_pwritev2 fs/read_write.c:1224 [inline]
__se_sys_pwritev2+0x280/0x470 fs/read_write.c:1215
__x64_sys_pwritev2+0x11f/0x1a0 fs/read_write.c:1215
x64_sys_call+0x2edb/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:329
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was stored to memory at:
memcpy_to_iter lib/iov_iter.c:65 [inline]
iterate_bvec include/linux/iov_iter.h:123 [inline]
iterate_and_advance2 include/linux/iov_iter.h:304 [inline]
iterate_and_advance include/linux/iov_iter.h:328 [inline]
_copy_to_iter+0xe53/0x2b30 lib/iov_iter.c:185
copy_page_to_iter+0x419/0x880 lib/iov_iter.c:362
shmem_file_read_iter+0xa09/0x12b0 mm/shmem.c:3167
do_iter_readv_writev+0x88a/0xa30
vfs_iter_read+0x278/0x760 fs/read_write.c:923
lo_read_simple drivers/block/loop.c:283 [inline]
do_req_filebacked drivers/block/loop.c:516 [inline]
loop_handle_cmd drivers/block/loop.c:1910 [inline]
loop_process_work+0x20fc/0x3750 drivers/block/loop.c:1945
loop_workfn+0x48/0x60 drivers/block/loop.c:1969
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was stored to memory at:
memcpy_from_iter lib/iov_iter.c:73 [inline]
iterate_bvec include/linux/iov_iter.h:123 [inline]
iterate_and_advance2 include/linux/iov_iter.h:304 [inline]
iterate_and_advance include/linux/iov_iter.h:328 [inline]
__copy_from_iter lib/iov_iter.c:249 [inline]
copy_page_from_iter_atomic+0x12b7/0x3100 lib/iov_iter.c:481
copy_folio_from_iter_atomic include/linux/uio.h:201 [inline]
generic_perform_write+0x8d1/0x1080 mm/filemap.c:4066
shmem_file_write_iter+0x2ba/0x2f0 mm/shmem.c:3221
do_iter_readv_writev+0x88a/0xa30
vfs_iter_write+0x44d/0xd40 fs/read_write.c:988
lo_write_bvec drivers/block/loop.c:243 [inline]
lo_write_simple drivers/block/loop.c:264 [inline]
do_req_filebacked drivers/block/loop.c:511 [inline]
loop_handle_cmd drivers/block/loop.c:1910 [inline]
loop_process_work+0x15e6/0x3750 drivers/block/loop.c:1945
loop_workfn+0x48/0x60 drivers/block/loop.c:1969
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
__alloc_pages_noprof+0x9a7/0xe00 mm/page_alloc.c:4756
alloc_pages_mpol_noprof+0x299/0x990 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2345 [inline]
folio_alloc_noprof+0x1db/0x310 mm/mempolicy.c:2352
filemap_alloc_folio_noprof+0xa6/0x440 mm/filemap.c:1010
__filemap_get_folio+0xac4/0x1550 mm/filemap.c:1952
block_write_begin+0x6e/0x2b0 fs/buffer.c:2226
exfat_write_begin+0xfb/0x410 fs/exfat/inode.c:434
exfat_extend_valid_size fs/exfat/file.c:531 [inline]
exfat_file_write_iter+0x474/0xfb0 fs/exfat/file.c:566
do_iter_readv_writev+0x88a/0xa30
vfs_writev+0x56a/0x14f0 fs/read_write.c:1064
do_pwritev fs/read_write.c:1165 [inline]
__do_sys_pwritev2 fs/read_write.c:1224 [inline]
__se_sys_pwritev2+0x280/0x470 fs/read_write.c:1215
__x64_sys_pwritev2+0x11f/0x1a0 fs/read_write.c:1215
x64_sys_call+0x2edb/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:329
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 5994 Comm: syz.0.15 Not tainted 6.12.0-rc3-syzkaller-gc964ced77262-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
=====================================================


Tested on:

commit: c964ced7 Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16ab745f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=5242e0e980477c72
dashboard link: https://syzkaller.appspot.com/bug?extid=01218003be74b5e1213a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1615e830580000

Namjae Jeon

unread,
Oct 19, 2024, 12:01:23 AMOct 19
to syzbot, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com, yuezh...@sony.com
#syz test
0001-exfat-fix-uninit-value-use-in-__exfat_get_dentry_set.patch

syzbot

unread,
Oct 19, 2024, 1:20:04 AMOct 19
to linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com, yuezh...@sony.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in __exfat_get_dentry_set

loop0: detected capacity change from 0 to 256
exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x726052d3, utbl_chksum : 0xe619d30d)
=====================================================
BUG: KMSAN: uninit-value in __exfat_get_dentry_set+0x10ca/0x1500 fs/exfat/dir.c:810
__exfat_get_dentry_set+0x10ca/0x1500 fs/exfat/dir.c:810
exfat_get_dentry_set+0x57/0xf60 fs/exfat/dir.c:865
shmem_file_read_iter+0xa09/0x12b0 mm/shmem.c:3162
do_iter_readv_writev+0x88a/0xa30
vfs_iter_read+0x278/0x760 fs/read_write.c:923
lo_read_simple drivers/block/loop.c:283 [inline]
do_req_filebacked drivers/block/loop.c:516 [inline]
loop_handle_cmd drivers/block/loop.c:1910 [inline]
loop_process_work+0x20fc/0x3750 drivers/block/loop.c:1945
loop_workfn+0x48/0x60 drivers/block/loop.c:1969
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was stored to memory at:
memcpy_from_iter lib/iov_iter.c:73 [inline]
iterate_bvec include/linux/iov_iter.h:123 [inline]
iterate_and_advance2 include/linux/iov_iter.h:304 [inline]
iterate_and_advance include/linux/iov_iter.h:328 [inline]
__copy_from_iter lib/iov_iter.c:249 [inline]
copy_page_from_iter_atomic+0x12b7/0x3100 lib/iov_iter.c:481
copy_folio_from_iter_atomic include/linux/uio.h:201 [inline]
generic_perform_write+0x8d1/0x1080 mm/filemap.c:4066
shmem_file_write_iter+0x2ba/0x2f0 mm/shmem.c:3216
do_iter_readv_writev+0x88a/0xa30
vfs_iter_write+0x44d/0xd40 fs/read_write.c:988
lo_write_bvec drivers/block/loop.c:243 [inline]
lo_write_simple drivers/block/loop.c:264 [inline]
do_req_filebacked drivers/block/loop.c:511 [inline]
loop_handle_cmd drivers/block/loop.c:1910 [inline]
loop_process_work+0x15e6/0x3750 drivers/block/loop.c:1945
loop_workfn+0x48/0x60 drivers/block/loop.c:1969
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
__alloc_pages_noprof+0x9a7/0xe00 mm/page_alloc.c:4756
alloc_pages_mpol_noprof+0x299/0x990 mm/mempolicy.c:2265
alloc_pages_noprof mm/mempolicy.c:2345 [inline]
folio_alloc_noprof+0x1db/0x310 mm/mempolicy.c:2352
filemap_alloc_folio_noprof+0xa6/0x440 mm/filemap.c:1010
__filemap_get_folio+0xac4/0x1550 mm/filemap.c:1952
block_write_begin+0x6e/0x2b0 fs/buffer.c:2226
exfat_write_begin+0xfb/0x400 fs/exfat/inode.c:434
exfat_extend_valid_size fs/exfat/file.c:553 [inline]
exfat_file_write_iter+0x474/0xfb0 fs/exfat/file.c:588
do_iter_readv_writev+0x88a/0xa30
vfs_writev+0x56a/0x14f0 fs/read_write.c:1064
do_pwritev fs/read_write.c:1165 [inline]
__do_sys_pwritev2 fs/read_write.c:1224 [inline]
__se_sys_pwritev2+0x280/0x470 fs/read_write.c:1215
__x64_sys_pwritev2+0x11f/0x1a0 fs/read_write.c:1215
x64_sys_call+0x2edb/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:329
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 6003 Comm: syz.0.15 Not tainted 6.12.0-rc3-syzkaller-g3d5ad2d4eca3-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
=====================================================


Tested on:

commit: 3d5ad2d4 Merge tag 'bpf-fixes' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16155240580000
kernel config: https://syzkaller.appspot.com/x/.config?x=5242e0e980477c72
dashboard link: https://syzkaller.appspot.com/bug?extid=01218003be74b5e1213a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=142fbc5f980000

Namjae Jeon

unread,
Oct 29, 2024, 12:17:16 AM (10 days ago) Oct 29
to syzbot, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com, yuezh...@sony.com
#syz test

On Sat, Oct 5, 2024 at 11:32 PM syzbot
<syzbot+012180...@syzkaller.appspotmail.com> wrote:
>
0001-exfat-fix-uninit-value-in-__exfat_get_dentry_set.patch

syzbot

unread,
Oct 29, 2024, 5:28:05 AM (10 days ago) Oct 29
to linki...@kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, sj155...@samsung.com, syzkall...@googlegroups.com, yuezh...@sony.com
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+012180...@syzkaller.appspotmail.com
Tested-by: syzbot+012180...@syzkaller.appspotmail.com

Tested on:

commit: e42b1a9a Merge tag 'spi-fix-v6.12-rc5' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=142ec687980000
kernel config: https://syzkaller.appspot.com/x/.config?x=8c11ea7cf15419ce
dashboard link: https://syzkaller.appspot.com/bug?extid=01218003be74b5e1213a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=16bbef57980000
Reply all
Reply to author
Forward
0 new messages