From: Barry Song Uninitialized folio allocated in shmem_symlink() may be accessed during swap-out, causing KMSAN BUG: BUG: KMSAN: uninit-value in is_folio_zero_filled mm/page_io.c:188 [inline] BUG: KMSAN: uninit-value in swap_writeout+0x468/0x1390 mm/page_io.c:263 is_folio_zero_filled mm/page_io.c:188 [inline] swap_writeout+0x468/0x1390 mm/page_io.c:263 shmem_writeout+0x1abb/0x1f60 mm/shmem.c:1662 writeout mm/vmscan.c:649 [inline] pageout mm/vmscan.c:698 [inline] shrink_folio_list+0x5920/0x7fc0 mm/vmscan.c:1418 evict_folios+0x999d/0xbf30 mm/vmscan.c:4711 try_to_shrink_lruvec+0x12b6/0x17e0 mm/vmscan.c:4874 lru_gen_shrink_lruvec mm/vmscan.c:5023 [inline] shrink_lruvec+0x46f/0x4f10 mm/vmscan.c:5784 shrink_node_memcgs mm/vmscan.c:6020 [inline] This patch clears the remaining part to zero for the portion not covered by memcpy from symname. Cc: Hugh Dickins Cc: Baolin Wang Reported-by: syzbot+178fff6149127421c2cc@syzkaller.appspotmail.com Closes: https://lore.kernel.org/lkml/6949370f.050a0220.1b4e0c.0038.GAE@google.com/ Signed-off-by: Barry Song --- mm/shmem.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/shmem.c b/mm/shmem.c index ec6c01378e9d..835900a08f51 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -4131,6 +4131,7 @@ static int shmem_symlink(struct mnt_idmap *idmap, struct inode *dir, goto out_remove_offset; inode->i_op = &shmem_symlink_inode_operations; memcpy(folio_address(folio), symname, len); + folio_zero_range(folio, len, folio_size(folio) - len); folio_mark_uptodate(folio); folio_mark_dirty(folio); folio_unlock(folio); -- 2.43.0