Re: [PATCH] mm/vmalloc: fix KMSAN uninit-value warning in decay_va_pool_node()

[Qing Wang]

On Thu, 02 Apr 2026 at 23:45, Uladzislau Rezki <urezki@xxxxxxxxx> wrote:
> > KMSAN reported an uninit-value warning when accessing vmap_area->list
> > in decay_va_pool_node():
> > 
> >   BUG: KMSAN: uninit-value in __list_del_entry_valid include/linux/list.h:-1 [inline]
> >   BUG: KMSAN: uninit-value in __list_del_entry include/linux/list.h:223 [inline]
> >   BUG: KMSAN: uninit-value in list_del_init include/linux/list.h:295 [inline]
> >   BUG: KMSAN: uninit-value in decay_va_pool_node+0xf78/0x1dd0 mm/vmalloc.c:2255
> > 
> >   Uninit was created at:
> >    kmem_cache_alloc_node_noprof+0x3cd/0x12d0 mm/slub.c:4918
> >    alloc_vmap_area+0x327/0x2e30 mm/vmalloc.c:2065
> > 
> > The root cause is that if node_alloc() fail and the va is allocated via
> > kmem_cache_alloc_node() by alloc_vmap_area(), va->list will be uninitialized.
> > 
> > Fix this by explicitly initializing va->list after allocation.
> > 
> > Reported-by: syzbot+37b7f6cd519f7fb8d32a@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Closes: https://syzkaller.appspot.com/bug?extid=37b7f6cd519f7fb8d32a
> >
> I can not access two above links. Are they valid? I would like to have
> a look at report.

I recheck the 'Closes' link and it's valid.

> 
> > Signed-off-by: Qing Wang <wangqing7171@xxxxxxxxx>
> > ---
> >  mm/vmalloc.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/mm/vmalloc.c b/mm/vmalloc.c
> > index 61caa55a4402..8aebbb51e178 100644
> > --- a/mm/vmalloc.c
> > +++ b/mm/vmalloc.c
> > @@ -2071,6 +2071,7 @@ static struct vmap_area *alloc_vmap_area(unsigned long size,
> >  		 * to avoid false negatives.
> >  		 */
> >  		kmemleak_scan_area(&va->rb_node, SIZE_MAX, gfp_mask);
> > +		INIT_LIST_HEAD(&va->list);
> >  	}
> >
> va->list does not require to be initialized. Because:
> 
> 	spin_lock(&vn->busy.lock);
> 	insert_vmap_area(va, &vn->busy.root, &vn->busy.head);
> 	spin_unlock(&vn->busy.lock);
> 
> when a node is inserted into list_head, its next/prev pointers are
> properly set by the list_add().
> 
> Or, am i missing something?
> 
> --
> Uladzislau Rezki

First, va->list is inserted into the list_head when insert_vmap_area()
calls link_va(). However, if find_va_links() returns NULL, link_va()
will not be called, leaving va->list uninitialized.

Second, even if link_va() is called, list_add() will still invoke
__list_add_valid() which reads va->list fields (prev/next). Under KMSAN,
this will also report a same uninit-value error.

--
Best Regards,
Qing