Re: [BUG] fs/btrfs: KASAN "args" initialization gripe in btrfs_ioctl_get_csums()

[Qu Wenruo]

在 2026/7/15 06:02, Paul E. McKenney 写道:
> Hello!
>
> This should be considered at least as much a bug report as a fix.  Though
> this "fix" does make KASAN happy, so there is that.  ;-)
>
> The following compiler diagnostic appears when building with KASAN on ARM:
>
> In file included from ./include/asm-generic/rwonce.h:26,
>                   from ./arch/arm64/include/asm/rwonce.h:81,
>                   from ./include/linux/compiler.h:369,
>                   from ./include/linux/array_size.h:5,
>                   from ./include/linux/kernel.h:16,
>                   from fs/btrfs/ioctl.c:6:
> In function ‘instrument_copy_from_user_before’,
>      inlined from ‘_inline_copy_from_user’ at ./include/linux/uaccess.h:184:2,
>      inlined from ‘copy_from_user’ at ./include/linux/uaccess.h:222:9,
>      inlined from ‘btrfs_ioctl_get_csums.isra’ at fs/btrfs/ioctl.c:5220:6:
> ./include/linux/kasan-checks.h:38:27: warning: ‘args’ may be used uninitialized [-Wmaybe-uninitialized]
>     38 | #define kasan_check_write __kasan_check_write
> ./include/linux/instrumented.h:146:9: note: in expansion of macro ‘kasan_check_write’
>    146 |         kasan_check_write(to, n);
>        |         ^~~~~~~~~~~~~~~~~
> fs/btrfs/ioctl.c: In function ‘btrfs_ioctl_get_csums.isra’:
> ./include/linux/kasan-checks.h:20:6: note: by argument 1 of type ‘const volatile void *’ to ‘__kasan_check_write’ declared here
>     20 | bool __kasan_check_write(const volatile void *p, unsigned int size);
>        |      ^~~~~~~~~~~~~~~~~~~
> fs/btrfs/ioctl.c:5201:43: note: ‘args’ declared here
>   5201 |         struct btrfs_ioctl_get_csums_args args;
>        |                                           ^~~~
>
> Fix (or at least suppress) this by initializing "args" to "{ 0 }".

This is a little weird, as @args is immediately written with 
copy_from_user().

So I'd say this may be specific to certain compiler version.
Mind to provide the name and version of the compiler?

But still, initializing the structure to zero makes no harm.

I'll convert the report into a proper commit during merge.

Reviewed-by: Qu Wenruo <wqu@xxxxxxxx>

Thanks,
Qu

> Signed-off-by: Paul E. McKenney <paulmck@xxxxxxxxxx>
>
> diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
> index 9d47d16394fc56..1e28f1411e20f8 100644
> --- a/fs/btrfs/ioctl.c
> +++ b/fs/btrfs/ioctl.c
> @@ -5198,7 +5198,7 @@ static int btrfs_ioctl_get_csums(struct file *file, void __user *argp)
>   	struct btrfs_inode *inode = BTRFS_I(vfs_inode);
>   	struct btrfs_fs_info *fs_info = inode->root->fs_info;
>   	struct btrfs_root *root = inode->root;
> -	struct btrfs_ioctl_get_csums_args args;
> +	struct btrfs_ioctl_get_csums_args args = { 0 };
>   	BTRFS_PATH_AUTO_FREE(path);
>   	const u64 ino = btrfs_ino(inode);
>   	const u32 csum_size = fs_info->csum_size;