Re: [BUG] fs/btrfs: KASAN "args" initialization gripe in btrfs_ioctl_get_csums()

[Paul E. McKenney]

On Wed, Jul 15, 2026 at 07:25:49AM +0930, Qu Wenruo wrote:
> 
> 
> 在 2026/7/15 06:02, Paul E. McKenney 写道:
> > Hello!
> > 
> > This should be considered at least as much a bug report as a fix.  Though
> > this "fix" does make KASAN happy, so there is that.  ;-)
> > 
> > The following compiler diagnostic appears when building with KASAN on ARM:
> > 
> > In file included from ./include/asm-generic/rwonce.h:26,
> >                   from ./arch/arm64/include/asm/rwonce.h:81,
> >                   from ./include/linux/compiler.h:369,
> >                   from ./include/linux/array_size.h:5,
> >                   from ./include/linux/kernel.h:16,
> >                   from fs/btrfs/ioctl.c:6:
> > In function ‘instrument_copy_from_user_before’,
> >      inlined from ‘_inline_copy_from_user’ at ./include/linux/uaccess.h:184:2,
> >      inlined from ‘copy_from_user’ at ./include/linux/uaccess.h:222:9,
> >      inlined from ‘btrfs_ioctl_get_csums.isra’ at fs/btrfs/ioctl.c:5220:6:
> > ./include/linux/kasan-checks.h:38:27: warning: ‘args’ may be used uninitialized [-Wmaybe-uninitialized]
> >     38 | #define kasan_check_write __kasan_check_write
> > ./include/linux/instrumented.h:146:9: note: in expansion of macro ‘kasan_check_write’
> >    146 |         kasan_check_write(to, n);
> >        |         ^~~~~~~~~~~~~~~~~
> > fs/btrfs/ioctl.c: In function ‘btrfs_ioctl_get_csums.isra’:
> > ./include/linux/kasan-checks.h:20:6: note: by argument 1 of type ‘const volatile void *’ to ‘__kasan_check_write’ declared here
> >     20 | bool __kasan_check_write(const volatile void *p, unsigned int size);
> >        |      ^~~~~~~~~~~~~~~~~~~
> > fs/btrfs/ioctl.c:5201:43: note: ‘args’ declared here
> >   5201 |         struct btrfs_ioctl_get_csums_args args;
> >        |                                           ^~~~
> > 
> > Fix (or at least suppress) this by initializing "args" to "{ 0 }".
> 
> This is a little weird, as @args is immediately written with
> copy_from_user().

I was wondering about that myself.  Perhaps it refuses to assume that
the entirety of args is overwritten?

> So I'd say this may be specific to certain compiler version.
> Mind to provide the name and version of the compiler?

gcc version 11.5.0 20240719 (Red Hat 11.5.0-14) (GCC)

> But still, initializing the structure to zero makes no harm.
> 
> I'll convert the report into a proper commit during merge.
> 
> Reviewed-by: Qu Wenruo <wqu@xxxxxxxx>

Thank you very much!

							Thanx, Paul

> Thanks,
> Qu
> 
> > 
> > Signed-off-by: Paul E. McKenney <paulmck@xxxxxxxxxx>
> > 
> > diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
> > index 9d47d16394fc56..1e28f1411e20f8 100644
> > --- a/fs/btrfs/ioctl.c
> > +++ b/fs/btrfs/ioctl.c
> > @@ -5198,7 +5198,7 @@ static int btrfs_ioctl_get_csums(struct file *file, void __user *argp)
> >   	struct btrfs_inode *inode = BTRFS_I(vfs_inode);
> >   	struct btrfs_fs_info *fs_info = inode->root->fs_info;
> >   	struct btrfs_root *root = inode->root;
> > -	struct btrfs_ioctl_get_csums_args args;
> > +	struct btrfs_ioctl_get_csums_args args = { 0 };
> >   	BTRFS_PATH_AUTO_FREE(path);
> >   	const u64 ino = btrfs_ino(inode);
> >   	const u32 csum_size = fs_info->csum_size;
> > 
>