[syzbot] [hfs?] KMSAN: uninit-value in __hfs_ext_cache_extent

From: syzbot
Date: Wed May 29 2024 - 03:06:34 EST


Hello,

syzbot found the following issue on:

HEAD commit: 614da38e2f7a Merge tag 'hid-for-linus-2024051401' of git:/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1701d634980000
kernel config: https://syzkaller.appspot.com/x/.config?x=f5d2cbf33633f507
dashboard link: https://syzkaller.appspot.com/bug?extid=ca5e77364a05ff2d8c8b
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/89eafb874b71/disk-614da38e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/356000512ad9/vmlinux-614da38e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/839c73939115/bzImage-614da38e.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ca5e77364a05ff2d8c8b@xxxxxxxxxxxxxxxxxxxxxxxxx

loop1: detected capacity change from 0 to 64
=====================================================
BUG: KMSAN: uninit-value in __hfs_ext_read_extent fs/hfs/extent.c:160 [inline]
BUG: KMSAN: uninit-value in __hfs_ext_cache_extent+0x69f/0x7e0 fs/hfs/extent.c:179
__hfs_ext_read_extent fs/hfs/extent.c:160 [inline]
__hfs_ext_cache_extent+0x69f/0x7e0 fs/hfs/extent.c:179
hfs_file_truncate+0x769/0xd30 fs/hfs/extent.c:526
hfs_inode_setattr+0x998/0xab0 fs/hfs/inode.c:652
notify_change+0x1a07/0x1af0 fs/attr.c:497
do_truncate fs/open.c:65 [inline]
do_ftruncate+0x8d3/0xc00 fs/open.c:181
do_sys_ftruncate fs/open.c:199 [inline]
__do_sys_ftruncate fs/open.c:207 [inline]
__se_sys_ftruncate fs/open.c:205 [inline]
__x64_sys_ftruncate+0x133/0x280 fs/open.c:205
x64_sys_call+0x247a/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:78
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
slab_post_alloc_hook mm/slub.c:3877 [inline]
slab_alloc_node mm/slub.c:3918 [inline]
__do_kmalloc_node mm/slub.c:4038 [inline]
__kmalloc+0x6e4/0x1060 mm/slub.c:4052
kmalloc include/linux/slab.h:632 [inline]
hfs_find_init+0x91/0x250 fs/hfs/bfind.c:21
hfs_file_truncate+0x3c5/0xd30 fs/hfs/extent.c:512
hfs_inode_setattr+0x998/0xab0 fs/hfs/inode.c:652
notify_change+0x1a07/0x1af0 fs/attr.c:497
do_truncate fs/open.c:65 [inline]
do_ftruncate+0x8d3/0xc00 fs/open.c:181
do_sys_ftruncate fs/open.c:199 [inline]
__do_sys_ftruncate fs/open.c:207 [inline]
__se_sys_ftruncate fs/open.c:205 [inline]
__x64_sys_ftruncate+0x133/0x280 fs/open.c:205
x64_sys_call+0x247a/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:78
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 PID: 8137 Comm: syz-executor.1 Not tainted 6.9.0-syzkaller-02707-g614da38e2f7a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup