Re: [syzbot] [mm?] KMSAN: uninit-value in swap_writeout

[Barry Song]

>
> Uninit was created at:
>  __alloc_frozen_pages_noprof+0x421/0xab0 mm/page_alloc.c:5233
>  alloc_pages_mpol+0x328/0x860 mm/mempolicy.c:2486
>  folio_alloc_mpol_noprof+0x56/0x1d0 mm/mempolicy.c:2505
>  shmem_alloc_folio mm/shmem.c:1890 [inline]
>  shmem_alloc_and_add_folio+0xc56/0x1bd0 mm/shmem.c:1932
>  shmem_get_folio_gfp+0xad3/0x1fc0 mm/shmem.c:2556
>  shmem_get_folio mm/shmem.c:2662 [inline]
>  shmem_symlink+0x562/0xad0 mm/shmem.c:4129
>  vfs_symlink+0x42f/0x4c0 fs/namei.c:5514
>  do_symlinkat+0x2ae/0xbb0 fs/namei.c:5541

+Hugh and Baolin.

This happens in the shmem symlink path, where newly allocated
folios are not cleared for some reason. As a result,
is_folio_zero_filled() ends up reading uninitialized data.

Clearing newly allocated folios in shmem_get_folio_gfp() would
fix the issue, but it may not be the proper solution. We will
need Hugh and Baolin’s guidance to recommend an appropriate fix.

>  __do_sys_symlinkat fs/namei.c:5562 [inline]
>  __se_sys_symlinkat fs/namei.c:5559 [inline]
>  __ia32_sys_symlinkat+0xf5/0x180 fs/namei.c:5559
>  ia32_sys_call+0x385e/0x4340 arch/x86/include/generated/asm/syscalls_32.h:305
>  do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
>  __do_fast_syscall_32+0x15a/0x330 arch/x86/entry/syscall_32.c:307
>  do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:332
>  do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:370
>  entry_SYSENTER_compat_after_hwframe+0x84/0x8e
>
> CPU: 0 UID: 0 PID: 7862 Comm: syz.2.517 Tainted: G             L      syzkaller #0 PREEMPT(none)
> Tainted: [L]=SOFTLOCKUP
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
> =====================================================

Thanks
Barry