Re: [PATCH] mm/shmem: fix uninitialized folio in shmem_symlink

[Baolin Wang]

On 12/24/25 5:40 PM, Barry Song wrote:
> From: Barry Song <baohua@xxxxxxxxxx>
>
> Uninitialized folio allocated in shmem_symlink() may be accessed
> during swap-out, causing KMSAN BUG:
>
> BUG: KMSAN: uninit-value in is_folio_zero_filled mm/page_io.c:188 [inline]
> BUG: KMSAN: uninit-value in swap_writeout+0x468/0x1390 mm/page_io.c:263
>   is_folio_zero_filled mm/page_io.c:188 [inline]
>   swap_writeout+0x468/0x1390 mm/page_io.c:263
>   shmem_writeout+0x1abb/0x1f60 mm/shmem.c:1662
>   writeout mm/vmscan.c:649 [inline]
>   pageout mm/vmscan.c:698 [inline]
>   shrink_folio_list+0x5920/0x7fc0 mm/vmscan.c:1418
>   evict_folios+0x999d/0xbf30 mm/vmscan.c:4711
>   try_to_shrink_lruvec+0x12b6/0x17e0 mm/vmscan.c:4874
>   lru_gen_shrink_lruvec mm/vmscan.c:5023 [inline]
>   shrink_lruvec+0x46f/0x4f10 mm/vmscan.c:5784
>   shrink_node_memcgs mm/vmscan.c:6020 [inline]
>
> This patch clears the remaining part to zero for the portion not
> covered by memcpy from symname.
>
> Cc: Hugh Dickins <hughd@xxxxxxxxxx>
> Cc: Baolin Wang <baolin.wang@xxxxxxxxxxxxxxxxx>
> Reported-by: syzbot+178fff6149127421c2cc@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://lore.kernel.org/lkml/6949370f.050a0220.1b4e0c.0038.GAE@xxxxxxxxxx/
> Signed-off-by: Barry Song <baohua@xxxxxxxxxx>
> ---

LGTM. Thanks.
Reviewed-by: Baolin Wang <baolin.wang@xxxxxxxxxxxxxxxxx>

>   mm/shmem.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/mm/shmem.c b/mm/shmem.c
> index ec6c01378e9d..835900a08f51 100644
> --- a/mm/shmem.c
> +++ b/mm/shmem.c
> @@ -4131,6 +4131,7 @@ static int shmem_symlink(struct mnt_idmap *idmap, struct inode *dir,
>   			goto out_remove_offset;
>   		inode->i_op = &shmem_symlink_inode_operations;
>   		memcpy(folio_address(folio), symname, len);
> +		folio_zero_range(folio, len, folio_size(folio) - len);
>   		folio_mark_uptodate(folio);
>   		folio_mark_dirty(folio);
>   		folio_unlock(folio);