All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tetsuo Handa <penguin-kernel-JPay3/Yim36HaxMnTkn67Xf5DAMn2ifp@public.gmane.org>
To: syzbot
	<syzbot+048585f3f4227bb2b49b-Pl5Pbv+GP7P466ipTTIvnc23WoclnBCfAL8bYrjMMd8@public.gmane.org>,
	konishi.ryusuke-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org,
	syzkaller-bugs-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
Cc: glider-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org,
	linux-nilfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: [PATCH] nilfs2: fix incomplete initialization in nilfs_direct_assign_p()
Date: Sun, 26 Mar 2023 15:32:07 +0900	[thread overview]
Message-ID: <6c1d39bc-b19b-becf-821e-8cc9db8b4167@I-love.SAKURA.ne.jp> (raw)
In-Reply-To: <0000000000000d710705f63f014c-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>

syzbot is reporting uninit value at nilfs_add_checksums_on_logs() [1], for
nilfs_direct_assign_p() from nilfs_direct_assign() from nilfs_bmap_assign()
does not initialize "struct nilfs_binfo_dat"->bi_pad field.

We need to initialize sizeof("union nilfs_binfo"->bi_dat) bytes if
nilfs_write_dat_node_binfo() from nilfs_segctor_assign() copies it
and nilfs_add_checksums_on_logs() passes it to CRC function.

Reported-by: syzbot <syzbot+048585f3f4227bb2b49b-Pl5Pbv+GP7P466ipTTIvnc23WoclnBCfAL8bYrjMMd8@public.gmane.org>
Link: https://syzkaller.appspot.com/bug?extid=048585f3f4227bb2b49b [1]
Signed-off-by: Tetsuo Handa <penguin-kernel-JPay3/Yim36HaxMnTkn67Xf5DAMn2ifp@public.gmane.org>
---
I'm not sure whether this can fix the bug, for a reproducer is not yet
available...

 fs/nilfs2/direct.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c
index a35f2795b242..4358b4581ec4 100644
--- a/fs/nilfs2/direct.c
+++ b/fs/nilfs2/direct.c
@@ -313,7 +313,8 @@ static int nilfs_direct_assign_p(struct nilfs_bmap *direct,
 	nilfs_direct_set_ptr(direct, key, blocknr);
 
 	binfo->bi_dat.bi_blkoff = cpu_to_le64(key);
-	binfo->bi_dat.bi_level = 0;
+	/* initialize bi_pad field together while assigning bi_level field */
+	*(u64 *) &binfo->bi_dat.bi_level = (u64) 0;
 
 	return 0;
 }
-- 
2.34.1


  parent reply	other threads:[~2023-03-26  6:32 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-03-06 17:55 [syzbot] [nilfs?] KMSAN: uninit-value in nilfs_add_checksums_on_logs syzbot
     [not found] ` <0000000000000d710705f63f014c-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>
2023-03-26  6:32   ` Tetsuo Handa [this message]
     [not found]     ` <6c1d39bc-b19b-becf-821e-8cc9db8b4167-JPay3/Yim36HaxMnTkn67Xf5DAMn2ifp@public.gmane.org>
2023-03-26  7:38       ` [PATCH] nilfs2: fix incomplete initialization in nilfs_direct_assign_p() Ryusuke Konishi
     [not found]         ` <CAKFNMokJ0_n6y3Wrc87WfhKA02ay4dqP7R_4XnonqDCj_Tuqcg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2023-03-26 10:13           ` [PATCH v2] " Tetsuo Handa
     [not found]             ` <1103c7b0-0e46-4a92-74ee-920bf9599a80-JPay3/Yim36HaxMnTkn67Xf5DAMn2ifp@public.gmane.org>
2023-03-26 10:27               ` [PATCH v3] nilfs2: initialize "struct nilfs_binfo_dat"->bi_pad field Tetsuo Handa
     [not found]                 ` <85f48e7e-a1dc-69ac-4e28-7449036cc8b3-JPay3/Yim36HaxMnTkn67Xf5DAMn2ifp@public.gmane.org>
2023-03-26 12:51                   ` Ryusuke Konishi
2023-03-26 15:21 ` [PATCH] " Ryusuke Konishi
2023-03-26 15:21   ` Ryusuke Konishi
2023-04-17 17:35 ` [PATCH] nilfs2: initialize unused bytes in segment summary blocks Ryusuke Konishi
2023-04-17 17:35   ` Ryusuke Konishi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=6c1d39bc-b19b-becf-821e-8cc9db8b4167@I-love.SAKURA.ne.jp \
    --to=penguin-kernel-jpay3/yim36haxmntkn67xf5damn2ifp@public.gmane.org \
    --cc=glider-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org \
    --cc=konishi.ryusuke-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \
    --cc=linux-nilfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=syzbot+048585f3f4227bb2b49b-Pl5Pbv+GP7P466ipTTIvnc23WoclnBCfAL8bYrjMMd8@public.gmane.org \
    --cc=syzkaller-bugs-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.