All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jens Axboe <axboe@kernel.dk>
To: Alexander Potapenko <glider@google.com>
Cc: linux-block@vger.kernel.org,
	Willem de Bruijn <willemb@google.com>,
	Dmitriy Vyukov <dvyukov@google.com>
Subject: Re: null_handle_cmd() doesn't initialize data when reading
Date: Wed, 20 Nov 2019 16:12:17 -0700	[thread overview]
Message-ID: <d204a9d7-3722-5e55-d6cc-3018e366981e@kernel.dk> (raw)
In-Reply-To: <CAG_fn=VBHmBgqLi35tD27NRLH2tEZLH=Y+rTfZ3rKNz9ipG+jQ@mail.gmail.com>

On 11/15/19 3:16 AM, Alexander Potapenko wrote:
> Hi Jens,
> 
> I'm debugging an issue in nullb driver reported by KMSAN at QEMU startup.
> There are numerous reports like the one below when checking nullb for
> different partition types.
> Basically, read_dev_sector() allocates a cache page which is then
> wrapped into a bio and passed to the device driver, but never
> initialized.
> 
> I've tracked the problem down to a call to null_handle_cmd(cmd,
> /*sector*/0, /*nr_sectors*/8, /*op*/0).
> Turns out all the if-branches in this function are skipped, so neither
> of null_handle_throttled(), null_handle_flush(),
> null_handle_badblocks(), null_handle_memory_backed(),
> null_handle_zoned() is executed, and we proceed directly to
> nullb_complete_cmd().
> 
> As a result, the pages read from the nullb device are never
> initialized, at least at boot time.
> How can we fix this?
> 
> This bug may also have something to do with
> https://groups.google.com/d/topic/syzkaller-bugs/d0fmiL9Vi9k/discussion.

Probably just want to have the read path actually memset() them to
zero, or something like that.

-- 
Jens Axboe


  reply	other threads:[~2019-11-21  2:00 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-11-15 10:16 null_handle_cmd() doesn't initialize data when reading Alexander Potapenko
2019-11-20 23:12 ` Jens Axboe [this message]
2019-11-22 11:58   ` Alexander Potapenko
2019-11-25  4:01     ` Chaitanya Kulkarni
2020-05-10 10:03       ` Alexander Potapenko
2020-05-10 16:20         ` Bart Van Assche
2020-05-11 12:58           ` Alexander Potapenko
2020-05-11 13:01             ` Damien Le Moal
2020-05-11 13:09               ` Alexander Potapenko
2020-05-11 23:18             ` Bart Van Assche
2020-05-12  1:25               ` Bart Van Assche
2020-05-12  1:42                 ` Damien Le Moal
2020-05-12  2:43                   ` Bart Van Assche
2020-05-12  3:23                     ` Damien Le Moal

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=d204a9d7-3722-5e55-d6cc-3018e366981e@kernel.dk \
    --to=axboe@kernel.dk \
    --cc=dvyukov@google.com \
    --cc=glider@google.com \
    --cc=linux-block@vger.kernel.org \
    --cc=willemb@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.