Hi,
We would like to report the following bug which has been found by our
modified version of syzkaller.
======================================================
description: KMSAN: uninit-value in generic_bin_search
affected file: fs/btrfs/ctree.c
kernel version: 6.2.0-rc5
kernel commit: 41c66f47061608dc1fd493eebce198f0e74cc2d7
git tree: kmsan
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=a9a22da1efde3af6
crash reproducer: attached
======================================================
Crash log:
======================================================
BUG: KMSAN: uninit-value in btrfs_comp_cpu_keys fs/btrfs/ctree.c:753 [inline]
BUG: KMSAN: uninit-value in comp_keys fs/btrfs/ctree.c:729 [inline]
BUG: KMSAN: uninit-value in generic_bin_search+0x709/0xc20 fs/btrfs/ctree.c:913
btrfs_comp_cpu_keys fs/btrfs/ctree.c:753 [inline]
comp_keys fs/btrfs/ctree.c:729 [inline]
generic_bin_search+0x709/0xc20 fs/btrfs/ctree.c:913
search_for_key_slot fs/btrfs/ctree.c:1872 [inline]
search_leaf fs/btrfs/ctree.c:1964 [inline]
btrfs_search_slot+0x3ebc/0x4850 fs/btrfs/ctree.c:2177
update_dev_stat_item fs/btrfs/volumes.c:7648 [inline]
btrfs_run_dev_stats+0x3b7/0x17d0 fs/btrfs/volumes.c:7725
commit_cowonly_roots+0x350/0x1120 fs/btrfs/transaction.c:1288
btrfs_commit_transaction+0x22b0/0x6980 fs/btrfs/transaction.c:2398
btrfs_commit_super+0x136/0x180 fs/btrfs/disk-io.c:4604
close_ctree+0x3e5/0x14e0 fs/btrfs/disk-io.c:4758
btrfs_put_super+0x38/0x50 fs/btrfs/super.c:81
generic_shutdown_super+0x1c5/0x520 fs/super.c:492
kill_anon_super+0x33/0x70 fs/super.c:1086
btrfs_kill_super+0x39/0x60 fs/btrfs/super.c:2132
deactivate_locked_super+0xbd/0x140 fs/super.c:332
deactivate_super+0x151/0x160 fs/super.c:363
cleanup_mnt+0x6b1/0x720 fs/namespace.c:1291
__cleanup_mnt+0x1e/0x30 fs/namespace.c:1298
task_work_run+0x236/0x2d0 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0x2a7/0x320 kernel/entry/common.c:171
exit_to_user_mode_prepare+0x172/0x230 kernel/entry/common.c:203
__syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
syscall_exit_to_user_mode+0x27/0x140 kernel/entry/common.c:296
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was created at:
__alloc_pages+0x767/0xee0 mm/page_alloc.c:5572
alloc_pages+0xa9a/0xd90 mm/mempolicy.c:2286
folio_alloc+0x41/0x100 mm/mempolicy.c:2296
filemap_alloc_folio+0xa5/0x450 mm/filemap.c:972
__filemap_get_folio+0xe7c/0x1960 mm/filemap.c:1966
pagecache_get_page+0x46/0x270 mm/folio-compat.c:98
find_or_create_page include/linux/pagemap.h:612 [inline]
alloc_extent_buffer+0x6b8/0x3000 fs/btrfs/extent_io.c:4498
btrfs_find_create_tree_block+0x40/0x50 fs/btrfs/disk-io.c:1002
btrfs_init_new_buffer fs/btrfs/extent-tree.c:4873 [inline]
btrfs_alloc_tree_block+0x361/0x2020 fs/btrfs/extent-tree.c:4992
__btrfs_cow_block+0x557/0x1f60 fs/btrfs/ctree.c:541
btrfs_cow_block+0x75c/0xa10 fs/btrfs/ctree.c:696
btrfs_search_slot+0x1727/0x4850 fs/btrfs/ctree.c:2141
update_dev_stat_item fs/btrfs/volumes.c:7648 [inline]
btrfs_run_dev_stats+0x3b7/0x17d0 fs/btrfs/volumes.c:7725
commit_cowonly_roots+0x350/0x1120 fs/btrfs/transaction.c:1288
btrfs_commit_transaction+0x22b0/0x6980 fs/btrfs/transaction.c:2398
btrfs_commit_super+0x136/0x180 fs/btrfs/disk-io.c:4604
close_ctree+0x3e5/0x14e0 fs/btrfs/disk-io.c:4758
btrfs_put_super+0x38/0x50 fs/btrfs/super.c:81
generic_shutdown_super+0x1c5/0x520 fs/super.c:492
kill_anon_super+0x33/0x70 fs/super.c:1086
btrfs_kill_super+0x39/0x60 fs/btrfs/super.c:2132
deactivate_locked_super+0xbd/0x140 fs/super.c:332
deactivate_super+0x151/0x160 fs/super.c:363
cleanup_mnt+0x6b1/0x720 fs/namespace.c:1291
__cleanup_mnt+0x1e/0x30 fs/namespace.c:1298
task_work_run+0x236/0x2d0 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0x2a7/0x320 kernel/entry/common.c:171
exit_to_user_mode_prepare+0x172/0x230 kernel/entry/common.c:203
__syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
syscall_exit_to_user_mode+0x27/0x140 kernel/entry/common.c:296
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
CPU: 0 PID: 8513 Comm: syz-executor.0 Not tainted
6.2.0-rc5-00010-g41c66f470616 #8
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
--
Thanks and Regards,
Dipanjan