Received-SPF: pass (google.com: domain of linux-crypto+bounces-4038-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Precedence: bulk
MIME-Version: 1.0
References: <000000000000dcd2ae06178bccb0@google.com> <CANp29Y5k1S5ETBibTzWv7y6jiKevOhMYg0LYqM+PGvuFYiM14A@mail.gmail.com>
 <yyxz7mm542wyswp7o6t7oagqq543scntvvtrvros3iqvfjewb2@3ksyadymtnrn>
In-Reply-To: <yyxz7mm542wyswp7o6t7oagqq543scntvvtrvros3iqvfjewb2@3ksyadymtnrn>
From: Ard Biesheuvel <ardb@kernel.org>
Date: Mon, 6 May 2024 12:52:27 +0200
Message-ID: <CAMj1kXGFHBCG+aX3XSEXZh_ZYQ0dSVBAW6cCqkqmw+tB5bLeow@mail.gmail.com>
Subject: Re: [syzbot] [crypto?] KMSAN: uninit-value in skcipher_walk_virt
To: Kent Overstreet <kent.overstreet@linux.dev>
Cc: Aleksandr Nogikh <nogikh@google.com>, 
	syzbot <syzbot+97b4444a5bd7bf30b3a8@syzkaller.appspotmail.com>, davem@davemloft.net, 
	herbert@gondor.apana.org.au, linux-crypto@vger.kernel.org, 
	linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Content-Type: text/plain; charset="UTF-8"

On Sat, 4 May 2024 at 19:21, Kent Overstreet <kent.overstreet@linux.dev> wrote:
>
> This is odd - it seems to be req->base.flags that's uninitialized, and I
> can't find the code that's supposed to be initializing it - but bcachefs
> usage seems to be the same as all the other uses I'm looking at; if it
> is req->base.flags then other code must be buggy as well?
>

You seem to be missing a call to

skcipher_request_set_callback()

which initializes some (irrelevant in this case) async related fields
but also the flags field.