From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 1986E396B7B for ; Mon, 30 Mar 2026 20:39:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774903163; cv=none; b=GMCIbtsYc/jHFAaQ9JZa8Pjd47h87e77/iiMFbOVFRWF10j5qwLakA/72WL2TkA8PtgPK7pbhMXZ8M54hukUEb1+Yrxgv1+uutoIWxLU8yiInSJuuLrYKKLv8pEogz94KZeWFCHdyBlNVdKwlfOJDUH/utYruLLRchsaYKgDq+o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774903163; c=relaxed/simple; bh=57yEmJLr5ZH4sNztAyV4c9hHBxfBM+qcR9YdxTsp5s0=; h=Message-ID:Date:MIME-Version:Cc:Subject:To:References:From: In-Reply-To:Content-Type; b=WnBaMCSisrWiVIAHVtlDS7BhizMN0kMwFRaArdwif0dkY8F8s1UuC/CfZ44QgEwEIlfDJfpbKCHc8wBoUqFiZN5u6ZFjt5IuC1Inr1xILhFZZdOxsCoje7EwsW2l73R278rphDFhOj2VRxbOHiceMsf64wVbVQPmE36BB2rVmRE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b=l8LPnS44; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b="l8LPnS44" Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 7B98D2880; Mon, 30 Mar 2026 13:39:07 -0700 (PDT) Received: from [10.1.194.63] (e142334-100.cambridge.arm.com [10.1.194.63]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 7E71C3F7D8; Mon, 30 Mar 2026 13:39:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1774903153; bh=57yEmJLr5ZH4sNztAyV4c9hHBxfBM+qcR9YdxTsp5s0=; h=Date:Cc:Subject:To:References:From:In-Reply-To:From; b=l8LPnS44n+fwwNRwgxDikVoU6C12MVa7wcE3uFJGICd/Jo67jMkKvDRRq1PCWMVn3 ShCVzHwevb83snR2cJ9JQpBhw/m9WTfpD/IiRorgC23ySnRYp0EuGau2UkQGQklMO/ usGz1Vshh1seKIXi7EtMBkRVx0vK15331BbJ9F88= Message-ID: <1dfbe39b-d052-4810-81d8-2ab74263bd7a@arm.com> Date: Mon, 30 Mar 2026 21:39:09 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Cc: usama.anjum@arm.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, syzbot+2aee6839a252e612ce34@syzkaller.appspotmail.com Subject: Re: [PATCH] mm, KMSAN: Add missing shadow memory initialization in special allocation paths To: Ke Zhao , Andrew Morton , Vlastimil Babka , Suren Baghdasaryan , Michal Hocko , John Hubbard , Brendan Jackman , Johannes Weiner , Zi Yan References: <20260330-fix-kmsan-v1-1-e9c672a4b9eb@gmail.com> From: Usama Anjum Content-Language: en-US In-Reply-To: <20260330-fix-kmsan-v1-1-e9c672a4b9eb@gmail.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 30/03/2026 9:36 am, Ke Zhao wrote: > Some page allocation paths that call post_alloc_hook() but skip > kmsan_alloc_page(), leaving stale KMSAN shadow on allocated pages. > Fix this by explicitly calling kmsan_alloc_page() after they > successfully get new pages. > > Reported-by: syzbot+2aee6839a252e612ce34@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=2aee6839a252e612ce34 > > Signed-off-by: Ke Zhao > --- > mm/page_alloc.c | 13 +++++++++++++ > 1 file changed, 13 insertions(+) > > diff --git a/mm/page_alloc.c b/mm/page_alloc.c > index 2d4b6f1a554e..6435e8708ef4 100644 > --- a/mm/page_alloc.c > +++ b/mm/page_alloc.c > @@ -5189,6 +5189,10 @@ unsigned long alloc_pages_bulk_noprof(gfp_t gfp, int preferred_nid, > > prep_new_page(page, 0, gfp, 0); > set_page_refcounted(page); > + > + trace_mm_page_alloc(page, 0, gfp, ac.migratetype); > + kmsan_alloc_page(page, 0, gfp); > + > page_array[nr_populated++] = page; > } > > @@ -6911,6 +6915,12 @@ static void split_free_frozen_pages(struct list_head *list, gfp_t gfp_mask) > int i; > > post_alloc_hook(page, order, gfp_mask); > + /* > + * Initialize KMSAN state right after post_alloc_hook(). > + * This prepares the pages for subsequent outer callers > + * that might free sub-pages after the split. > + */ > + kmsan_alloc_page(page, order, gfp_mask); > if (!order) > continue; > > @@ -7117,6 +7127,9 @@ int alloc_contig_frozen_range_noprof(unsigned long start, unsigned long end, > > check_new_pages(head, order); > prep_new_page(head, order, gfp_mask, 0); > + > + trace_mm_page_alloc(page, order, gfp_mask, get_pageblock_migratetype(page)); > + kmsan_alloc_page(page, order, gfp_mask); There is no page defined in this function. Most probably you wanted to use head in place of page here. How did you compiled and tested this change? > } else { > ret = -EINVAL; > WARN(true, "PFN range: requested [%lu, %lu), allocated [%lu, %lu)\n", > > --- > base-commit: bbeb83d3182abe0d245318e274e8531e5dd7a948 > change-id: 20260325-fix-kmsan-e291f752a949 > > Best regards, Thanks, Usama