From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 43C7A39281D
	for <linux-kernel@vger.kernel.org>; Tue, 12 May 2026 21:47:34 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1778622455; cv=none; b=Ujki3jGgeCO0jOEyx2Ls7Ma/FWnjwoBiRncU1thyItNQohUSfPGAX6Up2rEAx9UWKIs1VGlM2Ffn790n1up98XA7kyNn1d5XugnGDg30Fa4+logDV/xoAEvaCNHin6xQjyvtkJpkt4ips8apv0J6L9jNy0hLa5lk/vU8rt2Vv3o=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1778622455; c=relaxed/simple;
	bh=KvSjEgCXQMoXNf5Sg1l9vwpiFrQ+xO0tKCt6MXsr+34=;
	h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References:
	 Mime-Version:Content-Type; b=aDQDV/XH8i70iRMoX52mk5+AoJB4X/SSuB7Q5k+3Sd6EYT2R/adcn0hJjUDqbK1PejUJACXjGOYB6Pf2UwqySo64WRhMdyK+s7MKGp4GBO4YJZlCvRFMudSv00cGOtlXA6gwC+vdGJzrtUEnIun2i5lnfXclu7gycbqgZj9Qyyg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=sjpMzdns; arc=none smtp.client-ip=10.30.226.201
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="sjpMzdns"
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 960DCC2BCB0;
	Tue, 12 May 2026 21:47:34 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org;
	s=korg; t=1778622454;
	bh=KvSjEgCXQMoXNf5Sg1l9vwpiFrQ+xO0tKCt6MXsr+34=;
	h=Date:From:To:Cc:Subject:In-Reply-To:References:From;
	b=sjpMzdnsWpnquJx+uihdS8zzT7vrmx9p1pU+nmnk7aK/7w8/wJ8uUGyYepDfpeXDB
	 oHpPb3TcSsKHlcSEsM9iv6v9NR7XHKzc3of9PeuPmKxw0n3evtPLb71XvaGpHucLuA
	 d6O+5ZTDBUh0AnPl+tjVJO0PpRhtlq9ix0ub59sQ=
Date: Tue, 12 May 2026 14:47:33 -0700
From: Andrew Morton <akpm@linux-foundation.org>
To: Kartik Nair <contact.kartikn@gmail.com>
Cc: minchan@kernel.org, senozhatsky@chromium.org, linux-mm@kvack.org,
 linux-kernel@vger.kernel.org,
 syzbot+8f77ff6144a73f0cf71b@syzkaller.appspotmail.com, Nhat Pham
 <nphamcs@gmail.com>
Subject: Re: [PATCH] zsmalloc: zero-initialize zspage memory to prevent
 KMSAN uninit reads
Message-Id: <20260512144733.9132c83e392a109743e92f71@linux-foundation.org>
In-Reply-To: <20260511213658.25273-1-contact.kartikn@gmail.com>
References: <20260511213658.25273-1-contact.kartikn@gmail.com>
X-Mailer: Sylpheed 3.7.0 (GTK+ 2.24.33; x86_64-pc-linux-gnu)
Precedence: bulk
X-Mailing-List: linux-kernel@vger.kernel.org
List-Id: <linux-kernel.vger.kernel.org>
List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Tue, 12 May 2026 03:06:58 +0530 Kartik Nair <contact.kartikn@gmail.com> wrote:

> Pages allocated via alloc_zpdesc() use alloc_pages_node() without
> __GFP_ZERO, leaving physical memory uninitialized. When a compressed
> object spans two physical pages in a zspage, zs_obj_read_sg_begin()
> sets up a scatterlist pointing directly at the raw second page. If the
> second page was freshly allocated and never written beyond the object
> boundary, KMSAN detects reads of uninitialized memory downstream in
> the decompressor (e.g. sw842_decompress reading the CRC trailer).
> 
> Fix this by passing __GFP_ZERO to alloc_zpdesc() in alloc_zspage() so
> all pages backing a zspage are zero-initialized at allocation time.
> 
> Reported-by: syzbot+8f77ff6144a73f0cf71b@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=8f77ff6144a73f0cf71b
> Signed-off-by: Kartik Nair <contact.kartikn@gmail.com>

Thanks.

> --- a/mm/zsmalloc.c
> +++ b/mm/zsmalloc.c
> @@ -951,7 +951,7 @@ static struct zspage *alloc_zspage(struct zs_pool *pool,
>  	for (i = 0; i < class->pages_per_zspage; i++) {
>  		struct zpdesc *zpdesc;
>  
> -		zpdesc = alloc_zpdesc(gfp, nid);
> +		zpdesc = alloc_zpdesc(gfp | __GFP_ZERO, nid);
>  		if (!zpdesc) {
>  			while (--i >= 0) {
>  				zpdesc_dec_zone_page_state(zpdescs[i]);

Decompressing uninitialized memory sounds rather bad, so I'll add a
cc:stable to this.

I think the Fixes: target is 56e5a103a721 ("zsmalloc: prefer the the
original page's node for compressed data").  Can people please check
this when reviewing?