From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f67.google.com (mail-pj1-f67.google.com [209.85.216.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0FD862F6193 for ; Tue, 31 Mar 2026 02:04:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.67 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774922667; cv=none; b=qU9Cs568Z/vyFPIU1qP6tZ8++FmDhGzUdwZmwrqjEZO5reX9mYlISugyp0ZB03VJpgUI4sLhnJJMG33+D9NzS3CoBXSY7o5smQbgrX4IeTc+YCEbxAzH/PaslHUqYTaNbuXIQvqWm6o5SIg5ND0T8TFiZE/VFDee6wy+NuJKOd8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774922667; c=relaxed/simple; bh=3M7q3qLCb/JST6Xd0RriK4HqXOPx6QT42eKqc8AhY5E=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=Su3DKnInE5Zd3MM5mTwtH1IpScFsX4duRHbxIrkXfX0Nxb5AN6/NKrC49DKTFDbo1bPiICBlwXQpVGtvKNTbOQq/QoF62SbpLAWCPaALMRWdnzbiuHtuzC3hPSQJhm2zqnSE3wXg98KbuRz1J8MZ6dBaMfTm5RfWelw8k+L8f9s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KYgbIv2A; arc=none smtp.client-ip=209.85.216.67 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KYgbIv2A" Received: by mail-pj1-f67.google.com with SMTP id 98e67ed59e1d1-35d90833cacso1786003a91.2 for ; Mon, 30 Mar 2026 19:04:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1774922665; x=1775527465; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=JB5ukn0uCa6Qxbx0qz8yn2WmcmtYcqs4HV7hWyMTUYc=; b=KYgbIv2AI1MbGN7t9XCdtbjcd8CZtHf+oKIjnEBHTAhVVz2xYPbc3Txrg5BsmpI91q ZF5JaQ+Bnfvqs+HDCsFiFitzULTtl44MtK8MULmHij+nG1TP96Vp65DwfAQCsufIj8Au 8xQkGoF9I1lj+yaFBxl+bVA3HJAaH/v5h5x0PvkAgfuzuUbH6l7skB+hcGxiPzxjToTE zPYQmXkCZKvQCi+1llqfLPpNhANPvpoKMyGOR9gnJtI74jLLaxjdnJP/pT/IuKFAc0zr PGcoj2VvMqJSRRaYUDL3/aDoRyAUwj/wZvlFmnPGet13sah2kCVaQsUi1F0OuSKhRQts htHQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774922665; x=1775527465; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=JB5ukn0uCa6Qxbx0qz8yn2WmcmtYcqs4HV7hWyMTUYc=; b=n6XWa2yog1opEA0DhMXrXZ1F0bqQ4YInmwkAEpBL6qxBb2x/HwJ/SL6ESXUbKjEH2K vl5BsXnqvoTwH2/y9f79x8vw2izNQpNgGUAdWPdG/OmkSCdeJKQOuisUKvyrTuewSBlv mqD8w60o4co5x0uh0rAQb4XQMwWQBElf2vQJ2NUb8FCLoQ/WT/AIAZu7QObdohx1Ps88 L8MLD7taWXY3y4sreT6VFqdrU0dJJqMZP+nJDHJpOPL7sCEx/avbmRjbJNuFEZFzTWBI i0dDCjEDUtMaae3RKTUanIa6cIgZSBI4+x6fZP72XhbYFR0EepF8YC2D0y27UGyakj7D YLTg== X-Forwarded-Encrypted: i=1; AJvYcCXLiDAz/EKg1NWufdLZHXAa5/oU8EyD60hAhqgLPmsbVdUD62gRJRvK1Qsge/kPgZC03f6BL/1U0jSkDfw=@vger.kernel.org X-Gm-Message-State: AOJu0YzG+ur6PvdV7xDM6nfpsnx4PAJgkuO4CmJHD34XH9rF3W+kXH0r 0H7RpTNYgJblA5550R/ujpOmE3bquywfTc4IbTWWkIkxiXuGRyNHZ/tH9yW8RXDIWmT2S/io X-Gm-Gg: ATEYQzz7x2YNB/IEQNWtUpdoYvo1JZe7d5iqCVHgaBj/1q56FawY/uBPbMwJzQE4Juk cQXGukvIOPn39F9lp6v+0WNp1IgVYqK31AZEPwarRotTLgjJN+4hjO5e70JcwoykYMjEJfWWddM rwVw0YZQX4P1S4TuHVgrtQ9iy5GMtiPUWckgdkvp9r0TzYGr7pD1EcqR3gY0jJ/VTwBoKiCUBiF 2vTKte3BR83n9K5PmRrI11PWTVHyHURXdSM0Vem8brJcF4myqCnIsSu7eG6e7YCyP3M6JYoIhC1 rUXDOgRN0EIYmDJ69Um1CP3Pe14VJuYAUCLAkAg730pTodVS7EeaRvYcsjFw+8erBAkDZJ1Y8pY 7FfPnryfCJsUSwxjoG2h7QRaCS5CYc8X15SRoUk5/he/YOQf0GBepKrDdW8SdtFvcBQZT0jk/ck 2wu7X01KcLWq5qxmjztYY9jm+7wymqTwt2IHDsqn13/qT70uAb X-Received: by 2002:a17:90b:4f42:b0:35b:e52a:6fe5 with SMTP id 98e67ed59e1d1-35c2ff26762mr13137266a91.5.1774922665300; Mon, 30 Mar 2026 19:04:25 -0700 (PDT) Received: from [172.19.21.154] ([112.64.138.194]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-35da9ef1b70sm4251292a91.16.2026.03.30.19.04.21 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 30 Mar 2026 19:04:24 -0700 (PDT) Message-ID: <6f0fcf07-9ee1-43a7-a0ac-0a5200acf099@gmail.com> Date: Tue, 31 Mar 2026 10:04:19 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] mm, KMSAN: Add missing shadow memory initialization in special allocation paths To: Usama Anjum , Andrew Morton , Vlastimil Babka , Suren Baghdasaryan , Michal Hocko , John Hubbard , Brendan Jackman , Johannes Weiner , Zi Yan Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, syzbot+2aee6839a252e612ce34@syzkaller.appspotmail.com References: <20260330-fix-kmsan-v1-1-e9c672a4b9eb@gmail.com> <1dfbe39b-d052-4810-81d8-2ab74263bd7a@arm.com> Content-Language: en-US From: Ke Zhao In-Reply-To: <1dfbe39b-d052-4810-81d8-2ab74263bd7a@arm.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 3/31/2026 4:39 AM, Usama Anjum wrote: > On 30/03/2026 9:36 am, Ke Zhao wrote: >> Some page allocation paths that call post_alloc_hook() but skip >> kmsan_alloc_page(), leaving stale KMSAN shadow on allocated pages. >> Fix this by explicitly calling kmsan_alloc_page() after they >> successfully get new pages. >> >> Reported-by: syzbot+2aee6839a252e612ce34@syzkaller.appspotmail.com >> Closes: https://syzkaller.appspot.com/bug?extid=2aee6839a252e612ce34 >> >> Signed-off-by: Ke Zhao >> --- >> mm/page_alloc.c | 13 +++++++++++++ >> 1 file changed, 13 insertions(+) >> >> diff --git a/mm/page_alloc.c b/mm/page_alloc.c >> index 2d4b6f1a554e..6435e8708ef4 100644 >> --- a/mm/page_alloc.c >> +++ b/mm/page_alloc.c >> @@ -5189,6 +5189,10 @@ unsigned long alloc_pages_bulk_noprof(gfp_t gfp, int preferred_nid, >> >> prep_new_page(page, 0, gfp, 0); >> set_page_refcounted(page); >> + >> + trace_mm_page_alloc(page, 0, gfp, ac.migratetype); >> + kmsan_alloc_page(page, 0, gfp); >> + >> page_array[nr_populated++] = page; >> } >> >> @@ -6911,6 +6915,12 @@ static void split_free_frozen_pages(struct list_head *list, gfp_t gfp_mask) >> int i; >> >> post_alloc_hook(page, order, gfp_mask); >> + /* >> + * Initialize KMSAN state right after post_alloc_hook(). >> + * This prepares the pages for subsequent outer callers >> + * that might free sub-pages after the split. >> + */ >> + kmsan_alloc_page(page, order, gfp_mask); >> if (!order) >> continue; >> >> @@ -7117,6 +7127,9 @@ int alloc_contig_frozen_range_noprof(unsigned long start, unsigned long end, >> >> check_new_pages(head, order); >> prep_new_page(head, order, gfp_mask, 0); >> + >> + trace_mm_page_alloc(page, order, gfp_mask, get_pageblock_migratetype(page)); >> + kmsan_alloc_page(page, order, gfp_mask); > There is no page defined in this function. Most probably you wanted > to use head in place of page here. > Sorry, I just simply compiled with the change but add wrong code into the commit. I can hardly make an environment that could trigger the same warning here. I'm not sure if I can trigger syzbot to test this. > How did you compiled and tested this change? > >> } else { >> ret = -EINVAL; >> WARN(true, "PFN range: requested [%lu, %lu), allocated [%lu, %lu)\n", >> >> --- >> base-commit: bbeb83d3182abe0d245318e274e8531e5dd7a948 >> change-id: 20260325-fix-kmsan-e291f752a949 >> >> Best regards, > > Thanks, > Usama