Messages in this thread |  | | From | Uladzislau Rezki <> | | Date | Thu, 2 Apr 2026 17:45:44 +0200 | | Subject | Re: [PATCH] mm/vmalloc: fix KMSAN uninit-value warning in decay_va_pool_node() |
| |
On Thu, Apr 02, 2026 at 04:14:13PM +0800, Qing Wang wrote: > KMSAN reported an uninit-value warning when accessing vmap_area->list > in decay_va_pool_node(): > > BUG: KMSAN: uninit-value in __list_del_entry_valid include/linux/list.h:-1 [inline] > BUG: KMSAN: uninit-value in __list_del_entry include/linux/list.h:223 [inline] > BUG: KMSAN: uninit-value in list_del_init include/linux/list.h:295 [inline] > BUG: KMSAN: uninit-value in decay_va_pool_node+0xf78/0x1dd0 mm/vmalloc.c:2255 > > Uninit was created at: > kmem_cache_alloc_node_noprof+0x3cd/0x12d0 mm/slub.c:4918 > alloc_vmap_area+0x327/0x2e30 mm/vmalloc.c:2065 > > The root cause is that if node_alloc() fail and the va is allocated via > kmem_cache_alloc_node() by alloc_vmap_area(), va->list will be uninitialized. > > Fix this by explicitly initializing va->list after allocation. > > Reported-by: syzbot+37b7f6cd519f7fb8d32a@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=37b7f6cd519f7fb8d32a > I can not access two above links. Are they valid? I would like to have a look at report.
> Signed-off-by: Qing Wang <wangqing7171@gmail.com> > --- > mm/vmalloc.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/mm/vmalloc.c b/mm/vmalloc.c > index 61caa55a4402..8aebbb51e178 100644 > --- a/mm/vmalloc.c > +++ b/mm/vmalloc.c > @@ -2071,6 +2071,7 @@ static struct vmap_area *alloc_vmap_area(unsigned long size, > * to avoid false negatives. > */ > kmemleak_scan_area(&va->rb_node, SIZE_MAX, gfp_mask); > + INIT_LIST_HEAD(&va->list); > } > va->list does not require to be initialized. Because:
spin_lock(&vn->busy.lock); insert_vmap_area(va, &vn->busy.root, &vn->busy.head); spin_unlock(&vn->busy.lock);
when a node is inserted into list_head, its next/prev pointers are properly set by the list_add().
Or, am i missing something?
-- Uladzislau Rezki
|  |