For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] iommufd: Initialize batch structures in map/unmap paths
Author: kartikey406@gmail.com


#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

KMSAN reported uninitialized values in batch processing for both the
map and unmap paths:

1. In iopt_area_fill_domains(), struct pfn_reader pfns was used
   uninitialized, causing warnings in batch_add_pfn_num() when
   accessing batch->npfns[] and batch->pfns[] arrays.

2. In __iopt_area_unfill_domain(), struct pfn_batch batch was used
   uninitialized, causing warnings in batch_from_domain() when
   accessing the same arrays.

Although some initialization functions are called on these structures,
they do not initialize all fields, leaving arrays and padding bytes
uninitialized.

Initialize both structures to zero to ensure all fields start in a
known state.

Reported-by: syzbot+df28076a30d726933015@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/iommu/iommufd/pages.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c
index dbe51ecb9a20..8c7681192a07 100644
--- a/drivers/iommu/iommufd/pages.c
+++ b/drivers/iommu/iommufd/pages.c
@@ -1735,7 +1735,7 @@ static void __iopt_area_unfill_domain(struct iopt_area *area,
 	unsigned long start_index = iopt_area_index(area);
 	unsigned long unmapped_end_index = start_index;
 	u64 backup[BATCH_BACKUP_SIZE];
-	struct pfn_batch batch;
+	struct pfn_batch batch = {};
 
 	lockdep_assert_held(&pages->mutex);
 
@@ -1897,7 +1897,7 @@ int iopt_area_fill_domains(struct iopt_area *area, struct iopt_pages *pages)
 	unsigned long done_all_end_index;
 	struct iommu_domain *domain;
 	unsigned long unmap_index;
-	struct pfn_reader pfns;
+	struct pfn_reader pfns = {};
 	unsigned long index;
 	int rc;
 
-- 
2.43.0