From nobody Sat Feb 7 11:31:29 2026 Received: from mail-oo1-f71.google.com (mail-oo1-f71.google.com [209.85.161.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DD871190664 for ; Sat, 24 Jan 2026 11:24:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.71 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769253896; cv=none; b=jQu7ipUd1pImzFFaROw5gvewXlEY957T52sQo4BDxJjQL2yQSU/0haf0GLdU2jYpejxzuGO2aGg2T+REVcRpXU648J6da90RImMqksNV6Jij74Bn/BEwVgapig7/1D0/DVsJDWcbRrdWluRE2iLKoS23bUPTSR1NZgm66r5TA78= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769253896; c=relaxed/simple; bh=LNA7eggXRXajr/koHeQxqhE3BXCk4kmA4JWqy47vZKE=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=u8OqTOdCMPhldCJ4dpcQIzZ9wc+yxBf7D2MTqs8JAzI5KFiZmNVL0cC6/WUEJZwHAxwzPUoXTVKUH0YCDRUQNMF4TBDDUHmVUAxffl1qGC0b2hn9pKcJCU6947zDL8HhusXNm0vL1fhiNl1g/tQR6WS/o/rml39IyqrR5yPitQ8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f71.google.com with SMTP id 006d021491bc7-662ca3cb667so3172103eaf.2 for ; Sat, 24 Jan 2026 03:24:54 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769253894; x=1769858694; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=4xKkOSh5CrPnOEK4AL2mMeSKScoTHkrzlPwLTtX+Jww=; b=jlN4I8Xm9udd03N4CiZi0v31F/f2KCqdudHkKIKlIV6JlXjJPi64ygxZ0/s/3AqcKv kINrU79HOUGkNomE5eZD4FaRRGLpKMJTGiVVQk3o05KY7V/is/pMhcc3Nt3Ew21NQmO5 PNNFE4ti43VkFRVVPjmRUr4kBOnTJANFhyPisai7ITbgyzQHRgC/53WIG2KAFOsmzL4Z XGme0NC6JelZJnctdeW3DXXWfgIzA8n1WisB8YNxVmo6m4G7DqwHTgs6KP88ogabtIcG fgzTbMpXrThRWiTXXIr213u3maE/VNcBI6UDq+ET4t1C/cU8XmeC5f/Ue3xUfURaQzqd SjXA== X-Gm-Message-State: AOJu0YzgSgR1z7mgDI/ssTCR/mTjOT5dlueFAXZ4lIuGSlJR/0bbtoul 1Wjce0qEXLfxrsHUaCPNe8f/zidZD92OltaMxvakfjK2Zrh2X/XWC36IzTMqaKN7yEZUQZVh2E7 1yR76sIvyrbKjRRYJYvRIQmBN7kMjyiKkKmFax1jEqb84DZnvl6fZV0e0sjU= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:22a0:b0:662:bd3d:9f1d with SMTP id 006d021491bc7-662cab4242emr2889743eaf.51.1769253893855; Sat, 24 Jan 2026 03:24:53 -0800 (PST) Date: Sat, 24 Jan 2026 03:24:53 -0800 In-Reply-To: <69746a86.050a0220.226181.0002.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6974ac05.a00a0220.33ccc7.0005.GAE@google.com> Subject: Forwarded: [PATCH] iommufd: Initialize batch structures in map/unmap paths From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] iommufd: Initialize batch structures in map/unmap paths Author: kartikey406@gmail.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git= master KMSAN reported uninitialized values in batch processing for both the map and unmap paths: 1. In iopt_area_fill_domains(), struct pfn_reader pfns was used uninitialized, causing warnings in batch_add_pfn_num() when accessing batch->npfns[] and batch->pfns[] arrays. 2. In __iopt_area_unfill_domain(), struct pfn_batch batch was used uninitialized, causing warnings in batch_from_domain() when accessing the same arrays. Although some initialization functions are called on these structures, they do not initialize all fields, leaving arrays and padding bytes uninitialized. Initialize both structures to zero to ensure all fields start in a known state. Reported-by: syzbot+df28076a30d726933015@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey --- drivers/iommu/iommufd/pages.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c index dbe51ecb9a20..8c7681192a07 100644 --- a/drivers/iommu/iommufd/pages.c +++ b/drivers/iommu/iommufd/pages.c @@ -1735,7 +1735,7 @@ static void __iopt_area_unfill_domain(struct iopt_are= a *area, unsigned long start_index =3D iopt_area_index(area); unsigned long unmapped_end_index =3D start_index; u64 backup[BATCH_BACKUP_SIZE]; - struct pfn_batch batch; + struct pfn_batch batch =3D {}; =20 lockdep_assert_held(&pages->mutex); =20 @@ -1897,7 +1897,7 @@ int iopt_area_fill_domains(struct iopt_area *area, st= ruct iopt_pages *pages) unsigned long done_all_end_index; struct iommu_domain *domain; unsigned long unmap_index; - struct pfn_reader pfns; + struct pfn_reader pfns =3D {}; unsigned long index; int rc; =20 --=20 2.43.0