Hello!
This should be considered at least as much a bug report as a fix. Though
this "fix" does make KASAN happy, so there is that. ;-)
The following compiler diagnostic appears when building with KASAN on ARM:
In file included from ./include/asm-generic/rwonce.h:26,
from ./arch/arm64/include/asm/rwonce.h:81,
from ./include/linux/compiler.h:369,
from ./include/linux/array_size.h:5,
from ./include/linux/kernel.h:16,
from fs/btrfs/ioctl.c:6:
In function ‘instrument_copy_from_user_before’,
inlined from ‘_inline_copy_from_user’ at ./include/linux/uaccess.h:184:2,
inlined from ‘copy_from_user’ at ./include/linux/uaccess.h:222:9,
inlined from ‘btrfs_ioctl_get_csums.isra’ at fs/btrfs/ioctl.c:5220:6:
./include/linux/kasan-checks.h:38:27: warning: ‘args’ may be used uninitialized [-Wmaybe-uninitialized]
38 | #define kasan_check_write __kasan_check_write
./include/linux/instrumented.h:146:9: note: in expansion of macro ‘kasan_check_write’
146 | kasan_check_write(to, n);
| ^~~~~~~~~~~~~~~~~
fs/btrfs/ioctl.c: In function ‘btrfs_ioctl_get_csums.isra’:
./include/linux/kasan-checks.h:20:6: note: by argument 1 of type ‘const volatile void *’ to ‘__kasan_check_write’ declared here
20 | bool __kasan_check_write(const volatile void *p, unsigned int size);
| ^~~~~~~~~~~~~~~~~~~
fs/btrfs/ioctl.c:5201:43: note: ‘args’ declared here
5201 | struct btrfs_ioctl_get_csums_args args;
| ^~~~
Fix (or at least suppress) this by initializing "args" to "{ 0 }".
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 9d47d16394fc56..1e28f1411e20f8 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -5198,7 +5198,7 @@ static int btrfs_ioctl_get_csums(struct file *file, void __user *argp)
struct btrfs_inode *inode = BTRFS_I(vfs_inode);
struct btrfs_fs_info *fs_info = inode->root->fs_info;
struct btrfs_root *root = inode->root;
- struct btrfs_ioctl_get_csums_args args;
+ struct btrfs_ioctl_get_csums_args args = { 0 };
BTRFS_PATH_AUTO_FREE(path);
const u64 ino = btrfs_ino(inode);
const u32 csum_size = fs_info->csum_size;
在 2026/7/15 06:02, Paul E. McKenney 写道:
> Hello!
>
> This should be considered at least as much a bug report as a fix. Though
> this "fix" does make KASAN happy, so there is that. ;-)
>
> The following compiler diagnostic appears when building with KASAN on ARM:
>
> In file included from ./include/asm-generic/rwonce.h:26,
> from ./arch/arm64/include/asm/rwonce.h:81,
> from ./include/linux/compiler.h:369,
> from ./include/linux/array_size.h:5,
> from ./include/linux/kernel.h:16,
> from fs/btrfs/ioctl.c:6:
> In function ‘instrument_copy_from_user_before’,
> inlined from ‘_inline_copy_from_user’ at ./include/linux/uaccess.h:184:2,
> inlined from ‘copy_from_user’ at ./include/linux/uaccess.h:222:9,
> inlined from ‘btrfs_ioctl_get_csums.isra’ at fs/btrfs/ioctl.c:5220:6:
> ./include/linux/kasan-checks.h:38:27: warning: ‘args’ may be used uninitialized [-Wmaybe-uninitialized]
> 38 | #define kasan_check_write __kasan_check_write
> ./include/linux/instrumented.h:146:9: note: in expansion of macro ‘kasan_check_write’
> 146 | kasan_check_write(to, n);
> | ^~~~~~~~~~~~~~~~~
> fs/btrfs/ioctl.c: In function ‘btrfs_ioctl_get_csums.isra’:
> ./include/linux/kasan-checks.h:20:6: note: by argument 1 of type ‘const volatile void *’ to ‘__kasan_check_write’ declared here
> 20 | bool __kasan_check_write(const volatile void *p, unsigned int size);
> | ^~~~~~~~~~~~~~~~~~~
> fs/btrfs/ioctl.c:5201:43: note: ‘args’ declared here
> 5201 | struct btrfs_ioctl_get_csums_args args;
> | ^~~~
>
> Fix (or at least suppress) this by initializing "args" to "{ 0 }".
This is a little weird, as @args is immediately written with
copy_from_user().
So I'd say this may be specific to certain compiler version.
Mind to provide the name and version of the compiler?
But still, initializing the structure to zero makes no harm.
I'll convert the report into a proper commit during merge.
Reviewed-by: Qu Wenruo <wqu@suse.com>
Thanks,
Qu
>
> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
>
> diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
> index 9d47d16394fc56..1e28f1411e20f8 100644
> --- a/fs/btrfs/ioctl.c
> +++ b/fs/btrfs/ioctl.c
> @@ -5198,7 +5198,7 @@ static int btrfs_ioctl_get_csums(struct file *file, void __user *argp)
> struct btrfs_inode *inode = BTRFS_I(vfs_inode);
> struct btrfs_fs_info *fs_info = inode->root->fs_info;
> struct btrfs_root *root = inode->root;
> - struct btrfs_ioctl_get_csums_args args;
> + struct btrfs_ioctl_get_csums_args args = { 0 };
> BTRFS_PATH_AUTO_FREE(path);
> const u64 ino = btrfs_ino(inode);
> const u32 csum_size = fs_info->csum_size;
>
On Wed, Jul 15, 2026 at 07:25:49AM +0930, Qu Wenruo wrote:
>
>
> 在 2026/7/15 06:02, Paul E. McKenney 写道:
> > Hello!
> >
> > This should be considered at least as much a bug report as a fix. Though
> > this "fix" does make KASAN happy, so there is that. ;-)
> >
> > The following compiler diagnostic appears when building with KASAN on ARM:
> >
> > In file included from ./include/asm-generic/rwonce.h:26,
> > from ./arch/arm64/include/asm/rwonce.h:81,
> > from ./include/linux/compiler.h:369,
> > from ./include/linux/array_size.h:5,
> > from ./include/linux/kernel.h:16,
> > from fs/btrfs/ioctl.c:6:
> > In function ‘instrument_copy_from_user_before’,
> > inlined from ‘_inline_copy_from_user’ at ./include/linux/uaccess.h:184:2,
> > inlined from ‘copy_from_user’ at ./include/linux/uaccess.h:222:9,
> > inlined from ‘btrfs_ioctl_get_csums.isra’ at fs/btrfs/ioctl.c:5220:6:
> > ./include/linux/kasan-checks.h:38:27: warning: ‘args’ may be used uninitialized [-Wmaybe-uninitialized]
> > 38 | #define kasan_check_write __kasan_check_write
> > ./include/linux/instrumented.h:146:9: note: in expansion of macro ‘kasan_check_write’
> > 146 | kasan_check_write(to, n);
> > | ^~~~~~~~~~~~~~~~~
> > fs/btrfs/ioctl.c: In function ‘btrfs_ioctl_get_csums.isra’:
> > ./include/linux/kasan-checks.h:20:6: note: by argument 1 of type ‘const volatile void *’ to ‘__kasan_check_write’ declared here
> > 20 | bool __kasan_check_write(const volatile void *p, unsigned int size);
> > | ^~~~~~~~~~~~~~~~~~~
> > fs/btrfs/ioctl.c:5201:43: note: ‘args’ declared here
> > 5201 | struct btrfs_ioctl_get_csums_args args;
> > | ^~~~
> >
> > Fix (or at least suppress) this by initializing "args" to "{ 0 }".
>
> This is a little weird, as @args is immediately written with
> copy_from_user().
I was wondering about that myself. Perhaps it refuses to assume that
the entirety of args is overwritten?
> So I'd say this may be specific to certain compiler version.
> Mind to provide the name and version of the compiler?
gcc version 11.5.0 20240719 (Red Hat 11.5.0-14) (GCC)
> But still, initializing the structure to zero makes no harm.
>
> I'll convert the report into a proper commit during merge.
>
> Reviewed-by: Qu Wenruo <wqu@suse.com>
Thank you very much!
Thanx, Paul
> Thanks,
> Qu
>
> >
> > Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
> >
> > diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
> > index 9d47d16394fc56..1e28f1411e20f8 100644
> > --- a/fs/btrfs/ioctl.c
> > +++ b/fs/btrfs/ioctl.c
> > @@ -5198,7 +5198,7 @@ static int btrfs_ioctl_get_csums(struct file *file, void __user *argp)
> > struct btrfs_inode *inode = BTRFS_I(vfs_inode);
> > struct btrfs_fs_info *fs_info = inode->root->fs_info;
> > struct btrfs_root *root = inode->root;
> > - struct btrfs_ioctl_get_csums_args args;
> > + struct btrfs_ioctl_get_csums_args args = { 0 };
> > BTRFS_PATH_AUTO_FREE(path);
> > const u64 ino = btrfs_ino(inode);
> > const u32 csum_size = fs_info->csum_size;
> >
>
On Tue, Jul 14, 2026 at 03:38:43PM -0700, Paul E. McKenney wrote:
> > > Fix (or at least suppress) this by initializing "args" to "{ 0 }".
> >
> > This is a little weird, as @args is immediately written with
> > copy_from_user().
>
> I was wondering about that myself. Perhaps it refuses to assume that
> the entirety of args is overwritten?
>
> > So I'd say this may be specific to certain compiler version.
> > Mind to provide the name and version of the compiler?
>
> gcc version 11.5.0 20240719 (Red Hat 11.5.0-14) (GCC)
The 'maybe-uninitialized' warning occasionaly catches some arch and
compiler combination that does not recognize the effects of
initialization. The versions I see in fs/btrfs log are 10.2,
loongarch64-gcc 12.3.1, gcc8 on m68k or mips, gcc 5 on ppc. Eventually
reported when -Os is enabled.
© 2016 - 2026 Red Hat, Inc.