From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dmitry Vyukov Subject: Re: ata: BUG in ata_sff_hsm_move Date: Fri, 29 Jan 2016 12:59:49 +0100 Message-ID: References: <20160129115214.GM32380@htj.duckdns.org> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Return-path: In-Reply-To: <20160129115214.GM32380@htj.duckdns.org> Sender: linux-kernel-owner@vger.kernel.org To: Tejun Heo Cc: linux-ide@vger.kernel.org, LKML , Alan Cox , Jeff Garzik , Sergei Shtylyov , syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin List-Id: linux-ide@vger.kernel.org On Fri, Jan 29, 2016 at 12:52 PM, Tejun Heo wrote: > Hello, Dmitry. > > On Thu, Jan 28, 2016 at 12:35:43PM +0100, Dmitry Vyukov wrote: >> Hello, >> >> I episodically hit the following BUG while running syzkaller fuzzer: >> >> ata2: protocol 2 task_state 0 (dev_stat 0x41) >> ------------[ cut here ]------------ >> kernel BUG at drivers/ata/libata-sff.c:1302! > ... >> So the unexpected state is HSM_IDLE. > > Hmmm... the port interrupt handler checks for IDLE before calling into > hsm_move, so the only explanation would be that something is resetting > it to IDLE inbetween. ce7514526742 ("libata: prevent HSM state change > race between ISR and PIO") describes and fixes the same problem. The > fix seems correct and I can't find anywhere else where this can > happen. :( > > Can you please post the kernel log leading to the BUG? Also, I don't > think that condition needs to be BUG. I'll change it to WARN. Here are two logs, in both cases no kernel messages prior to the bug: https://gist.githubusercontent.com/dvyukov/5087d633e3620280b6c7/raw/31c9ab1ced92ac5f85cfb15eaf48ec5793c2c3a1/gistfile1.txt https://gist.githubusercontent.com/dvyukov/825b2e3d5fb80ae08a9a/raw/03c5a4f4c4bd9d0a304a71cda2da4c92f4b7f1ba/gistfile1.txt