From: Daniel Vetter <daniel@ffwll.ch>
To: syzbot <syzbot+10e27961f4da37c443b2@syzkaller.appspotmail.com>,
Gerd Hoffmann <kraxel@redhat.com>
Cc: sumit.semwal@linaro.org, linaro-mm-sig-owner@lists.linaro.org,
syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org,
dri-devel@lists.freedesktop.org, hch@lst.de,
linaro-mm-sig@lists.linaro.org, iommu@lists.linux-foundation.org,
robin.murphy@arm.com, christian.koenig@amd.com,
linux-media@vger.kernel.org
Subject: Re: [syzbot] WARNING in __dma_map_sg_attrs
Date: Tue, 8 Feb 2022 13:26:53 +0100 [thread overview]
Message-ID: <YgJhjdAbRHdnCZ4T@phenom.ffwll.local> (raw)
In-Reply-To: <000000000000b968f305d74b1195@google.com>
On Sat, Feb 05, 2022 at 12:18:23PM -0800, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 0457e5153e0e Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11b2637c700000
> kernel config: https://syzkaller.appspot.com/x/.config?x=6f043113811433a5
> dashboard link: https://syzkaller.appspot.com/bug?extid=10e27961f4da37c443b2
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c65542700000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1163f480700000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+10e27961f4da37c443b2@syzkaller.appspotmail.com
Adding Gerd, since this seems to blow up in udmabuf.
I wonder why syzbot didn't figure this out, since it seems to have
correctly added both dma-api and dma-buf people. Just not the maintainer
for the begin_cpu_udmabuf function in the middle of the backtrace?
-Daniel
>
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 3595 at kernel/dma/mapping.c:188 __dma_map_sg_attrs+0x181/0x1f0 kernel/dma/mapping.c:188
> Modules linked in:
> CPU: 0 PID: 3595 Comm: syz-executor249 Not tainted 5.17.0-rc2-syzkaller-00316-g0457e5153e0e #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> RIP: 0010:__dma_map_sg_attrs+0x181/0x1f0 kernel/dma/mapping.c:188
> Code: 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 71 4c 8b 3d c0 83 b5 0d e9 db fe ff ff e8 b6 0f 13 00 0f 0b e8 af 0f 13 00 <0f> 0b 45 31 e4 e9 54 ff ff ff e8 a0 0f 13 00 49 8d 7f 50 48 b8 00
> RSP: 0018:ffffc90002a07d68 EFLAGS: 00010293
> RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> RDX: ffff88807e25e2c0 RSI: ffffffff81649e91 RDI: ffff88801b848408
> RBP: ffff88801b848000 R08: 0000000000000002 R09: ffff88801d86c74f
> R10: ffffffff81649d72 R11: 0000000000000001 R12: 0000000000000002
> R13: ffff88801d86c680 R14: 0000000000000001 R15: 0000000000000000
> FS: 0000555556e30300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00000000200000cc CR3: 000000001d74a000 CR4: 00000000003506e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <TASK>
> dma_map_sgtable+0x70/0xf0 kernel/dma/mapping.c:264
> get_sg_table.isra.0+0xe0/0x160 drivers/dma-buf/udmabuf.c:72
> begin_cpu_udmabuf+0x130/0x1d0 drivers/dma-buf/udmabuf.c:126
> dma_buf_begin_cpu_access+0xfd/0x1d0 drivers/dma-buf/dma-buf.c:1164
> dma_buf_ioctl+0x259/0x2b0 drivers/dma-buf/dma-buf.c:363
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:874 [inline]
> __se_sys_ioctl fs/ioctl.c:860 [inline]
> __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x7f62fcf530f9
> Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffe3edab9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f62fcf530f9
> RDX: 0000000020000200 RSI: 0000000040086200 RDI: 0000000000000006
> RBP: 00007f62fcf170e0 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00007f62fcf17170
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> </TASK>
>
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu
WARNING: multiple messages have this Message-ID (diff)
From: Daniel Vetter <daniel@ffwll.ch>
To: syzbot <syzbot+10e27961f4da37c443b2@syzkaller.appspotmail.com>,
Gerd Hoffmann <kraxel@redhat.com>
Cc: sumit.semwal@linaro.org, linaro-mm-sig-owner@lists.linaro.org,
syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org,
dri-devel@lists.freedesktop.org, hch@lst.de,
linaro-mm-sig@lists.linaro.org, iommu@lists.linux-foundation.org,
m.szyprowski@samsung.com, robin.murphy@arm.com,
christian.koenig@amd.com, linux-media@vger.kernel.org
Subject: Re: [syzbot] WARNING in __dma_map_sg_attrs
Date: Tue, 8 Feb 2022 13:26:53 +0100 [thread overview]
Message-ID: <YgJhjdAbRHdnCZ4T@phenom.ffwll.local> (raw)
In-Reply-To: <000000000000b968f305d74b1195@google.com>
On Sat, Feb 05, 2022 at 12:18:23PM -0800, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 0457e5153e0e Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11b2637c700000
> kernel config: https://syzkaller.appspot.com/x/.config?x=6f043113811433a5
> dashboard link: https://syzkaller.appspot.com/bug?extid=10e27961f4da37c443b2
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c65542700000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1163f480700000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+10e27961f4da37c443b2@syzkaller.appspotmail.com
Adding Gerd, since this seems to blow up in udmabuf.
I wonder why syzbot didn't figure this out, since it seems to have
correctly added both dma-api and dma-buf people. Just not the maintainer
for the begin_cpu_udmabuf function in the middle of the backtrace?
-Daniel
>
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 3595 at kernel/dma/mapping.c:188 __dma_map_sg_attrs+0x181/0x1f0 kernel/dma/mapping.c:188
> Modules linked in:
> CPU: 0 PID: 3595 Comm: syz-executor249 Not tainted 5.17.0-rc2-syzkaller-00316-g0457e5153e0e #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> RIP: 0010:__dma_map_sg_attrs+0x181/0x1f0 kernel/dma/mapping.c:188
> Code: 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 71 4c 8b 3d c0 83 b5 0d e9 db fe ff ff e8 b6 0f 13 00 0f 0b e8 af 0f 13 00 <0f> 0b 45 31 e4 e9 54 ff ff ff e8 a0 0f 13 00 49 8d 7f 50 48 b8 00
> RSP: 0018:ffffc90002a07d68 EFLAGS: 00010293
> RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> RDX: ffff88807e25e2c0 RSI: ffffffff81649e91 RDI: ffff88801b848408
> RBP: ffff88801b848000 R08: 0000000000000002 R09: ffff88801d86c74f
> R10: ffffffff81649d72 R11: 0000000000000001 R12: 0000000000000002
> R13: ffff88801d86c680 R14: 0000000000000001 R15: 0000000000000000
> FS: 0000555556e30300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00000000200000cc CR3: 000000001d74a000 CR4: 00000000003506e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <TASK>
> dma_map_sgtable+0x70/0xf0 kernel/dma/mapping.c:264
> get_sg_table.isra.0+0xe0/0x160 drivers/dma-buf/udmabuf.c:72
> begin_cpu_udmabuf+0x130/0x1d0 drivers/dma-buf/udmabuf.c:126
> dma_buf_begin_cpu_access+0xfd/0x1d0 drivers/dma-buf/dma-buf.c:1164
> dma_buf_ioctl+0x259/0x2b0 drivers/dma-buf/dma-buf.c:363
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:874 [inline]
> __se_sys_ioctl fs/ioctl.c:860 [inline]
> __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x7f62fcf530f9
> Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffe3edab9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f62fcf530f9
> RDX: 0000000020000200 RSI: 0000000040086200 RDI: 0000000000000006
> RBP: 00007f62fcf170e0 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00007f62fcf17170
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> </TASK>
>
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
WARNING: multiple messages have this Message-ID (diff)
From: Daniel Vetter <daniel@ffwll.ch>
To: syzbot <syzbot+10e27961f4da37c443b2@syzkaller.appspotmail.com>,
Gerd Hoffmann <kraxel@redhat.com>
Cc: christian.koenig@amd.com, dri-devel@lists.freedesktop.org,
hch@lst.de, iommu@lists.linux-foundation.org,
linaro-mm-sig-owner@lists.linaro.org,
linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org,
linux-media@vger.kernel.org, m.szyprowski@samsung.com,
robin.murphy@arm.com, sumit.semwal@linaro.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] WARNING in __dma_map_sg_attrs
Date: Tue, 8 Feb 2022 13:26:53 +0100 [thread overview]
Message-ID: <YgJhjdAbRHdnCZ4T@phenom.ffwll.local> (raw)
In-Reply-To: <000000000000b968f305d74b1195@google.com>
On Sat, Feb 05, 2022 at 12:18:23PM -0800, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 0457e5153e0e Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11b2637c700000
> kernel config: https://syzkaller.appspot.com/x/.config?x=6f043113811433a5
> dashboard link: https://syzkaller.appspot.com/bug?extid=10e27961f4da37c443b2
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c65542700000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1163f480700000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+10e27961f4da37c443b2@syzkaller.appspotmail.com
Adding Gerd, since this seems to blow up in udmabuf.
I wonder why syzbot didn't figure this out, since it seems to have
correctly added both dma-api and dma-buf people. Just not the maintainer
for the begin_cpu_udmabuf function in the middle of the backtrace?
-Daniel
>
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 3595 at kernel/dma/mapping.c:188 __dma_map_sg_attrs+0x181/0x1f0 kernel/dma/mapping.c:188
> Modules linked in:
> CPU: 0 PID: 3595 Comm: syz-executor249 Not tainted 5.17.0-rc2-syzkaller-00316-g0457e5153e0e #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> RIP: 0010:__dma_map_sg_attrs+0x181/0x1f0 kernel/dma/mapping.c:188
> Code: 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 71 4c 8b 3d c0 83 b5 0d e9 db fe ff ff e8 b6 0f 13 00 0f 0b e8 af 0f 13 00 <0f> 0b 45 31 e4 e9 54 ff ff ff e8 a0 0f 13 00 49 8d 7f 50 48 b8 00
> RSP: 0018:ffffc90002a07d68 EFLAGS: 00010293
> RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> RDX: ffff88807e25e2c0 RSI: ffffffff81649e91 RDI: ffff88801b848408
> RBP: ffff88801b848000 R08: 0000000000000002 R09: ffff88801d86c74f
> R10: ffffffff81649d72 R11: 0000000000000001 R12: 0000000000000002
> R13: ffff88801d86c680 R14: 0000000000000001 R15: 0000000000000000
> FS: 0000555556e30300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00000000200000cc CR3: 000000001d74a000 CR4: 00000000003506e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <TASK>
> dma_map_sgtable+0x70/0xf0 kernel/dma/mapping.c:264
> get_sg_table.isra.0+0xe0/0x160 drivers/dma-buf/udmabuf.c:72
> begin_cpu_udmabuf+0x130/0x1d0 drivers/dma-buf/udmabuf.c:126
> dma_buf_begin_cpu_access+0xfd/0x1d0 drivers/dma-buf/dma-buf.c:1164
> dma_buf_ioctl+0x259/0x2b0 drivers/dma-buf/dma-buf.c:363
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:874 [inline]
> __se_sys_ioctl fs/ioctl.c:860 [inline]
> __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x7f62fcf530f9
> Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffe3edab9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f62fcf530f9
> RDX: 0000000020000200 RSI: 0000000040086200 RDI: 0000000000000006
> RBP: 00007f62fcf170e0 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00007f62fcf17170
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> </TASK>
>
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
next prev parent reply other threads:[~2022-02-08 12:27 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-01 18:18 [syzbot] WARNING in __dma_map_sg_attrs syzbot
2021-12-01 18:18 ` syzbot
2021-12-02 6:55 ` Christoph Hellwig
2021-12-02 6:55 ` Christoph Hellwig
2022-02-05 20:18 ` syzbot
2022-02-05 20:18 ` syzbot
2022-02-08 12:26 ` Daniel Vetter [this message]
2022-02-08 12:26 ` Daniel Vetter
2022-02-08 12:26 ` Daniel Vetter
2022-05-19 12:25 ` Dmitry Vyukov
2022-05-19 12:25 ` Dmitry Vyukov via iommu
2022-05-20 6:23 ` [PATCH] udmabuf: Set the DMA mask for the udmabuf device Vivek Kasireddy
2022-05-20 20:52 ` [PATCH] udmabuf: Set the DMA mask for the udmabuf device (v2) Vivek Kasireddy
2022-05-20 19:32 [PATCH] udmabuf: Set the DMA mask for the udmabuf device kernel test robot
2022-05-23 11:03 ` Dan Carpenter
2022-05-23 11:03 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YgJhjdAbRHdnCZ4T@phenom.ffwll.local \
--to=daniel@ffwll.ch \
--cc=christian.koenig@amd.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=hch@lst.de \
--cc=iommu@lists.linux-foundation.org \
--cc=kraxel@redhat.com \
--cc=linaro-mm-sig-owner@lists.linaro.org \
--cc=linaro-mm-sig@lists.linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=robin.murphy@arm.com \
--cc=sumit.semwal@linaro.org \
--cc=syzbot+10e27961f4da37c443b2@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.