Hi,
We would like to report the following bug which has been found by our
modified version of syzkaller.
======================================================
description: KMSAN: uninit-value in __dma_map_sg_attrs
affected file: kernel/dma/mapping.c
kernel version: 6.2.0-rc5
kernel commit: 41c66f47061608dc1fd493eebce198f0e74cc2d7
git tree: kmsan
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=a9a22da1efde3af6
crash reproducer: attached
======================================================
Crash log:
======================================================
BUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x1f3/0x2e0
kernel/dma/mapping.c:200
__dma_map_sg_attrs+0x1f3/0x2e0 kernel/dma/mapping.c:200
dma_map_sg_attrs+0x4a/0x60 kernel/dma/mapping.c:232
ata_sg_setup drivers/ata/libata-core.c:4544 [inline]
ata_qc_issue+0x958/0x1480 drivers/ata/libata-core.c:4845
ata_scsi_translate drivers/ata/libata-scsi.c:1745 [inline]
__ata_scsi_queuecmd+0x161c/0x16c0 drivers/ata/libata-scsi.c:4023
ata_scsi_queuecmd+0x86d/0x970 drivers/ata/libata-scsi.c:4068
scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1517 [inline]
scsi_queue_rq+0x478f/0x55c0 drivers/scsi/scsi_lib.c:1758
blk_mq_dispatch_rq_list+0x13e9/0x40f0 block/blk-mq.c:2056
__blk_mq_do_dispatch_sched block/blk-mq-sched.c:173 [inline]
blk_mq_do_dispatch_sched+0xd97/0x1630 block/blk-mq-sched.c:187
__blk_mq_sched_dispatch_requests+0x495/0x620
blk_mq_sched_dispatch_requests+0x146/0x2b0 block/blk-mq-sched.c:339
__blk_mq_run_hw_queue+0xf7/0x310 block/blk-mq.c:2174
__blk_mq_delay_run_hw_queue+0x13c/0x6b0 block/blk-mq.c:2250
blk_mq_run_hw_queue+0x527/0x850 block/blk-mq.c:2298
blk_mq_sched_insert_requests+0x50f/0x7d0 block/blk-mq-sched.c:493
blk_mq_dispatch_plug_list block/blk-mq.c:2758 [inline]
blk_mq_flush_plug_list+0x752/0x1300 block/blk-mq.c:2800
__blk_flush_plug+0x600/0x680 block/blk-core.c:1137
blk_finish_plug+0x71/0x90 block/blk-core.c:1161
ext4_do_writepages+0x5c84/0x6e40 fs/ext4/inode.c:2928
ext4_writepages+0x2bc/0x660 fs/ext4/inode.c:2965
do_writepages+0x475/0x930 mm/page-writeback.c:2581
filemap_fdatawrite_wbc+0x1c4/0x260 mm/filemap.c:388
__filemap_fdatawrite_range mm/filemap.c:421 [inline]
file_write_and_wait_range+0x22f/0x410 mm/filemap.c:777
ext4_sync_file+0x1ef/0x15b0 fs/ext4/fsync.c:151
vfs_fsync_range+0x1ee/0x240 fs/sync.c:188
generic_write_sync include/linux/fs.h:2885 [inline]
ext4_buffered_write_iter+0xaa3/0xb90 fs/ext4/file.c:292
ext4_file_write_iter+0xc9c/0x3350
do_iter_write+0x645/0x12e0 fs/read_write.c:861
vfs_writev+0x307/0x750 fs/read_write.c:934
do_pwritev fs/read_write.c:1031 [inline]
__do_sys_pwritev2 fs/read_write.c:1090 [inline]
__se_sys_pwritev2+0x275/0x480 fs/read_write.c:1081
__x64_sys_pwritev2+0xe0/0x140 fs/read_write.c:1081
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was created at:
__alloc_pages+0x767/0xee0 mm/page_alloc.c:5572
alloc_pages+0xa9a/0xd90 mm/mempolicy.c:2286
folio_alloc+0x41/0x100 mm/mempolicy.c:2296
filemap_alloc_folio+0xa5/0x450 mm/filemap.c:972
__filemap_get_folio+0xe7c/0x1960 mm/filemap.c:1966
pagecache_get_page+0x46/0x270 mm/folio-compat.c:98
grab_cache_page_write_begin+0x51/0x70 mm/folio-compat.c:110
ext4_write_begin+0x3d8/0x31d0 fs/ext4/inode.c:1194
ext4_da_write_begin+0x5f4/0x11c0 fs/ext4/inode.c:3058
generic_perform_write+0x376/0xc50 mm/filemap.c:3772
ext4_buffered_write_iter+0x583/0xb90 fs/ext4/file.c:285
ext4_file_write_iter+0xc9c/0x3350
do_iter_write+0x645/0x12e0 fs/read_write.c:861
vfs_writev+0x307/0x750 fs/read_write.c:934
do_pwritev fs/read_write.c:1031 [inline]
__do_sys_pwritev2 fs/read_write.c:1090 [inline]
__se_sys_pwritev2+0x275/0x480 fs/read_write.c:1081
__x64_sys_pwritev2+0xe0/0x140 fs/read_write.c:1081
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Bytes 0-1279 of 4096 are uninitialized
Memory access of size 4096 starts at ffff8880324c6000
CPU: 0 PID: 24178 Comm: syz-executor.4 Not tainted
6.2.0-rc5-00010-g41c66f470616 #8
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
--
Thanks and Regards,
Dipanjan