KMSAN: uninit-value in __dma_map_sg_attrs

[Dipanjan Das]

Hi,

We would like to report the following bug which has been found by our
modified version of syzkaller.

======================================================
description: KMSAN: uninit-value in __dma_map_sg_attrs
affected file: kernel/dma/mapping.c
kernel version: 6.2.0-rc5
kernel commit: 41c66f47061608dc1fd493eebce198f0e74cc2d7
git tree: kmsan
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=a9a22da1efde3af6
crash reproducer: attached
======================================================
Crash log:
======================================================
BUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x1f3/0x2e0
kernel/dma/mapping.c:200
 __dma_map_sg_attrs+0x1f3/0x2e0 kernel/dma/mapping.c:200
 dma_map_sg_attrs+0x4a/0x60 kernel/dma/mapping.c:232
 ata_sg_setup drivers/ata/libata-core.c:4544 [inline]
 ata_qc_issue+0x958/0x1480 drivers/ata/libata-core.c:4845
 ata_scsi_translate drivers/ata/libata-scsi.c:1745 [inline]
 __ata_scsi_queuecmd+0x161c/0x16c0 drivers/ata/libata-scsi.c:4023
 ata_scsi_queuecmd+0x86d/0x970 drivers/ata/libata-scsi.c:4068
 scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1517 [inline]
 scsi_queue_rq+0x478f/0x55c0 drivers/scsi/scsi_lib.c:1758
 blk_mq_dispatch_rq_list+0x13e9/0x40f0 block/blk-mq.c:2056
 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:173 [inline]
 blk_mq_do_dispatch_sched+0xd97/0x1630 block/blk-mq-sched.c:187
 __blk_mq_sched_dispatch_requests+0x495/0x620
 blk_mq_sched_dispatch_requests+0x146/0x2b0 block/blk-mq-sched.c:339
 __blk_mq_run_hw_queue+0xf7/0x310 block/blk-mq.c:2174
 __blk_mq_delay_run_hw_queue+0x13c/0x6b0 block/blk-mq.c:2250
 blk_mq_run_hw_queue+0x527/0x850 block/blk-mq.c:2298
 blk_mq_sched_insert_requests+0x50f/0x7d0 block/blk-mq-sched.c:493
 blk_mq_dispatch_plug_list block/blk-mq.c:2758 [inline]
 blk_mq_flush_plug_list+0x752/0x1300 block/blk-mq.c:2800
 __blk_flush_plug+0x600/0x680 block/blk-core.c:1137
 blk_finish_plug+0x71/0x90 block/blk-core.c:1161
 ext4_do_writepages+0x5c84/0x6e40 fs/ext4/inode.c:2928
 ext4_writepages+0x2bc/0x660 fs/ext4/inode.c:2965
 do_writepages+0x475/0x930 mm/page-writeback.c:2581
 filemap_fdatawrite_wbc+0x1c4/0x260 mm/filemap.c:388
 __filemap_fdatawrite_range mm/filemap.c:421 [inline]
 file_write_and_wait_range+0x22f/0x410 mm/filemap.c:777
 ext4_sync_file+0x1ef/0x15b0 fs/ext4/fsync.c:151
 vfs_fsync_range+0x1ee/0x240 fs/sync.c:188
 generic_write_sync include/linux/fs.h:2885 [inline]
 ext4_buffered_write_iter+0xaa3/0xb90 fs/ext4/file.c:292
 ext4_file_write_iter+0xc9c/0x3350
 do_iter_write+0x645/0x12e0 fs/read_write.c:861
 vfs_writev+0x307/0x750 fs/read_write.c:934
 do_pwritev fs/read_write.c:1031 [inline]
 __do_sys_pwritev2 fs/read_write.c:1090 [inline]
 __se_sys_pwritev2+0x275/0x480 fs/read_write.c:1081
 __x64_sys_pwritev2+0xe0/0x140 fs/read_write.c:1081
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Uninit was created at:
 __alloc_pages+0x767/0xee0 mm/page_alloc.c:5572
 alloc_pages+0xa9a/0xd90 mm/mempolicy.c:2286
 folio_alloc+0x41/0x100 mm/mempolicy.c:2296
 filemap_alloc_folio+0xa5/0x450 mm/filemap.c:972
 __filemap_get_folio+0xe7c/0x1960 mm/filemap.c:1966
 pagecache_get_page+0x46/0x270 mm/folio-compat.c:98
 grab_cache_page_write_begin+0x51/0x70 mm/folio-compat.c:110
 ext4_write_begin+0x3d8/0x31d0 fs/ext4/inode.c:1194
 ext4_da_write_begin+0x5f4/0x11c0 fs/ext4/inode.c:3058
 generic_perform_write+0x376/0xc50 mm/filemap.c:3772
 ext4_buffered_write_iter+0x583/0xb90 fs/ext4/file.c:285
 ext4_file_write_iter+0xc9c/0x3350
 do_iter_write+0x645/0x12e0 fs/read_write.c:861
 vfs_writev+0x307/0x750 fs/read_write.c:934
 do_pwritev fs/read_write.c:1031 [inline]
 __do_sys_pwritev2 fs/read_write.c:1090 [inline]
 __se_sys_pwritev2+0x275/0x480 fs/read_write.c:1081
 __x64_sys_pwritev2+0xe0/0x140 fs/read_write.c:1081
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Bytes 0-1279 of 4096 are uninitialized
Memory access of size 4096 starts at ffff8880324c6000

CPU: 0 PID: 24178 Comm: syz-executor.4 Not tainted
6.2.0-rc5-00010-g41c66f470616 #8
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014

-- 
Thanks and Regards,

Dipanjan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: repro.syz
Type: application/octet-stream
Size: 583 bytes
Desc: not available
URL: <https://lists.freedesktop.org/archives/dri-devel/attachments/20230217/90c3f974/attachment-0001.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: repro.c
Type: text/x-csrc
Size: 6809 bytes
Desc: not available
URL: <https://lists.freedesktop.org/archives/dri-devel/attachments/20230217/90c3f974/attachment-0001.c>