Hi,
We would like to report the following bug which has been found by our modified version of syzkaller.
====================================================== description: KMSAN: uninit-value in __dma_map_sg_attrs affected file: kernel/dma/mapping.c kernel version: 6.2.0-rc5 kernel commit: 41c66f47061608dc1fd493eebce198f0e74cc2d7 git tree: kmsan kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=a9a22da1efde3af6 crash reproducer: attached ====================================================== Crash log: ====================================================== BUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x1f3/0x2e0 kernel/dma/mapping.c:200 __dma_map_sg_attrs+0x1f3/0x2e0 kernel/dma/mapping.c:200 dma_map_sg_attrs+0x4a/0x60 kernel/dma/mapping.c:232 ata_sg_setup drivers/ata/libata-core.c:4544 [inline] ata_qc_issue+0x958/0x1480 drivers/ata/libata-core.c:4845 ata_scsi_translate drivers/ata/libata-scsi.c:1745 [inline] __ata_scsi_queuecmd+0x161c/0x16c0 drivers/ata/libata-scsi.c:4023 ata_scsi_queuecmd+0x86d/0x970 drivers/ata/libata-scsi.c:4068 scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1517 [inline] scsi_queue_rq+0x478f/0x55c0 drivers/scsi/scsi_lib.c:1758 blk_mq_dispatch_rq_list+0x13e9/0x40f0 block/blk-mq.c:2056 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:173 [inline] blk_mq_do_dispatch_sched+0xd97/0x1630 block/blk-mq-sched.c:187 __blk_mq_sched_dispatch_requests+0x495/0x620 blk_mq_sched_dispatch_requests+0x146/0x2b0 block/blk-mq-sched.c:339 __blk_mq_run_hw_queue+0xf7/0x310 block/blk-mq.c:2174 __blk_mq_delay_run_hw_queue+0x13c/0x6b0 block/blk-mq.c:2250 blk_mq_run_hw_queue+0x527/0x850 block/blk-mq.c:2298 blk_mq_sched_insert_requests+0x50f/0x7d0 block/blk-mq-sched.c:493 blk_mq_dispatch_plug_list block/blk-mq.c:2758 [inline] blk_mq_flush_plug_list+0x752/0x1300 block/blk-mq.c:2800 __blk_flush_plug+0x600/0x680 block/blk-core.c:1137 blk_finish_plug+0x71/0x90 block/blk-core.c:1161 ext4_do_writepages+0x5c84/0x6e40 fs/ext4/inode.c:2928 ext4_writepages+0x2bc/0x660 fs/ext4/inode.c:2965 do_writepages+0x475/0x930 mm/page-writeback.c:2581 filemap_fdatawrite_wbc+0x1c4/0x260 mm/filemap.c:388 __filemap_fdatawrite_range mm/filemap.c:421 [inline] file_write_and_wait_range+0x22f/0x410 mm/filemap.c:777 ext4_sync_file+0x1ef/0x15b0 fs/ext4/fsync.c:151 vfs_fsync_range+0x1ee/0x240 fs/sync.c:188 generic_write_sync include/linux/fs.h:2885 [inline] ext4_buffered_write_iter+0xaa3/0xb90 fs/ext4/file.c:292 ext4_file_write_iter+0xc9c/0x3350 do_iter_write+0x645/0x12e0 fs/read_write.c:861 vfs_writev+0x307/0x750 fs/read_write.c:934 do_pwritev fs/read_write.c:1031 [inline] __do_sys_pwritev2 fs/read_write.c:1090 [inline] __se_sys_pwritev2+0x275/0x480 fs/read_write.c:1081 __x64_sys_pwritev2+0xe0/0x140 fs/read_write.c:1081 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was created at: __alloc_pages+0x767/0xee0 mm/page_alloc.c:5572 alloc_pages+0xa9a/0xd90 mm/mempolicy.c:2286 folio_alloc+0x41/0x100 mm/mempolicy.c:2296 filemap_alloc_folio+0xa5/0x450 mm/filemap.c:972 __filemap_get_folio+0xe7c/0x1960 mm/filemap.c:1966 pagecache_get_page+0x46/0x270 mm/folio-compat.c:98 grab_cache_page_write_begin+0x51/0x70 mm/folio-compat.c:110 ext4_write_begin+0x3d8/0x31d0 fs/ext4/inode.c:1194 ext4_da_write_begin+0x5f4/0x11c0 fs/ext4/inode.c:3058 generic_perform_write+0x376/0xc50 mm/filemap.c:3772 ext4_buffered_write_iter+0x583/0xb90 fs/ext4/file.c:285 ext4_file_write_iter+0xc9c/0x3350 do_iter_write+0x645/0x12e0 fs/read_write.c:861 vfs_writev+0x307/0x750 fs/read_write.c:934 do_pwritev fs/read_write.c:1031 [inline] __do_sys_pwritev2 fs/read_write.c:1090 [inline] __se_sys_pwritev2+0x275/0x480 fs/read_write.c:1081 __x64_sys_pwritev2+0xe0/0x140 fs/read_write.c:1081 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Bytes 0-1279 of 4096 are uninitialized Memory access of size 4096 starts at ffff8880324c6000
CPU: 0 PID: 24178 Comm: syz-executor.4 Not tainted 6.2.0-rc5-00010-g41c66f470616 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014