From: syzbot <syzbot+df28076a30d726933015@syzkaller.appspotmail.com>
To: kartikey406@gmail.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [iommu?] KMSAN: uninit-value in pfn_reader_next
Date: Sat, 24 Jan 2026 02:25:03 -0800 [thread overview]
Message-ID: <69749dff.a00a0220.33ccc7.0004.GAE@google.com> (raw)
In-Reply-To: <20260124090709.617302-1-kartikey406@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KMSAN: uninit-value in batch_from_domain
=====================================================
BUG: KMSAN: uninit-value in batch_add_pfn_num drivers/iommu/iommufd/pages.c:365 [inline]
BUG: KMSAN: uninit-value in batch_add_pfn drivers/iommu/iommufd/pages.c:398 [inline]
BUG: KMSAN: uninit-value in batch_from_domain+0xe8c/0x1010 drivers/iommu/iommufd/pages.c:425
batch_add_pfn_num drivers/iommu/iommufd/pages.c:365 [inline]
batch_add_pfn drivers/iommu/iommufd/pages.c:398 [inline]
batch_from_domain+0xe8c/0x1010 drivers/iommu/iommufd/pages.c:425
iopt_area_unpin_domain drivers/iommu/iommufd/pages.c:1687 [inline]
__iopt_area_unfill_domain+0xccf/0x1b90 drivers/iommu/iommufd/pages.c:1773
iopt_area_unfill_domain+0x100/0x140 drivers/iommu/iommufd/pages.c:1828
iopt_unfill_domain drivers/iommu/iommufd/io_pagetable.c:1025 [inline]
iopt_table_remove_domain+0xada/0x1010 drivers/iommu/iommufd/io_pagetable.c:1269
iommufd_hwpt_paging_destroy+0x21e/0x540 drivers/iommu/iommufd/hw_pagetable.c:30
iommufd_object_remove+0x4c8/0x6c0 drivers/iommu/iommufd/main.c:273
iommufd_object_put_and_try_destroy drivers/iommu/iommufd/iommufd_private.h:268 [inline]
iommufd_hw_pagetable_put drivers/iommu/iommufd/iommufd_private.h:461 [inline]
iommufd_hw_pagetable_detach+0x6e3/0xa10 drivers/iommu/iommufd/device.c:714
iommufd_device_detach+0x38/0xe0 drivers/iommu/iommufd/device.c:1059
iommufd_selftest_destroy+0x9e/0x100 drivers/iommu/iommufd/selftest.c:1951
iommufd_fops_release+0x1e0/0x5f0 drivers/iommu/iommufd/main.c:361
__fput+0x60e/0x1050 fs/file_table.c:468
____fput+0x25/0x30 fs/file_table.c:496
task_work_run+0x208/0x2b0 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
exit_to_user_mode_loop+0x2ff/0x1b20 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x1d7/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable batch created at:
__iopt_area_unfill_domain+0xa8/0x1b90 drivers/iommu/iommufd/pages.c:1738
iopt_area_unfill_domain+0x100/0x140 drivers/iommu/iommufd/pages.c:1828
CPU: 0 UID: 0 PID: 6581 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026
=====================================================
Tested on:
commit: 62085877 Merge tag 'kbuild-fixes-6.19-2' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1642c452580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8bf02b9e495b9fcd
dashboard link: https://syzkaller.appspot.com/bug?extid=df28076a30d726933015
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=158cc452580000
next parent reply other threads:[~2026-01-24 10:25 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20260124090709.617302-1-kartikey406@gmail.com>
2026-01-24 10:25 ` syzbot [this message]
[not found] <20260124124617.623091-1-kartikey406@gmail.com>
2026-01-24 13:18 ` [syzbot] [iommu?] KMSAN: uninit-value in pfn_reader_next syzbot
[not found] <20260124112446.618792-1-kartikey406@gmail.com>
2026-01-24 12:20 ` syzbot
2026-01-24 6:45 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69749dff.a00a0220.33ccc7.0004.GAE@google.com \
--to=syzbot+df28076a30d726933015@syzkaller.appspotmail.com \
--cc=kartikey406@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.