From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB4BB2DB7BB for ; Wed, 29 Jul 2026 09:29:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785317384; cv=none; b=kNtG/5hVlkoGTQCxkrO0q+uUaLm/bPvbFGvaII9tr+6koKlixiSpkrsjLqEgP/XLuJZNrtrEyQE37xP2eqsov/iw1zYXtn3GS2XwInfx50meZNnwvf8D1nrhdJrx0z4DhHaPviBSTHqO9DtmdxgmRxfjqa4DBVwu/zqbqv1DSJg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785317384; c=relaxed/simple; bh=MBvhRVyzVmJrJ8VVFjtwWEwthwt7OHfMpzng/ZaAQz4=; h=Date:Message-ID:From:To:Cc:Subject:In-Reply-To:References: MIME-Version:Content-Type; b=EQ7J/sFu6o6d3ac0q4zfFn5P57hCfI7cEsVUrl9eAdXBMp1QwIff5bmIqNOEw5PKp9GAkAr5Y3w4nqVZthgbQhrvPk4+Nz030Cu9RjNgLdPmBdnRdDbaG7tyR4ihcXoSpfFprhdfYpv9Z7Dllhh8ebXCGKT9Nb2I+Nrto/2UqFQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=LZ8wtX4/; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="LZ8wtX4/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4D32B1F000E9; Wed, 29 Jul 2026 09:29:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1785317382; bh=nvLoOHlrWmtU3u/2W1dSHqc0GHvJQjtrqctTxJjbDQU=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=LZ8wtX4/O4QP89PrMXnrrtXMN5/Vyp1WEtTskSeBtv8svAKubw+O6cFp8sA77MGJg 2+Vev4lql4li5xw7dY41a76RQyvgOW3KvsoiCErmWHCP67NkRHpSWlzwWZuBnusuxq PGbYjeQojxA2jvHRHNLLP6KlJtwju656H+T1zXTQpg8p5CcjPw4Y2NuouezOrZKpUN QY2nz8t5xwkpgnN/lv32mBD5p9WFMhHuaKTHQlvDeVtQ3VHHYzh74ExFtZjcy8v8L+ 3nKDDgTbk8P2CjoCvvEHSWuUx0l1q6tgwMP8ZrLdxnvb+gJv9NxUQT1tltUWzjXst9 R9dD6qpYdGo4w== Received: from sofa.misterjones.org ([185.219.108.64] helo=goblin-girl.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wp0bc-0000000A2ES-063o; Wed, 29 Jul 2026 09:29:40 +0000 Date: Wed, 29 Jul 2026 10:29:39 +0100 Message-ID: <86se52cfek.wl-maz@kernel.org> From: Marc Zyngier To: syzbot Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, tglx@kernel.org Subject: Re: [syzbot] [kernel?] WARNING in its_msi_teardown In-Reply-To: <6a69447f.6bd615f2.c0aa.0002.GAE@google.com> References: <6a69447f.6bd615f2.c0aa.0002.GAE@google.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/30.1 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: syzbot+229d761b8a110e6de517@syzkaller.appspotmail.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, tglx@kernel.org X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false On Wed, 29 Jul 2026 01:08:31 +0100, syzbot wrote: > > Hello, > > syzbot found the following issue on: > > HEAD commit: b66b0005b6ce Merge branches 'for-next/fixes' and 'for-next.. > git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci > console output: https://syzkaller.appspot.com/x/log.txt?x=15f7d746580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=72c97575381cec47 > dashboard link: https://syzkaller.appspot.com/bug?extid=229d761b8a110e6de517 > compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 > userspace arch: arm64 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1667e09e580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17525fde580000 > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/63e3226301fe/disk-b66b0005.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/b268844cbd22/vmlinux-b66b0005.xz > kernel image: https://storage.googleapis.com/syzbot-assets/9440dfc93d1e/Image-b66b0005.gz.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+229d761b8a110e6de517@syzkaller.appspotmail.com > > el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 > do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 > el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 > el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 > el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 > ------------[ cut here ]------------ > WARNING: drivers/irqchip/irq-gic-v3-its.c:2251 at its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2251 [inline], CPU#0: syz.0.18/4916 > WARNING: drivers/irqchip/irq-gic-v3-its.c:2251 at its_msi_teardown+0x3a4/0x424 drivers/irqchip/irq-gic-v3-its.c:3644, CPU#0: syz.0.18/4916 > Modules linked in: > CPU: 0 UID: 0 PID: 4916 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 > pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) > pc : its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2251 [inline] > pc : its_msi_teardown+0x3a4/0x424 drivers/irqchip/irq-gic-v3-its.c:3644 > lr : its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2251 [inline] > lr : its_msi_teardown+0x3a4/0x424 drivers/irqchip/irq-gic-v3-its.c:3644 > sp : ffff800098017560 > x29: ffff8000980175f0 x28: ffff0000cfc75930 x27: 1fffe00019f8eb26 > x26: 1fffe00019f8eb22 x25: ffff0000c13e1000 x24: dfff800000000000 > x23: ffff700013002eac x22: 00000000fffffff4 x21: ffff800098017580 > x20: ffff0000c1e07ce0 x19: ffff0000cfc75900 x18: 00000000ffffffff > x17: 70202c31206c6176 x16: 0000000000000001 x15: 0000000000000000 > x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 > x11: 0000000000000000 x10: 0000000000000003 x9 : 0000000000000000 > x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 > x5 : 00000000ffffffff x4 : 0000000000000cc0 x3 : ffff800081ba1c7c > x2 : 00000000fffffff4 x1 : ffff0000cfb10000 x0 : 0000000000000000 > Call trace: > its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2251 [inline] (P) > its_msi_teardown+0x3a4/0x424 drivers/irqchip/irq-gic-v3-its.c:3644 (P) > its_msi_teardown+0xa0/0xb8 drivers/irqchip/irq-gic-its-msi-parent.c:249 That's an allocation failure, caused by a fault injection. We end-up leaking LPIs, but there isn't much we can do about that if we can't allocate the correct tracking structure. So yes, we WARN() about this, and carry on. M. -- Without deviation from the norm, progress is not possible.