Hello, kernel test robot noticed "BUG:KASAN:slab-use-after-free_in_idxd_dma_complete_txd" on: commit: 98d187a989036096feaa2fef1ec3b2240ecdeacf ("dmaengine: idxd: Enable Function Level Reset (FLR) for halt") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master [test failed on linus/master ad1b832bf1cf2df9304f8eb72943111625c7e5a7] [test failed on linux-next/master 0ae0fa3bf0b44c8611d114a9f69985bf451010c3] in testcase: lkvs version: lkvs-x86_64-b814353-1_20250114 with following parameters: test: dma config: x86_64-rhel-9.4-func compiler: gcc-12 test machine: 224 threads 2 sockets Intel(R) Xeon(R) Platinum 8480+ (Sapphire Rapids) with 256G memory (please refer to attached dmesg/kmsg for entire log/backtrace) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <oliver.sang@xxxxxxxxx> | Closes: https://lore.kernel.org/oe-lkp/202502171134.8c403348-lkp@xxxxxxxxx The kernel config and materials to reproduce are available at: https://download.01.org/0day-ci/archive/20250217/202502171134.8c403348-lkp@xxxxxxxxx [ 81.023244][ T1644] idxd dsa0: Active wq 0 on disable wq0.0. [ 81.040447][ T1644] idxd 0000:6a:01.0: Clients has claim on wq 0: 1 [ 81.057589][ T1644] ================================================================== [ 81.067630][ T1644] BUG: KASAN: slab-use-after-free in idxd_dma_complete_txd+0x418/0x510 [idxd] [ 81.078535][ T1644] Write of size 4 at addr ff11000134978114 by task kworker/118:1/1644 [ 81.088651][ T1644] [ 81.092179][ T1644] CPU: 118 UID: 0 PID: 1644 Comm: kworker/118:1 Tainted: G S 6.13.0-rc1-00054-g98d187a98903 #1 [ 81.107286][ T1644] Tainted: [S]=CPU_OUT_OF_SPEC [ 81.113559][ T1644] Hardware name: Intel Corporation D50DNP1SBB/D50DNP1SBB, BIOS SE5C7411.86B.8118.D04.2206151341 06/15/2022 [ 81.127263][ T1644] Workqueue: 0000:6a:01.0 idxd_device_flr [idxd] [ 81.135307][ T1644] Call Trace: [ 81.139911][ T1644] <TASK> [ 81.144097][ T1644] dump_stack_lvl+0x4f/0x70 [ 81.149999][ T1644] print_address_description+0x2c/0x3a0 [ 81.158248][ T1644] ? idxd_dma_complete_txd+0x418/0x510 [idxd] [ 81.165906][ T1644] print_report+0xb9/0x280 [ 81.171662][ T1644] ? kasan_addr_to_slab+0x9/0x90 [ 81.177960][ T1644] ? idxd_dma_complete_txd+0x418/0x510 [idxd] [ 81.185532][ T1644] kasan_report+0xaa/0xe0 [ 81.191118][ T1644] ? idxd_dma_complete_txd+0x418/0x510 [idxd] [ 81.198663][ T1644] idxd_dma_complete_txd+0x418/0x510 [idxd] [ 81.206004][ T1644] ? __asan_memcpy+0x38/0x60 [ 81.211829][ T1644] ? __pfx_idxd_dma_complete_txd+0x10/0x10 [idxd] [ 81.219714][ T1644] ? _raw_spin_lock+0x81/0xe0 [ 81.225650][ T1644] ? __pfx__raw_spin_lock+0x10/0x10 [ 81.232151][ T1644] idxd_flush_pending_descs+0x4a8/0x7e0 [idxd] [ 81.239763][ T1644] ? __pfx_idxd_flush_pending_descs+0x10/0x10 [idxd] [ 81.247975][ T1644] idxd_wq_free_irq+0xcd/0x330 [idxd] [ 81.254703][ T1644] idxd_drv_disable_wq+0x125/0x2d0 [idxd] [ 81.261787][ T1644] idxd_dmaengine_drv_remove+0x1fd/0x2f0 [idxd] [ 81.269441][ T1644] ? kernfs_remove_by_name_ns+0x108/0x150 [ 81.276508][ T1644] device_release_driver_internal+0x36d/0x530 [ 81.283969][ T1644] idxd_device_drv_remove+0xa0/0x240 [idxd] [ 81.291238][ T1644] device_release_driver_internal+0x36d/0x530 [ 81.298666][ T1644] idxd_reset_done+0x600/0x770 [idxd] [ 81.305332][ T1644] ? __pfx_pci_restore_iov_state+0x10/0x10 [ 81.312479][ T1644] ? __pfx_idxd_reset_done+0x10/0x10 [idxd] [ 81.319737][ T1644] ? pci_restore_state+0x42b/0x600 [ 81.326774][ T1644] pci_reset_function+0x1c9/0x230 [ 81.333042][ T1644] idxd_device_flr+0x34/0x90 [idxd] [ 81.339505][ T1644] process_one_work+0x676/0x1000 [ 81.345656][ T1644] worker_thread+0x710/0xf40 [ 81.351399][ T1644] ? __pfx_set_cpus_allowed_ptr+0x10/0x10 [ 81.358381][ T1644] ? __kthread_parkme+0xba/0x1e0 [ 81.364500][ T1644] ? schedule+0x75/0x1c0 [ 81.369820][ T1644] ? __pfx_worker_thread+0x10/0x10 [ 81.376131][ T1644] kthread+0x2d4/0x3c0 [ 81.381240][ T1644] ? __pfx_kthread+0x10/0x10 [ 81.386963][ T1644] ret_from_fork+0x2d/0x70 [ 81.392478][ T1644] ? __pfx_kthread+0x10/0x10 [ 81.398155][ T1644] ret_from_fork_asm+0x1a/0x30 [ 81.404030][ T1644] </TASK> [ 81.407943][ T1644] [ 81.411051][ T1644] Allocated by task 3664: [ 81.416396][ T1644] kasan_save_stack+0x1c/0x40 [ 81.422121][ T1644] kasan_save_track+0x10/0x30 [ 81.427836][ T1644] __kasan_kmalloc+0x8b/0x90 [ 81.433408][ T1644] idxd_dmaengine_drv_probe+0x2eb/0x860 [idxd] [ 81.440774][ T1644] really_probe+0x1e0/0x920 [ 81.441469][ T2471] install debs round one: dpkg -i --force-confdef --force-depends /opt/deb/ntpdate_1%3a4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1_all.deb [ 81.445747][ T1644] __driver_probe_device+0x18c/0x3d0 [ 81.445750][ T1644] device_driver_attach+0xae/0x1b0 [ 81.445751][ T1644] bind_store+0xc9/0x140 [ 81.445756][ T1644] kernfs_fop_write_iter+0x2e6/0x4c0 [ 81.460993][ T2471] [ 81.466823][ T1644] vfs_write+0x584/0xc40 [ 81.466828][ T1644] ksys_write+0xf0/0x1c0 [ 81.466830][ T1644] do_syscall_64+0x79/0x150 [ 81.466834][ T1644] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 81.473172][ T2471] /opt/deb/ntpsec-ntpdate_1.2.2+dfsg1-1+deb12u1_amd64.deb [ 81.477183][ T1644] [ 81.477185][ T1644] Freed by task 1644: [ 81.477186][ T1644] kasan_save_stack+0x1c/0x40 [ 81.477189][ T1644] kasan_save_track+0x10/0x30 [ 81.483064][ T2471] [ 81.485576][ T1644] kasan_save_free_info+0x37/0x60 [ 81.485578][ T1644] __kasan_slab_free+0x33/0x40 [ 81.490842][ T2471] /opt/deb/python3-ntp_1.2.2+dfsg1-1+deb12u1_amd64.deb [ 81.494947][ T1644] kfree+0xef/0x3e0 [ 81.494954][ T1644] idxd_dmaengine_drv_remove+0x1cb/0x2f0 [idxd] [ 81.499941][ T2471] [ 81.506445][ T1644] device_release_driver_internal+0x36d/0x530 [ 81.506448][ T1644] idxd_device_drv_remove+0xa0/0x240 [idxd] [ 81.514840][ T2471] /opt/deb/openssl_3.0.15-1~deb12u1_amd64.deb [ 81.516891][ T1644] device_release_driver_internal+0x36d/0x530 [ 81.516893][ T1644] idxd_reset_done+0x600/0x770 [idxd] [ 81.521311][ T2471] [ 81.526486][ T1644] pci_reset_function+0x1c9/0x230 [ 81.526491][ T1644] idxd_device_flr+0x34/0x90 [idxd] [ 81.532161][ T2471] /opt/deb/libpython3.11_3.11.2-6+deb12u5_amd64.deb [ 81.534173][ T1644] process_one_work+0x676/0x1000 [ 81.539762][ T2471] [ 81.545023][ T1644] worker_thread+0x710/0xf40 [ 81.545026][ T1644] kthread+0x2d4/0x3c0 [ 81.545029][ T1644] ret_from_fork+0x2d/0x70 [ 81.553070][ T2471] /opt/deb/liberror-perl_0.17029-2_all.deb [ 81.556818][ T1644] ret_from_fork_asm+0x1a/0x30 [ 81.556823][ T1644] [ 81.556824][ T1644] The buggy address belongs to the object at ff11000134978100 [ 81.556824][ T1644] which belongs to the cache kmalloc-128 of size 128 [ 81.563755][ T2471] [ 81.566277][ T1644] The buggy address is located 20 bytes inside of [ 81.566277][ T1644] freed 128-byte region [ff11000134978100, ff11000134978180) [ 81.566280][ T1644] [ 81.566281][ T1644] The buggy address belongs to the physical page: [ 81.566283][ T1644] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x134978 [ 81.573497][ T2471] /opt/deb/g++-multilib_4%3a12.2.0-3_amd64.deb [ 81.579562][ T1644] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 81.579565][ T1644] flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) [ 81.579569][ T1644] page_type: f5(slab) [ 81.586307][ T2471] [ 81.593023][ T1644] raw: 0017ffffc0000040 ff1100010c83ca00 dead000000000100 dead000000000122 [ 81.593026][ T1644] raw: 0000000000000000 0000000080400040 00000001f5000000 0000000000000000 [ 81.593028][ T1644] head: 0017ffffc0000040 ff1100010c83ca00 dead000000000100 dead000000000122 [ 81.599459][ T2471] /opt/deb/gcc-multilib_4%3a12.2.0-3_amd64.deb [ 81.601514][ T1644] head: 0000000000000000 0000000080400040 00000001f5000000 0000000000000000 [ 81.601517][ T1644] head: 0017ffffc0000002 ffd4000004d25e01 ffffffffffffffff 0000000000000000 [ 81.607068][ T2471] [ 81.612816][ T1644] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 81.612818][ T1644] page dumped because: kasan: bad access detected [ 81.612818][ T1644] [ 81.612819][ T1644] Memory state around the buggy address: [ 81.612820][ T1644] ff11000134978000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 81.612822][ T1644] ff11000134978080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 81.620598][ T2471] /opt/deb/g++-12-multilib_12.2.0-14_amd64.deb [ 81.625605][ T1644] >ff11000134978100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 81.625607][ T1644] ^ [ 81.625608][ T1644] ff11000134978180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 81.625609][ T1644] ff11000134978200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 81.625611][ T1644] ================================================================== [ 81.625640][ T1644] Disabling lock debugging due to kernel taint [ 81.628154][ T2471] [ 81.652978][ T1644] idxd 0000:6a:01.0: Intel(R) Accelerator Device (v100) [ 81.656683][ T2471] /opt/deb/gcc-12-multilib_12.2.0-14_amd64.deb [ 81.658763][ T1644] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 81.674487][ T2471] [ 81.676998][ T1644] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 81.677003][ T1644] CPU: 118 UID: 0 PID: 1644 Comm: kworker/118:1 Tainted: G S B 6.13.0-rc1-00054-g98d187a98903 #1 [ 81.692784][ T2471] /opt/deb/libx32gcc-12-dev_12.2.0-14_amd64.deb [ 81.694857][ T1644] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE [ 81.694859][ T1644] Hardware name: Intel Corporation D50DNP1SBB/D50DNP1SBB, BIOS SE5C7411.86B.8118.D04.2206151341 06/15/2022 [ 81.694861][ T1644] Workqueue: 0000:6a:01.0 idxd_device_flr [idxd] [ 81.702005][ T2471] [ 81.711836][ T1644] [ 81.711838][ T1644] RIP: 0010:idxd_device_config_restore+0xfe/0x1180 [idxd] [ 81.719149][ T2471] /opt/deb/lib32gcc-12-dev_12.2.0-14_amd64.deb [ 81.728120][ T1644] Code: 01 38 d0 7c 08 84 d2 0f 85 87 10 00 00 48 8d 7b 34 41 0f b7 a8 2c 05 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 3f [ 81.728123][ T1644] RSP: 0018:ffa0000015d5fbd8 EFLAGS: 00010207 [ 81.728126][ T1644] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff823a331a [ 81.736784][ T2471] [ 81.741169][ T1644] RDX: 0000000000000006 RSI: ff1100032281d000 RDI: 0000000000000034 [ 81.741171][ T1644] RBP: 0000000000000000 R08: ff1100032281d000 R09: fff3fc0002babf0d [ 81.741173][ T1644] R10: ffa0000015d5f86f R11: 0000000034363154 R12: ff1100024e2c8a00 [ 81.741174][ T1644] R13: 1ff4000002babf94 R14: ff110002c3a61000 R15: ff110002c3a614f0 [ 81.741176][ T1644] FS: 0000000000000000(0000) GS:ff110017fe700000(0000) knlGS:0000000000000000 [ 81.744155][ T2471] /opt/deb/libx32quadmath0_12.2.0-14_amd64.deb [ 81.753262][ T1644] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 81.753265][ T1644] CR2: 00005571b074b010 CR3: 000000407c86c002 CR4: 0000000000f73ef0 [ 81.762841][ T2471] [ 81.772472][ T1644] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 81.772474][ T1644] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 81.772475][ T1644] PKRU: 55555554 [ 81.772476][ T1644] Call Trace: [ 81.772478][ T1644] <TASK> [ 81.772479][ T1644] ? die_addr+0x3c/0xa0 [ 81.779750][ T2471] /opt/deb/lib32quadmath0_12.2.0-14_amd64.deb [ 81.788975][ T1644] ? exc_general_protection+0x150/0x230 [ 81.788980][ T1644] ? asm_exc_general_protection+0x22/0x30 [ 81.798674][ T2471] [ 81.801182][ T1644] ? llist_add_batch+0xba/0x130 [ 81.811306][ T2471] /opt/deb/libx32atomic1_12.2.0-14_amd64.deb [ 81.817968][ T1644] ? idxd_device_config_restore+0xfe/0x1180 [idxd] [ 81.820540][ T2471] [ 81.826767][ T1644] ? idxd_pci_probe_alloc+0x1b7/0xbd0 [idxd] [ 81.836181][ T2471] /opt/deb/lib32atomic1_12.2.0-14_amd64.deb [ 81.844727][ T1644] idxd_reset_done+0x1d8/0x770 [idxd] [ 81.851592][ T2471] [ 81.860536][ T1644] ? __pfx_pci_restore_iov_state+0x10/0x10 [ 81.860542][ T1644] ? __pfx_idxd_reset_done+0x10/0x10 [idxd] [ 81.866040][ T2471] /opt/deb/libx32gcc-s1_12.2.0-14_amd64.deb [ 81.874587][ T1644] ? pci_restore_state+0x42b/0x600 [ 81.874591][ T1644] pci_reset_function+0x1c9/0x230 [ 81.874594][ T1644] idxd_device_flr+0x34/0x90 [idxd] [ 81.883600][ T2471] [ 81.892543][ T1644] process_one_work+0x676/0x1000 [ 81.892550][ T1644] worker_thread+0x710/0xf40 [ 81.899811][ T2471] /opt/deb/lib32gcc-s1_12.2.0-14_amd64.deb [ 81.901950][ T1644] ? __pfx_set_cpus_allowed_ptr+0x10/0x10 [ 81.909670][ T2471] [ 81.916481][ T1644] ? __kthread_parkme+0xba/0x1e0 [ 81.916484][ T1644] ? schedule+0x75/0x1c0 [ 81.931137][ T2471] /opt/deb/sgml-data_2.0.11+nmu1_all.deb [ 81.933252][ T1644] ? __pfx_worker_thread+0x10/0x10 [ 81.942644][ T2471] [ 81.955692][ T1644] kthread+0x2d4/0x3c0 [ 81.955695][ T1644] ? __pfx_kthread+0x10/0x10 [ 81.955697][ T1644] ret_from_fork+0x2d/0x70 [ 81.962967][ T2471] /opt/deb/cmake_3.25.1-1_amd64.deb [ 81.969242][ T1644] ? __pfx_kthread+0x10/0x10 [ 81.969245][ T1644] ret_from_fork_asm+0x1a/0x30 [ 81.969249][ T1644] </TASK> [ 81.969250][ T1644] Modules linked in: [ 81.981945][ T2471] [ 81.988957][ T1644] dmatest(+) intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common intel_ifs i10nm_edac skx_edac_common nfit [ 81.991926][ T2471] /opt/deb/cmake-data_3.25.1-1_all.deb [ 81.994039][ T1644] libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp btrfs kvm_intel blake2b_generic xor kvm zstd_compress [ 82.001948][ T2471] [ 82.008781][ T1644] crct10dif_pclmul crc32_pclmul ghash_clmulni_intel sha512_ssse3 raid6_pq sha256_ssse3 libcrc32c sha1_ssse3 snd_pcm crc32c_intel spi_nor ast rapl [ 82.031083][ T2471] /opt/deb/patch_2.7.6-7_amd64.deb [ 82.037471][ T1644] snd_timer dax_hmem drm_client_lib cxl_acpi mtd [ 82.046363][ T2471] [ 82.048897][ T1644] snd mei_me intel_cstate nvme ipmi_ssif drm_shmem_helper [ 82.058188][ T2471] /opt/deb/libdpkg-perl_1.21.22_all.deb [ 82.066655][ T1644] iaa_crypto isst_if_mbox_pci isst_if_mmio cxl_port qat_4xxx pmt_telemetry [ 82.075558][ T2471] [ 82.084424][ T1644] intel_sdsi pmt_class intel_th_gth intel_qat cxl_core idxd soundcore [ 82.094772][ T2471] /opt/deb/g++_4%3a12.2.0-3_amd64.deb [ 82.101195][ T1644] intel_th_pci crc8 i2c_i801 spi_intel_pci intel_uncore mei nvme_core [ 82.108530][ T2471] [ 82.117385][ T1644] drm_kms_helper einj acpi_power_meter cdc_ether pcspkr isst_if_common authenc [ 82.120298][ T2471] /opt/deb/g++-12_12.2.0-14_amd64.deb [ 82.128818][ T1644] intel_vsec idxd_bus intel_th wmi [ 82.137715][ T2471] [ 82.141586][ T1644] i2c_smbus spi_intel i2c_ismt ipmi_si acpi_ipmi ipmi_devintf ipmi_msghandler pinctrl_emmitsburg [ 82.145573][ T2471] /opt/deb/gcc_4%3a12.2.0-3_amd64.deb [ 82.148443][ T1644] acpi_pad joydev pfr_telemetry pfr_update binfmt_misc loop [ 82.153055][ T2471] [ 82.159772][ T1644] fuse drm [ 82.166283][ T2471] /opt/deb/gcc-12_12.2.0-14_amd64.deb [ 82.172250][ T1644] dm_mod ip_tables [ 82.174780][ T2471] [ 82.180164][ T1644] ---[ end trace 0000000000000000 ]--- [ 82.187224][ T2471] /opt/deb/libgcc-12-dev_12.2.0-14_amd64.deb [ 82.209342][ T1644] pstore: backend (erst) writing error (-28) [ 82.212775][ T2471] [ 82.218701][ T1644] RIP: 0010:idxd_device_config_restore+0xfe/0x1180 [idxd] [ 82.221693][ T2471] /opt/deb/libquadmath0_12.2.0-14_amd64.deb [ 82.227705][ T1644] Code: 01 38 d0 7c 08 84 d2 0f 85 87 10 00 00 48 8d 7b 34 41 0f b7 a8 2c 05 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 3f [ 82.234257][ T2471] [ 82.240814][ T1644] RSP: 0018:ffa0000015d5fbd8 EFLAGS: 00010207 [ 82.247569][ T2471] /opt/deb/libatomic1_12.2.0-14_amd64.deb [ 82.252734][ T1644] [ 82.252735][ T1644] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff823a331a [ 82.252736][ T1644] RDX: 0000000000000006 RSI: ff1100032281d000 RDI: 0000000000000034 [ 82.258508][ T2471] [ 82.261058][ T1644] RBP: 0000000000000000 R08: ff1100032281d000 R09: fff3fc0002babf0d [ 82.261060][ T1644] R10: ffa0000015d5f86f R11: 0000000034363154 R12: ff1100024e2c8a00 [ 82.261061][ T1644] R13: 1ff4000002babf94 R14: ff110002c3a61000 R15: ff110002c3a614f0 [ 82.266938][ T2471] /opt/deb/automake_1%3a1.16.5-1.3_all.deb [ 82.271636][ T1644] FS: 0000000000000000(0000) GS:ff110017fe700000(0000) knlGS:0000000000000000 [ 82.271638][ T1644] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 82.271639][ T1644] CR2: 00005571b074b010 CR3: 000000407c86c002 CR4: 0000000000f73ef0 [ 82.278092][ T2471] [ 82.284445][ T1644] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 82.287603][ T2471] /opt/deb/libpython3.11-minimal_3.11.2-6+deb12u5_amd64.deb [ 82.292478][ T1644] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 82.297171][ T2471] [ 82.303411][ T1644] PKRU: 55555554 [ 82.309646][ T2471] /opt/deb/python3.11-minimal_3.11.2-6+deb12u5_amd64.deb [ 82.311642][ T1644] Kernel panic - not syncing: Fatal exception [ 82.316193][ T1644] Kernel Offset: disabled -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki