linux-kernel - Re: Linux 6.12.4 - crash dma_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c0e94be466b367f1a3cfdc3cb7b1a4f47e5953ae.camel@sapience.com>
Date: Mon, 09 Dec 2024 09:52:17 -0500
From: Genes Lists <lists@...ience.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, 
	linux-kernel@...r.kernel.org, akpm@...ux-foundation.org, 
	torvalds@...ux-foundation.org, stable@...r.kernel.org
Cc: linux-media@...r.kernel.org, sakari.ailus@...ux.intel.com, 
	bingbu.cao@...el.com
Subject: Re: Linux 6.12.4 - crash dma_alloc_attrs+0x12b via ipu6

On Mon, 2024-12-09 at 11:48 +0100, Greg Kroah-Hartman wrote:
> I'm announcing the release of the 6.12.4 kernel.
> 
> All users of the 6.12 kernel series must upgrade.
> ...
> greg k-h
> 
> 

FYI 6.12.4 got a crash shortly after booting in dma_alloc_attrs - maybe
triggered in ipu6_probe. Crash only happened on laptop with ipu6. All
other machines are running fine.

Logs attached and first trace below

In case it's helpful gdb shows:

(1) gdb ./kernel/dma/mapping.o
(gdb) list *(dma_alloc_attrs+0x12b)
0x161b is in dma_alloc_attrs (kernel/dma/mapping.c:597).
592			gfp_t flag, unsigned long attrs)
593	{
594		const struct dma_map_ops *ops = get_dma_ops(dev);
595		void *cpu_addr;
596	
597		WARN_ON_ONCE(!dev->coherent_dma_mask);
598	

(2) gdb ./drivers/media/pci/intel/ipu6/ipu6-isys.o
(gdb) list *(alloc_fw_msg_bufs+0x67)
0x597 is in alloc_fw_msg_bufs (drivers/media/pci/intel/ipu6/ipu6-
isys.c:957).
952		dma_addr_t dma_addr;
953		unsigned long flags;
954		unsigned int i;
955	
956		for (i = 0; i < amount; i++) {
957			addr = dma_alloc_attrs(dev, sizeof(struct
isys_fw_msgs),
958					       &dma_addr, GFP_KERNEL,
0);
959			if (!addr)
960				break;
961			addr->dma_addr = dma_addr;

(3) gdb ./drivers/media/pci/intel/ipu6/ipu6-isys.o
(gdb) list *(isys_probe+0x349)
0xa79 is in isys_probe (drivers/media/pci/intel/ipu6/ipu6-isys.c:1113).
1108				goto remove_shared_buffer;
1109		}
1110	
1111		cpu_latency_qos_add_request(&isys->pm_qos,
PM_QOS_DEFAULT_VALUE);
1112	
1113		ret = alloc_fw_msg_bufs(isys, 20);
1114		if (ret < 0)
1115			goto out_remove_pkg_dir_shared_buffer;
1116	
1117		isys_iwake_watermark_init(isys);


--------------- trace ----------
Call trace:
 RIP: 0010:dma_alloc_attrs+0x12b/0x140
 Call Trace:
  <TASK>
  ? dma_alloc_attrs+0x12b/0x140
  ? __warn.cold+0x93/0xf6
  ? dma_alloc_attrs+0x12b/0x140
  ? report_bug+0xff/0x140
  ? handle_bug+0x58/0x90
  ? exc_invalid_op+0x17/0x70
  ? asm_exc_invalid_op+0x1a/0x20
  ? dma_alloc_attrs+0x12b/0x140
  alloc_fw_msg_bufs+0x67/0x1f0 [intel_ipu6_isys
1d0f5de0838fdfad5eeaac454f00234fa5b8fdd3]
  isys_probe+0x349/0x980 [intel_ipu6_isys
1d0f5de0838fdfad5eeaac454f00234fa5b8fdd3]
  ? __kmalloc_cache_noprof+0x11c/0x310
  ? kernfs_activate+0x82/0xd0
  ? kernfs_add_one+0x141/0x150 
  ? __pfx_isys_probe+0x10/0x10 [intel_ipu6_isys
1d0f5de0838fdfad5eeaac454f00234fa5b8fdd3]
  auxiliary_bus_probe+0x46/0x80
  ? driver_sysfs_add+0x57/0xc0
  really_probe+0xdb/0x340
  ? pm_runtime_barrier+0x54/0x90
  ? __pfx___driver_attach+0x10/0x10
  __driver_probe_device+0x78/0x110
  driver_probe_device+0x1f/0xa0
  __driver_attach+0xba/0x1c0
  bus_for_each_dev+0x8c/0xe0
  bus_add_driver+0x112/0x1f0
  driver_register+0x72/0xd0
  __auxiliary_driver_register+0x6e/0xd0
  ? __pfx_isys_driver_init+0x10/0x10 [intel_ipu6_isys
1d0f5de0838fdfad5eeaac454f00234fa5b8fdd3]
  do_one_initcall+0x58/0x310
  do_init_module+0x60/0x230
  init_module_from_file+0x89/0xe0
  idempotent_init_module+0x11e/0x310
  __x64_sys_finit_module+0x5e/0xb0
  do_syscall_64+0x82/0x160 
  do_syscall_64+0x82/0x160
  entry_SYSCALL_64_after_hwframe+0x76/0x7e
 RIP: 0033:0x72ae5c2bf1fd



Gene


View attachment "lspci.out" of type "text/plain" (3166 bytes)

View attachment "klog" of type "text/plain" (1734836 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)