Re: ata: BUG in ata_sff_hsm_move

From: Dmitry Vyukov
Date: Fri Jan 29 2016 - 07:00:19 EST

On Fri, Jan 29, 2016 at 12:52 PM, Tejun Heo <tj@xxxxxxxxxx> wrote:
> Hello, Dmitry.
> On Thu, Jan 28, 2016 at 12:35:43PM +0100, Dmitry Vyukov wrote:
>> Hello,
>> I episodically hit the following BUG while running syzkaller fuzzer:
>> ata2: protocol 2 task_state 0 (dev_stat 0x41)
>> ------------[ cut here ]------------
>> kernel BUG at drivers/ata/libata-sff.c:1302!
> ...
>> So the unexpected state is HSM_IDLE.
> Hmmm... the port interrupt handler checks for IDLE before calling into
> hsm_move, so the only explanation would be that something is resetting
> it to IDLE inbetween. ce7514526742 ("libata: prevent HSM state change
> race between ISR and PIO") describes and fixes the same problem. The
> fix seems correct and I can't find anywhere else where this can
> happen. :(
> Can you please post the kernel log leading to the BUG? Also, I don't
> think that condition needs to be BUG. I'll change it to WARN.

Here are two logs, in both cases no kernel messages prior to the bug: