Re: [syzbot] [kernel?] WARNING in its_msi_teardown

[Marc Zyngier]

On Wed, 29 Jul 2026 01:08:31 +0100,
syzbot <syzbot+229d761b8a110e6de517@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> 
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    b66b0005b6ce Merge branches 'for-next/fixes' and 'for-next..
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> console output: https://syzkaller.appspot.com/x/log.txt?x=15f7d746580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=72c97575381cec47
> dashboard link: https://syzkaller.appspot.com/bug?extid=229d761b8a110e6de517
> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> userspace arch: arm64
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1667e09e580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17525fde580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/63e3226301fe/disk-b66b0005.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/b268844cbd22/vmlinux-b66b0005.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/9440dfc93d1e/Image-b66b0005.gz.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+229d761b8a110e6de517@xxxxxxxxxxxxxxxxxxxxxxxxx
> 
>  el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
>  do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
>  el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
>  el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
>  el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
> ------------[ cut here ]------------
> WARNING: drivers/irqchip/irq-gic-v3-its.c:2251 at its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2251 [inline], CPU#0: syz.0.18/4916
> WARNING: drivers/irqchip/irq-gic-v3-its.c:2251 at its_msi_teardown+0x3a4/0x424 drivers/irqchip/irq-gic-v3-its.c:3644, CPU#0: syz.0.18/4916
> Modules linked in:
> CPU: 0 UID: 0 PID: 4916 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
> pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
> pc : its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2251 [inline]
> pc : its_msi_teardown+0x3a4/0x424 drivers/irqchip/irq-gic-v3-its.c:3644
> lr : its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2251 [inline]
> lr : its_msi_teardown+0x3a4/0x424 drivers/irqchip/irq-gic-v3-its.c:3644
> sp : ffff800098017560
> x29: ffff8000980175f0 x28: ffff0000cfc75930 x27: 1fffe00019f8eb26
> x26: 1fffe00019f8eb22 x25: ffff0000c13e1000 x24: dfff800000000000
> x23: ffff700013002eac x22: 00000000fffffff4 x21: ffff800098017580
> x20: ffff0000c1e07ce0 x19: ffff0000cfc75900 x18: 00000000ffffffff
> x17: 70202c31206c6176 x16: 0000000000000001 x15: 0000000000000000
> x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000
> x11: 0000000000000000 x10: 0000000000000003 x9 : 0000000000000000
> x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
> x5 : 00000000ffffffff x4 : 0000000000000cc0 x3 : ffff800081ba1c7c
> x2 : 00000000fffffff4 x1 : ffff0000cfb10000 x0 : 0000000000000000
> Call trace:
>  its_lpi_free drivers/irqchip/irq-gic-v3-its.c:2251 [inline] (P)
>  its_msi_teardown+0x3a4/0x424 drivers/irqchip/irq-gic-v3-its.c:3644 (P)
>  its_msi_teardown+0xa0/0xb8 drivers/irqchip/irq-gic-its-msi-parent.c:249

That's an allocation failure, caused by a fault injection. We end-up
leaking LPIs, but there isn't much we can do about that if we can't
allocate the correct tracking structure.

So yes, we WARN() about this, and carry on.

	M.

-- 
Without deviation from the norm, progress is not possible.