[harry:kmalloc-no-objext-rfc-v1r1] [mm/slab] 6bc21472e7: BUG:kernel_NULL_pointer_dereference,address
kernel test robot <[email protected]> Thu, 9 Jul 2026 16:48:00 +0800
| Newsgroups | dev.linux.lists.oe-lkp,org.kvack.linux-mm |
|---|---|
| Message-ID | <[email protected]> |
Hello,
kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
commit: 6bc21472e7eb9f8c771ffdf86266aa6d9dcb1dac ("mm/slab: prevent unbounded recursion due to obj_exts in free path")
https://git.kernel.org/cgit/linux/kernel/git/harry/linux.git kmalloc-no-objext-rfc-v1r1
in testcase: boot
config: i386-randconfig-2006-20250804
compiler: gcc-14
test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 4G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-lkp/[email protected]
[ 0.183091][ T0] BUG: kernel NULL pointer dereference, address: 0000000c
[ 0.183772][ T0] #PF: supervisor read access in kernel mode
[ 0.184312][ T0] #PF: error_code(0x0000) - not-present page
[ 0.184851][ T0] *pde = 00000000
[ 0.185186][ T0] Oops: Oops: 0000 [#1]
[ 0.185561][ T0] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.2.0-rc1+ #1 PREEMPT 27a7cd77b6ab41253c0455bf8bac7f75db905e14
[ 0.186647][ T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 0.187601][ T0] EIP: __kmalloc_flags_noprof (slub.c:5311 slub.c:5506)
[ 0.188122][ T0] Code: 7d d7 00 74 0a 84 d2 74 06 31 c0 89 df f3 aa ff 75 e8 89 da 89 f0 8b 4d dc e8 47 28 00 00 59 8b 45 e0 89 da ff 75 0c ff 75 dc <ff> 76 0c 8b 4d d8 e8 00 da ff ff 83 c4 0c eb 16 8d 45 e0 50 ff 75
All code
========
0: 7d d7 jge 0xffffffffffffffd9
2: 00 74 0a 84 add %dh,-0x7c(%rdx,%rcx,1)
6: d2 74 06 31 shlb %cl,0x31(%rsi,%rax,1)
a: c0 89 df f3 aa ff 75 rorb $0x75,-0x550c21(%rcx)
11: e8 89 da 89 f0 call 0xfffffffff089da9f
16: 8b 4d dc mov -0x24(%rbp),%ecx
19: e8 47 28 00 00 call 0x2865
1e: 59 pop %rcx
1f: 8b 45 e0 mov -0x20(%rbp),%eax
22: 89 da mov %ebx,%edx
24: ff 75 0c push 0xc(%rbp)
27: ff 75 dc push -0x24(%rbp)
2a:* ff 76 0c push 0xc(%rsi) <-- trapping instruction
2d: 8b 4d d8 mov -0x28(%rbp),%ecx
30: e8 00 da ff ff call 0xffffffffffffda35
35: 83 c4 0c add $0xc,%esp
38: eb 16 jmp 0x50
3a: 8d 45 e0 lea -0x20(%rbp),%eax
3d: 50 push %rax
3e: ff .byte 0xff
3f: 75 .byte 0x75
Code starting with the faulting instruction
===========================================
0: ff 76 0c push 0xc(%rsi)
3: 8b 4d d8 mov -0x28(%rbp),%ecx
6: e8 00 da ff ff call 0xffffffffffffda0b
b: 83 c4 0c add $0xc,%esp
e: eb 16 jmp 0x26
10: 8d 45 e0 lea -0x20(%rbp),%eax
13: 50 push %rax
14: ff .byte 0xff
15: 75 .byte 0x75
[ 0.189928][ T0] EAX: b11c8b96 EBX: 00000000 ECX: b18bdac5 EDX: 00000000
[ 0.190574][ T0] ESI: 00000000 EDI: 00000150 EBP: b1e17df0 ESP: b1e17db8
[ 0.191220][ T0] DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00210046
[ 0.191925][ T0] CR0: 80050033 CR2: 0000000c CR3: 0253b000 CR4: 00000090
[ 0.192579][ T0] Call Trace:
[ 0.192877][ T0] ? alloc_from_new_slab (linux/spinlock.h:408 slub.c:4416)
[ 0.193350][ T0] ? alloc_slab_obj_exts (slab.h:39 slub.c:2149)
[ 0.193823][ T0] alloc_slab_obj_exts (slab.h:39 slub.c:2149)
[ 0.194280][ T0] __alloc_tagging_slab_alloc_hook (slub.c:2329 slub.c:2358)
[ 0.194833][ T0] alloc_tagging_slab_alloc_hook (slub.c:2381)
[ 0.195372][ T0] __kmalloc_cache_node_noprof (slub.c:4596 slub.c:4893 slub.c:5482)
[ 0.195903][ T0] ? init_kmem_cache_nodes (linux/slab.h:1192 slub.c:7732)
[ 0.196400][ T0] init_kmem_cache_nodes (linux/slab.h:1192 slub.c:7732)
[ 0.196882][ T0] do_kmem_cache_create (slub.c:8646)
[ 0.197354][ T0] create_boot_cache (slab_common.c:717)
[ 0.197788][ T0] new_kmalloc_cache (slab_common.c:735 slab_common.c:996)
[ 0.198237][ T0] create_kmalloc_caches (slab_common.c:1019)
[ 0.198701][ T0] kmem_cache_init (slub.c:8555)
[ 0.199125][ T0] mm_core_init (mm_init.c:2728)
[ 0.199533][ T0] start_kernel (main.c:1034)
[ 0.199939][ T0] i386_start_kernel (x86/kernel/head32.c:79)
[ 0.200368][ T0] startup_32_smp (x86/kernel/head_32.S:292)
[ 0.200791][ T0] Modules linked in:
[ 0.201141][ T0] CR2: 000000000000000c
[ 0.201513][ T0] ---[ end trace 0000000000000000 ]---
[ 0.202004][ T0] EIP: __kmalloc_flags_noprof (slub.c:5311 slub.c:5506)
[ 0.202522][ T0] Code: 7d d7 00 74 0a 84 d2 74 06 31 c0 89 df f3 aa ff 75 e8 89 da 89 f0 8b 4d dc e8 47 28 00 00 59 8b 45 e0 89 da ff 75 0c ff 75 dc <ff> 76 0c 8b 4d d8 e8 00 da ff ff 83 c4 0c eb 16 8d 45 e0 50 ff 75
All code
========
0: 7d d7 jge 0xffffffffffffffd9
2: 00 74 0a 84 add %dh,-0x7c(%rdx,%rcx,1)
6: d2 74 06 31 shlb %cl,0x31(%rsi,%rax,1)
a: c0 89 df f3 aa ff 75 rorb $0x75,-0x550c21(%rcx)
11: e8 89 da 89 f0 call 0xfffffffff089da9f
16: 8b 4d dc mov -0x24(%rbp),%ecx
19: e8 47 28 00 00 call 0x2865
1e: 59 pop %rcx
1f: 8b 45 e0 mov -0x20(%rbp),%eax
22: 89 da mov %ebx,%edx
24: ff 75 0c push 0xc(%rbp)
27: ff 75 dc push -0x24(%rbp)
2a:* ff 76 0c push 0xc(%rsi) <-- trapping instruction
2d: 8b 4d d8 mov -0x28(%rbp),%ecx
30: e8 00 da ff ff call 0xffffffffffffda35
35: 83 c4 0c add $0xc,%esp
38: eb 16 jmp 0x50
3a: 8d 45 e0 lea -0x20(%rbp),%eax
3d: 50 push %rax
3e: ff .byte 0xff
3f: 75 .byte 0x75
Code starting with the faulting instruction
===========================================
0: ff 76 0c push 0xc(%rsi)
3: 8b 4d d8 mov -0x28(%rbp),%ecx
6: e8 00 da ff ff call 0xffffffffffffda0b
b: 83 c4 0c add $0xc,%esp
e: eb 16 jmp 0x26
10: 8d 45 e0 lea -0x20(%rbp),%eax
13: 50 push %rax
14: ff .byte 0xff
15: 75 .byte 0x75
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20260709/[email protected]
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki