[paulmckrcu:non-rcu/next] [hazptrtorture] 9b08a09f6d: BUG:kernel_NULL_pointer_dereference,address
kernel test robot <[email protected]>
| Newsgroups | dev.linux.lists.oe-lkp,org.kernel.vger.rcu |
|---|---|
| Message-ID | <[email protected]> |
Hello,
kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
commit: 9b08a09f6d073bebd38e7be08781b0a4758c924e ("hazptrtorture: Defer release of hazard pointers") https://github.com/paulmckrcu/linux non-rcu/next
[test failed on linux-next/master 6b8c8af514d739d0335f5579b585e02babe8a727]
in testcase: trinity
version: trinity-i386-abe9de86-1_20230429 with following parameters:
runtime: 300s
group: group-00
nr_groups: 5
reproduction: run 254 cycles, the issue can be reproduced for 16 times.
config: i386-randconfig-015-20260807
compiler: clang-22
test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 4G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-lkp/[email protected]
[ 419.412561][ T52] BUG: kernel NULL pointer dereference, address: 00000108
[ 419.456670][ T52] #PF: supervisor read access in kernel mode
[ 419.495649][ T52] #PF: error_code(0x0000) - not-present page
[ 419.534113][ T52] *pde = 00000000
[ 419.554661][ T52] Oops: Oops: 0000 [#1] SMP
[ 419.579287][ T52] CPU: 0 UID: 0 PID: 52 Comm: hazptr_torture_ Tainted: G W 7.2.0-rc3-00011-g9b08a09f6d07 #1 PREEMPTLAZY 809133f67ba61c2271624f9b1ff820a8a212cdad
[ 419.666331][ T52] Tainted: [W]=WARN
[ 419.686632][ T52] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 419.731225][ T52] EIP: hazptr_synchronize_overflow_list+0x43/0xc0
[ 419.767103][ T52] Code: 30 8b 4e 34 90 90 90 89 4d e8 89 7d ec 8d 46 2c 89 45 f0 8b 45 f0 8b 00 89 45 f0 85 c0 74 67 90 90 90 90 90 90 90 90 8b 45 f0 <8b> 40 08 3b 45 e4 0f 95 c3 83 f8 01 0f 95 c7 89 f0 e8 67 bc fe 00
All code
========
0: 30 8b 4e 34 90 90 xor %cl,-0x6f6fcbb2(%rbx)
6: 90 nop
7: 89 4d e8 mov %ecx,-0x18(%rbp)
a: 89 7d ec mov %edi,-0x14(%rbp)
d: 8d 46 2c lea 0x2c(%rsi),%eax
10: 89 45 f0 mov %eax,-0x10(%rbp)
13: 8b 45 f0 mov -0x10(%rbp),%eax
16: 8b 00 mov (%rax),%eax
18: 89 45 f0 mov %eax,-0x10(%rbp)
1b: 85 c0 test %eax,%eax
1d: 74 67 je 0x86
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
26: 90 nop
27: 8b 45 f0 mov -0x10(%rbp),%eax
2a:* 8b 40 08 mov 0x8(%rax),%eax <-- trapping instruction
2d: 3b 45 e4 cmp -0x1c(%rbp),%eax
30: 0f 95 c3 setne %bl
33: 83 f8 01 cmp $0x1,%eax
36: 0f 95 c7 setne %bh
39: 89 f0 mov %esi,%eax
3b: e8 67 bc fe 00 call 0xfebca7
Code starting with the faulting instruction ===========================================
0: 8b 40 08 mov 0x8(%rax),%eax
3: 3b 45 e4 cmp -0x1c(%rbp),%eax
6: 0f 95 c3 setne %bl
9: 83 f8 01 cmp $0x1,%eax
c: 0f 95 c7 setne %bh
f: 89 f0 mov %esi,%eax
11: e8 67 bc fe 00 call 0xfebc7d
[ 419.872228][ T52] EAX: 00000100 EBX: 00000000 ECX: 00000000 EDX: 00000202
[ 419.904569][ T52] ESI: e4f7e13c EDI: 00000829 EBP: b3e9df20 ESP: b3e9df04
[ 419.941247][ T52] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00010006
[ 419.980096][ T52] CR0: 80050033 CR2: 00000108 CR3: 05fb1000 CR4: 00000690
[ 420.005370][ T52] Call Trace:
[ 420.022998][ T52] hazptr_synchronize+0x166/0x200
[ 420.050473][ T52] hazptr_torture_writer+0x153/0x400
[ 420.076986][ T52] ? __kthread_parkme+0x4b/0x100
[ 420.094745][ T52] kthread+0x107/0x140
[ 420.112829][ T52] ? hazptr_torture_reader+0x340/0x340
[ 420.140468][ T52] ? kthread_unuse_mm+0xc0/0xc0
[ 420.165878][ T52] ? kthread_unuse_mm+0xc0/0xc0
[ 420.185387][ T52] ret_from_fork+0x131/0x240
[ 420.207521][ T52] ? kthread_unuse_mm+0xc0/0xc0
[ 420.231501][ T52] ret_from_fork_asm+0x12/0x20
[ 420.256219][ T52] entry_INT80_32+0x125/0x125
[ 420.280981][ T52] Modules linked in: ipmi_devintf ppdev rapl i2c_piix4 tpm_tis tpm_tis_core i2c_smbus tpm i2c_core ata_generic i6300esb libata parport_pc rtc_cmos parport fuse
[ 420.365047][ T52] CR2: 0000000000000108
[ 420.387629][ T52] ---[ end trace 0000000000000000 ]---
[ 420.416535][ T52] EIP: hazptr_synchronize_overflow_list+0x43/0xc0
[ 420.451442][ T52] Code: 30 8b 4e 34 90 90 90 89 4d e8 89 7d ec 8d 46 2c 89 45 f0 8b 45 f0 8b 00 89 45 f0 85 c0 74 67 90 90 90 90 90 90 90 90 8b 45 f0 <8b> 40 08 3b 45 e4 0f 95 c3 83 f8 01 0f 95 c7 89 f0 e8 67 bc fe 00
All code
========
0: 30 8b 4e 34 90 90 xor %cl,-0x6f6fcbb2(%rbx)
6: 90 nop
7: 89 4d e8 mov %ecx,-0x18(%rbp)
a: 89 7d ec mov %edi,-0x14(%rbp)
d: 8d 46 2c lea 0x2c(%rsi),%eax
10: 89 45 f0 mov %eax,-0x10(%rbp)
13: 8b 45 f0 mov -0x10(%rbp),%eax
16: 8b 00 mov (%rax),%eax
18: 89 45 f0 mov %eax,-0x10(%rbp)
1b: 85 c0 test %eax,%eax
1d: 74 67 je 0x86
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
26: 90 nop
27: 8b 45 f0 mov -0x10(%rbp),%eax
2a:* 8b 40 08 mov 0x8(%rax),%eax <-- trapping instruction
2d: 3b 45 e4 cmp -0x1c(%rbp),%eax
30: 0f 95 c3 setne %bl
33: 83 f8 01 cmp $0x1,%eax
36: 0f 95 c7 setne %bh
39: 89 f0 mov %esi,%eax
3b: e8 67 bc fe 00 call 0xfebca7
Code starting with the faulting instruction ===========================================
0: 8b 40 08 mov 0x8(%rax),%eax
3: 3b 45 e4 cmp -0x1c(%rbp),%eax
6: 0f 95 c3 setne %bl
9: 83 f8 01 cmp $0x1,%eax
c: 0f 95 c7 setne %bh
f: 89 f0 mov %esi,%eax
11: e8 67 bc fe 00 call 0xfebc7d
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20260813/[email protected]
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki