* [vbabka:b4/sheaves-for-all-rebased] [slab] 3c9d05a883: BUG_TestSlub_kfree_rcu_wq_destroy
@ 2026-01-12 7:45 kernel test robot
2026-01-12 10:07 ` Vlastimil Babka
0 siblings, 1 reply; 2+ messages in thread
From: kernel test robot @ 2026-01-12 7:45 UTC (permalink / raw)
To: Vlastimil Babka; +Cc: oe-lkp, lkp, linux-mm, oliver.sang
Hello,
kernel test robot noticed "BUG_TestSlub_kfree_rcu_wq_destroy" on:
commit: 3c9d05a88372eb667214035d903b5ea09be4459b ("slab: add sheaves to most caches")
https://git.kernel.org/cgit/linux/kernel/git/vbabka/linux.git b4/sheaves-for-all-rebased
in testcase: kunit
version:
with following parameters:
group: group-00
config: x86_64-rhel-9.4-kunit
compiler: gcc-14
test machine: 8 threads 1 sockets Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (Haswell) with 16G memory
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202601121442.c530bed3-lkp@intel.com
kern :err : [ 137.071325] [ T4498] # test_kfree_rcu: EXPECTATION FAILED at lib/tests/slub_kunit.c:182
Expected 0 == slab_errors, but
slab_errors == 2 (0x2)
kern :info : [ 137.076926] [ T4491] not ok 4 test_kfree_rcu
kern :err : [ 137.133204] [ T2648] =============================================================================
kern :err : [ 137.146570] [ T2648] BUG TestSlub_kfree_rcu_wq_destroy (Tainted: G S B N ): Objects remaining on __kmem_cache_shutdown()
kern :err : [ 137.158349] [ T2648] -----------------------------------------------------------------------------
kern :err : [ 137.169350] [ T2648] Object 0x00000000b072383a @offset=2240
kern :err : [ 137.174817] [ T2648] Slab 0x000000005fc4154e objects=128 used=1 fp=0x000000000b8c0d81 flags=0x17ffffc0000200(workingset|node=0|zone=2|lastcpupid=0x1fffff)
kern :warn : [ 137.188509] [ T2648] ------------[ cut here ]------------
kern :warn : [ 137.193801] [ T2648] WARNING: mm/slub.c:1248 at __slab_err+0x19/0x20, CPU#1: 0/2648
kern :warn : [ 137.202990] [ T2648] Modules linked in: slub_kunit linear_ranges binfmt_misc snd_hda_codec_intelhdmi snd_hda_codec_hdmi btrfs intel_rapl_msr intel_rapl_common blake2b x86_pkg_temp_thermal xor snd_hda_codec_alc269 raid6_pq intel_powerclamp snd_hda_scodec_component snd_hda_codec_realtek_lib coretemp i915 snd_hda_codec_generic sd_mod snd_hda_intel kvm_intel sg snd_hda_codec intel_gtt platform_profile snd_hda_core ttm drm_client_lib kvm dell_wmi snd_intel_dspcfg drm_buddy snd_intel_sdw_acpi dell_smbios drm_display_helper snd_hwdep dell_wmi_descriptor irqbypass ahci ghash_clmulni_intel sparse_keymap snd_pcm libahci mei_wdt cec rfkill rapl intel_cstate mei_me snd_timer dcdbas libata i2c_i801 snd drm_kms_helper i2c_smbus intel_uncore mei soundcore pcspkr lpc_ich video wmi fuse drm nfnetlink [last unloaded: mptcp_token_test]
kern :warn : [ 137.275019] [ T2648] CPU: 1 UID: 0 PID: 2648 Comm: kworker/u33:0 Tainted: G S B N 6.19.0-rc1-00005-g3c9d05a88372 #1 PREEMPT(voluntary)
kern :warn : [ 137.288184] [ T2648] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [N]=TEST
kern :warn : [ 137.294860] [ T2648] Hardware name: Dell Inc. OptiPlex 9020/0DNKMN, BIOS A05 12/05/2013
kern :warn : [ 137.302746] [ T2648] Workqueue: test_kfree_rcu_destroy_wq cache_destroy_workfn [slub_kunit]
kern :warn : [ 137.310986] [ T2648] RIP: 0010:__slab_err (kbuild/src/consumer/mm/slub.c:1249)
kern :warn : [ 137.316370] [ T2648] Code: 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 e8 16 fd ff ff be 01 00 00 00 bf 05 00 00 00 e8 07 b8 2e 00 <0f> 0b c3 cc cc cc cc 44 89 e2 be 00 10 00 00 48 c7 c7 c0 12 bc 85
All code
========
0: 00 90 90 90 90 90 add %dl,-0x6f6f6f70(%rax)
6: 90 nop
7: 90 nop
8: 90 nop
9: 90 nop
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
16: e8 16 fd ff ff call 0xfffffffffffffd31
1b: be 01 00 00 00 mov $0x1,%esi
20: bf 05 00 00 00 mov $0x5,%edi
25: e8 07 b8 2e 00 call 0x2eb831
2a:* 0f 0b ud2 <-- trapping instruction
2c: c3 ret
2d: cc int3
2e: cc int3
2f: cc int3
30: cc int3
31: 44 89 e2 mov %r12d,%edx
34: be 00 10 00 00 mov $0x1000,%esi
39: 48 c7 c7 c0 12 bc 85 mov $0xffffffff85bc12c0,%rdi
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: c3 ret
3: cc int3
4: cc int3
5: cc int3
6: cc int3
7: 44 89 e2 mov %r12d,%edx
a: be 00 10 00 00 mov $0x1000,%esi
f: 48 c7 c7 c0 12 bc 85 mov $0xffffffff85bc12c0,%rdi
kern :warn : [ 137.335754] [ T2648] RSP: 0018:ffffc900023cfc30 EFLAGS: 00010046
kern :warn : [ 137.341652] [ T2648] RAX: 0000000000000000 RBX: ffff888411a3f280 RCX: ffffffff8152ff76
kern :warn : [ 137.349451] [ T2648] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffff8772f660
kern :warn : [ 137.357253] [ T2648] RBP: ffffea00041cddc0 R08: 0000000000000001 R09: fffffbfff0ee5ecc
kern :warn : [ 137.365053] [ T2648] R10: ffffffff8772f667 R11: 0000000000000001 R12: ffff88815d5ef7c0
kern :warn : [ 137.372853] [ T2648] R13: ffff888107378000 R14: ffff888107377000 R15: ffff888411a3f280
kern :warn : [ 137.380655] [ T2648] FS: 0000000000000000(0000) GS:ffff88842480b000(0000) knlGS:0000000000000000
kern :warn : [ 137.389407] [ T2648] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kern :warn : [ 137.395824] [ T2648] CR2: 00007f0dd03d60ac CR3: 000000041b674002 CR4: 00000000001726f0
kern :warn : [ 137.403626] [ T2648] DR0: ffffffff87858864 DR1: ffffffff87858869 DR2: ffffffff8785886a
kern :warn : [ 137.411426] [ T2648] DR3: ffffffff8785886b DR6: 00000000ffff0ff0 DR7: 0000000000000600
kern :warn : [ 137.419227] [ T2648] Call Trace:
kern :warn : [ 137.422358] [ T2648] <TASK>
kern :warn : [ 137.425143] [ T2648] __kmem_cache_shutdown.cold (kbuild/src/consumer/include/linux/reciprocal_div.h:36 (discriminator 4) kbuild/src/consumer/mm/slub.c:8072 (discriminator 4) kbuild/src/consumer/mm/slub.c:8093 (discriminator 4) kbuild/src/consumer/mm/slub.c:8131 (discriminator 4))
kern :warn : [ 137.430441] [ T2648] kmem_cache_destroy (kbuild/src/consumer/mm/slab_common.c:560 kbuild/src/consumer/mm/slab_common.c:518)
kern :warn : [ 137.435220] [ T2648] process_one_work (kbuild/src/consumer/arch/x86/include/asm/jump_label.h:37 kbuild/src/consumer/include/trace/events/workqueue.h:110 kbuild/src/consumer/kernel/workqueue.c:3262)
kern :warn : [ 137.439915] [ T2648] worker_thread (kbuild/src/consumer/kernel/workqueue.c:3334 (discriminator 2) kbuild/src/consumer/kernel/workqueue.c:3421 (discriminator 2))
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20260112/202601121442.c530bed3-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [vbabka:b4/sheaves-for-all-rebased] [slab] 3c9d05a883: BUG_TestSlub_kfree_rcu_wq_destroy
2026-01-12 7:45 [vbabka:b4/sheaves-for-all-rebased] [slab] 3c9d05a883: BUG_TestSlub_kfree_rcu_wq_destroy kernel test robot
@ 2026-01-12 10:07 ` Vlastimil Babka
0 siblings, 0 replies; 2+ messages in thread
From: Vlastimil Babka @ 2026-01-12 10:07 UTC (permalink / raw)
To: kernel test robot, Harry Yoo; +Cc: oe-lkp, lkp, linux-mm
On 1/12/26 08:45, kernel test robot wrote:
>
>
> Hello,
>
> kernel test robot noticed "BUG_TestSlub_kfree_rcu_wq_destroy" on:
>
> commit: 3c9d05a88372eb667214035d903b5ea09be4459b ("slab: add sheaves to most caches")
> https://git.kernel.org/cgit/linux/kernel/git/vbabka/linux.git b4/sheaves-for-all-rebased
>
> in testcase: kunit
> version:
> with following parameters:
>
> group: group-00
>
>
>
> config: x86_64-rhel-9.4-kunit
> compiler: gcc-14
> test machine: 8 threads 1 sockets Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (Haswell) with 16G memory
>
> (please refer to attached dmesg/kmsg for entire log/backtrace)
>
>
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <oliver.sang@intel.com>
> | Closes: https://lore.kernel.org/oe-lkp/202601121442.c530bed3-lkp@intel.com
>
>
>
> kern :err : [ 137.071325] [ T4498] # test_kfree_rcu: EXPECTATION FAILED at lib/tests/slub_kunit.c:182
> Expected 0 == slab_errors, but
> slab_errors == 2 (0x2)
> kern :info : [ 137.076926] [ T4491] not ok 4 test_kfree_rcu
> kern :err : [ 137.133204] [ T2648] =============================================================================
> kern :err : [ 137.146570] [ T2648] BUG TestSlub_kfree_rcu_wq_destroy (Tainted: G S B N ): Objects remaining on __kmem_cache_shutdown()
> kern :err : [ 137.158349] [ T2648] -----------------------------------------------------------------------------
>
> kern :err : [ 137.169350] [ T2648] Object 0x00000000b072383a @offset=2240
> kern :err : [ 137.174817] [ T2648] Slab 0x000000005fc4154e objects=128 used=1 fp=0x000000000b8c0d81 flags=0x17ffffc0000200(workingset|node=0|zone=2|lastcpupid=0x1fffff)
> kern :warn : [ 137.188509] [ T2648] ------------[ cut here ]------------
> kern :warn : [ 137.193801] [ T2648] WARNING: mm/slub.c:1248 at __slab_err+0x19/0x20, CPU#1: 0/2648
> kern :warn : [ 137.202990] [ T2648] Modules linked in: slub_kunit linear_ranges binfmt_misc snd_hda_codec_intelhdmi snd_hda_codec_hdmi btrfs intel_rapl_msr intel_rapl_common blake2b x86_pkg_temp_thermal xor snd_hda_codec_alc269 raid6_pq intel_powerclamp snd_hda_scodec_component snd_hda_codec_realtek_lib coretemp i915 snd_hda_codec_generic sd_mod snd_hda_intel kvm_intel sg snd_hda_codec intel_gtt platform_profile snd_hda_core ttm drm_client_lib kvm dell_wmi snd_intel_dspcfg drm_buddy snd_intel_sdw_acpi dell_smbios drm_display_helper snd_hwdep dell_wmi_descriptor irqbypass ahci ghash_clmulni_intel sparse_keymap snd_pcm libahci mei_wdt cec rfkill rapl intel_cstate mei_me snd_timer dcdbas libata i2c_i801 snd drm_kms_helper i2c_smbus intel_uncore mei soundcore pcspkr lpc_ich video wmi fuse drm nfnetlink [last unloaded: mptcp_token_test]
> kern :warn : [ 137.275019] [ T2648] CPU: 1 UID: 0 PID: 2648 Comm: kworker/u33:0 Tainted: G S B N 6.19.0-rc1-00005-g3c9d05a88372 #1 PREEMPT(voluntary)
> kern :warn : [ 137.288184] [ T2648] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [N]=TEST
> kern :warn : [ 137.294860] [ T2648] Hardware name: Dell Inc. OptiPlex 9020/0DNKMN, BIOS A05 12/05/2013
> kern :warn : [ 137.302746] [ T2648] Workqueue: test_kfree_rcu_destroy_wq cache_destroy_workfn [slub_kunit]
> kern :warn : [ 137.310986] [ T2648] RIP: 0010:__slab_err (kbuild/src/consumer/mm/slub.c:1249)
> kern :warn : [ 137.316370] [ T2648] Code: 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 e8 16 fd ff ff be 01 00 00 00 bf 05 00 00 00 e8 07 b8 2e 00 <0f> 0b c3 cc cc cc cc 44 89 e2 be 00 10 00 00 48 c7 c7 c0 12 bc 85
Thanks, found the root cause, which is a recent hotfix. Will make this part
of the series, but I don't think we need to send it as a hotfix because the
problem is only exposed when destroying cache with sheaves, and in the
mainline/stable kernels only maple node and vma caches have sheaves and are
never destroyed.
----8<----
From 9f77c1e5dac6ff2ace6513cbbb2a69ba58f3ab44 Mon Sep 17 00:00:00 2001
From: Vlastimil Babka <vbabka@suse.cz>
Date: Mon, 12 Jan 2026 10:58:38 +0100
Subject: [PATCH] mm/slab: add rcu_barrier() to kvfree_rcu_barrier_on_cache()
After we submit the rcu_free sheaves to call_rcu() we need to make sure
the rcu callbacks complete. kvfree_rcu_barrier() does that via
flush_all_rcu_sheaves() but kvfree_rcu_barrier_on_cache() doesn't. Fix
that.
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202601121442.c530bed3-lkp@intel.com
Fixes: 0f35040de593 ("mm/slab: introduce kvfree_rcu_barrier_on_cache() for cache destruction")
Cc: stable@vger.kernel.org
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
---
mm/slab_common.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/mm/slab_common.c b/mm/slab_common.c
index eed7ea556cb1..ee994ec7f251 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -2133,8 +2133,11 @@ EXPORT_SYMBOL_GPL(kvfree_rcu_barrier);
*/
void kvfree_rcu_barrier_on_cache(struct kmem_cache *s)
{
- if (s->cpu_sheaves)
+ if (s->cpu_sheaves) {
flush_rcu_sheaves_on_cache(s);
+ rcu_barrier();
+ }
+
/*
* TODO: Introduce a version of __kvfree_rcu_barrier() that works
* on a specific slab cache.
--
2.52.0
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-01-12 10:07 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-01-12 7:45 [vbabka:b4/sheaves-for-all-rebased] [slab] 3c9d05a883: BUG_TestSlub_kfree_rcu_wq_destroy kernel test robot
2026-01-12 10:07 ` Vlastimil Babka
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox