Greeting, FYI, we noticed the following commit (built with gcc-9): commit: 9ddc8abf031750362cda61a9fb8a28be8871eaae ("[PATCH v4] mm: cma: support sysfs") url: https://github.com/0day-ci/linux/commits/Minchan-Kim/mm-cma-support-sysfs/20210305-002050 base: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git f69d02e37a85645aa90d18cacfff36dba370f797 in testcase: trinity version: trinity-i386-4d2343bd-1_20200320 with following parameters: group: group-01 test-description: Trinity is a linux system call fuzz tester. test-url: http://codemonkey.org.uk/projects/trinity/ on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 8G caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace): +-------------------------------------------------------------------------+------------+------------+ | | f69d02e37a | 9ddc8abf03 | +-------------------------------------------------------------------------+------------+------------+ | BUG:KASAN:null-ptr-deref_in_lockdep_init_map_type | 0 | 12 | | BUG:kernel_NULL_pointer_dereference,address | 0 | 12 | | Oops:#[##] | 0 | 12 | | RIP:lockdep_init_map_type | 0 | 12 | +-------------------------------------------------------------------------+------------+------------+ If you fix the issue, kindly add following tag Reported-by: kernel test robot [ 16.842917] BUG: KASAN: null-ptr-deref in lockdep_init_map_type (kbuild/src/consumer/kernel/locking/lockdep.c:4654) [ 16.844311] Write of size 8 at addr 0000000000000030 by task swapper/0/1 [ 16.844311] [ 16.844311] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1-00023-g9ddc8abf0317 #1 [ 16.844311] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 16.844311] Call Trace: [ 16.844311] dump_stack (kbuild/src/consumer/lib/dump_stack.c:122) [ 16.844311] ? lockdep_init_map_type (kbuild/src/consumer/kernel/locking/lockdep.c:4654) [ 16.844311] kasan_report.cold (kbuild/src/consumer/mm/kasan/report.c:403 kbuild/src/consumer/mm/kasan/report.c:416) [ 16.844311] ? lockdep_init_map_type (kbuild/src/consumer/kernel/locking/lockdep.c:4654) [ 16.844311] lockdep_init_map_type (kbuild/src/consumer/kernel/locking/lockdep.c:4654) [ 16.844311] __raw_spin_lock_init (kbuild/src/consumer/kernel/locking/spinlock_debug.c:26) [ 16.844311] cma_sysfs_init (kbuild/src/consumer/mm/cma_sysfs.c:91) [ 16.844311] ? cma_debugfs_init (kbuild/src/consumer/mm/cma_sysfs.c:74) [ 16.844311] do_one_initcall (kbuild/src/consumer/init/main.c:1226) [ 16.844311] ? perf_trace_initcall_level (kbuild/src/consumer/init/main.c:1217) [ 16.844311] ? rcu_read_lock_sched_held (kbuild/src/consumer/kernel/rcu/update.c:125) [ 16.844311] ? trace_event_raw_event_rcu_torture_read (kbuild/src/consumer/kernel/rcu/update.c:120) [ 16.844311] ? write_comp_data (kbuild/src/consumer/kernel/kcov.c:218) [ 16.844311] ? __sanitizer_cov_trace_pc (kbuild/src/consumer/kernel/kcov.c:197) [ 16.844311] kernel_init_freeable (kbuild/src/consumer/init/main.c:1298 kbuild/src/consumer/init/main.c:1315 kbuild/src/consumer/init/main.c:1335 kbuild/src/consumer/init/main.c:1537) [ 16.844311] ? console_on_rootfs (kbuild/src/consumer/init/main.c:1503) [ 16.844311] ? tracer_hardirqs_on (kbuild/src/consumer/kernel/trace/trace_irqsoff.c:57 kbuild/src/consumer/kernel/trace/trace_irqsoff.c:610) [ 16.844311] ? mark_held_locks (kbuild/src/consumer/kernel/locking/lockdep.c:4067) [ 16.844311] ? rest_init (kbuild/src/consumer/init/main.c:1421) [ 16.844311] kernel_init (kbuild/src/consumer/init/main.c:1426) [ 16.844311] ret_from_fork (kbuild/src/consumer/arch/x86/entry/entry_64.S:300) [ 16.844311] ================================================================== [ 16.844311] Disabling lock debugging due to kernel taint [ 16.844425] BUG: kernel NULL pointer dereference, address: 0000000000000030 [ 16.845925] #PF: supervisor write access in kernel mode [ 16.847149] #PF: error_code(0x0002) - not-present page [ 16.848311] PGD 0 P4D 0 [ 16.848311] Oops: 0002 [#1] SMP KASAN PTI [ 16.848311] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G B 5.12.0-rc1-00023-g9ddc8abf0317 #1 [ 16.848311] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 16.848311] RIP: 0010:lockdep_init_map_type (kbuild/src/consumer/kernel/locking/lockdep.c:4654) [ 16.848311] Code: 89 ce 41 55 41 54 49 89 d4 55 48 89 fd 48 83 c7 08 53 48 89 f3 48 83 ec 08 8b 44 24 40 44 89 04 24 89 44 24 04 e8 0e 2b 4b 00 <48> c7 45 08 00 00 00 00 48 8d 7d 10 e8 fd 2a 4b 00 48 c7 45 10 00 All code ======== 0: 89 ce mov %ecx,%esi 2: 41 55 push %r13 4: 41 54 push %r12 6: 49 89 d4 mov %rdx,%r12 9: 55 push %rbp a: 48 89 fd mov %rdi,%rbp d: 48 83 c7 08 add $0x8,%rdi 11: 53 push %rbx 12: 48 89 f3 mov %rsi,%rbx 15: 48 83 ec 08 sub $0x8,%rsp 19: 8b 44 24 40 mov 0x40(%rsp),%eax 1d: 44 89 04 24 mov %r8d,(%rsp) 21: 89 44 24 04 mov %eax,0x4(%rsp) 25: e8 0e 2b 4b 00 callq 0x4b2b38 2a:* 48 c7 45 08 00 00 00 movq $0x0,0x8(%rbp) <-- trapping instruction 31: 00 32: 48 8d 7d 10 lea 0x10(%rbp),%rdi 36: e8 fd 2a 4b 00 callq 0x4b2b38 3b: 48 rex.W 3c: c7 .byte 0xc7 3d: 45 10 00 adc %r8b,(%r8) Code starting with the faulting instruction =========================================== 0: 48 c7 45 08 00 00 00 movq $0x0,0x8(%rbp) 7: 00 8: 48 8d 7d 10 lea 0x10(%rbp),%rdi c: e8 fd 2a 4b 00 callq 0x4b2b0e 11: 48 rex.W 12: c7 .byte 0xc7 13: 45 10 00 adc %r8b,(%r8) [ 16.848311] RSP: 0000:ffffc9000006fc98 EFLAGS: 00010282 [ 16.848311] RAX: 0000000000000001 RBX: ffffffff9f3a9fc0 RCX: ffffffff9e875dcf [ 16.848311] RDX: dffffc0000000000 RSI: ffff888101489000 RDI: ffffffffa43ce860 [ 16.848311] RBP: 0000000000000028 R08: 0000000000000000 R09: 0000000000000000 [ 16.848311] R10: ffffffffa7c5de03 R11: fffffbfff4f8bbc0 R12: ffffffffafea6da0 [ 16.848311] R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000 [ 16.848311] FS: 0000000000000000(0000) GS:ffff8881c5c00000(0000) knlGS:0000000000000000 [ 16.848311] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 16.848311] CR2: 0000000000000030 CR3: 000000022eeba000 CR4: 00000000000406f0 [ 16.848311] Call Trace: [ 16.848311] __raw_spin_lock_init (kbuild/src/consumer/kernel/locking/spinlock_debug.c:26) [ 16.848311] cma_sysfs_init (kbuild/src/consumer/mm/cma_sysfs.c:91) [ 16.848311] ? cma_debugfs_init (kbuild/src/consumer/mm/cma_sysfs.c:74) [ 16.848311] do_one_initcall (kbuild/src/consumer/init/main.c:1226) [ 16.848311] ? perf_trace_initcall_level (kbuild/src/consumer/init/main.c:1217) [ 16.848311] ? rcu_read_lock_sched_held (kbuild/src/consumer/kernel/rcu/update.c:125) [ 16.848311] ? trace_event_raw_event_rcu_torture_read (kbuild/src/consumer/kernel/rcu/update.c:120) [ 16.848311] ? write_comp_data (kbuild/src/consumer/kernel/kcov.c:218) [ 16.848311] ? __sanitizer_cov_trace_pc (kbuild/src/consumer/kernel/kcov.c:197) [ 16.848311] kernel_init_freeable (kbuild/src/consumer/init/main.c:1298 kbuild/src/consumer/init/main.c:1315 kbuild/src/consumer/init/main.c:1335 kbuild/src/consumer/init/main.c:1537) [ 16.848311] ? console_on_rootfs (kbuild/src/consumer/init/main.c:1503) [ 16.848311] ? tracer_hardirqs_on (kbuild/src/consumer/kernel/trace/trace_irqsoff.c:57 kbuild/src/consumer/kernel/trace/trace_irqsoff.c:610) [ 16.848311] ? mark_held_locks (kbuild/src/consumer/kernel/locking/lockdep.c:4067) [ 16.848311] ? rest_init (kbuild/src/consumer/init/main.c:1421) [ 16.848311] kernel_init (kbuild/src/consumer/init/main.c:1426) [ 16.848311] ret_from_fork (kbuild/src/consumer/arch/x86/entry/entry_64.S:300) [ 16.848311] Modules linked in: [ 16.848311] CR2: 0000000000000030 [ 16.848311] ---[ end trace 29b158f4fb30e312 ]--- [ 16.848311] RIP: 0010:lockdep_init_map_type (kbuild/src/consumer/kernel/locking/lockdep.c:4654) [ 16.848311] Code: 89 ce 41 55 41 54 49 89 d4 55 48 89 fd 48 83 c7 08 53 48 89 f3 48 83 ec 08 8b 44 24 40 44 89 04 24 89 44 24 04 e8 0e 2b 4b 00 <48> c7 45 08 00 00 00 00 48 8d 7d 10 e8 fd 2a 4b 00 48 c7 45 10 00 All code ======== 0: 89 ce mov %ecx,%esi 2: 41 55 push %r13 4: 41 54 push %r12 6: 49 89 d4 mov %rdx,%r12 9: 55 push %rbp a: 48 89 fd mov %rdi,%rbp d: 48 83 c7 08 add $0x8,%rdi 11: 53 push %rbx 12: 48 89 f3 mov %rsi,%rbx 15: 48 83 ec 08 sub $0x8,%rsp 19: 8b 44 24 40 mov 0x40(%rsp),%eax 1d: 44 89 04 24 mov %r8d,(%rsp) 21: 89 44 24 04 mov %eax,0x4(%rsp) 25: e8 0e 2b 4b 00 callq 0x4b2b38 2a:* 48 c7 45 08 00 00 00 movq $0x0,0x8(%rbp) <-- trapping instruction 31: 00 32: 48 8d 7d 10 lea 0x10(%rbp),%rdi 36: e8 fd 2a 4b 00 callq 0x4b2b38 3b: 48 rex.W 3c: c7 .byte 0xc7 3d: 45 10 00 adc %r8b,(%r8) Code starting with the faulting instruction =========================================== 0: 48 c7 45 08 00 00 00 movq $0x0,0x8(%rbp) 7: 00 8: 48 8d 7d 10 lea 0x10(%rbp),%rdi c: e8 fd 2a 4b 00 callq 0x4b2b0e 11: 48 rex.W 12: c7 .byte 0xc7 13: 45 10 00 adc %r8b,(%r8) To reproduce: # build kernel cd linux cp config-5.12.0-rc1-00023-g9ddc8abf0317 .config make HOSTCC=gcc-9 CC=gcc-9 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage git clone https://github.com/intel/lkp-tests.git cd lkp-tests bin/lkp qemu -k job-script # job-script is attached in this email --- 0DAY/LKP+ Test Infrastructure Open Source Technology Center https://lists.01.org/hyperkitty/list/lkp@lists.01.org Intel Corporation Thanks, Oliver Sang