* [vbabka:b4/sheaves-for-all] [slab] 16e7d1ea82: BUG:kernel_NULL_pointer_dereference,address
@ 2025-10-16 6:02 kernel test robot
2025-10-16 17:06 ` Vlastimil Babka
0 siblings, 1 reply; 2+ messages in thread
From: kernel test robot @ 2025-10-16 6:02 UTC (permalink / raw)
To: Vlastimil Babka; +Cc: oe-lkp, lkp, linux-mm, oliver.sang
Hello,
kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
commit: 16e7d1ea820782b8335c2a52052e4a0d9ca0d4b0 ("slab: add sheaves to most caches")
https://git.kernel.org/cgit/linux/kernel/git/vbabka/linux.git b4/sheaves-for-all
in testcase: boot
config: x86_64-randconfig-004-20251015
compiler: clang-20
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202510161341.61ccb50f-lkp@intel.com
[ 9.175176][ T0] BUG: kernel NULL pointer dereference, address: 0000000000000030
[ 9.175820][ T0] #PF: supervisor read access in kernel mode
[ 9.176255][ T0] #PF: error_code(0x0000) - not-present page
[ 9.176689][ T0] PGD 0 P4D 0
[ 9.176951][ T0] Oops: Oops: 0000 [#1] KASAN
[ 9.177296][ T0] CPU: 0 UID: 0 PID: 0 Comm: swapper Tainted: G T 6.18.0-rc1-00007-g16e7d1ea8207 #1 PREEMPT(undef)
[ 9.178200][ T0] Tainted: [T]=RANDSTRUCT
[ 9.178512][ T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 9.179274][ T0] RIP: 0010:__kmalloc_noprof (mm/slub.c:5635)
[ 9.179696][ T0] Code: 75 0d 8b 55 d0 48 89 df 31 f6 e8 db 01 73 02 45 89 fc 4c 8b 7d c8 4c 89 ef 48 89 de 4c 89 fa 44 89 e1 e8 d3 b4 05 00 48 89 c3 <45> 8b 45 30 0f 1f 44 00 00 e8 42 c1 bd ff 84 c0 75 0d f6 05 ae f9
All code
========
0: 75 0d jne 0xf
2: 8b 55 d0 mov -0x30(%rbp),%edx
5: 48 89 df mov %rbx,%rdi
8: 31 f6 xor %esi,%esi
a: e8 db 01 73 02 call 0x27301ea
f: 45 89 fc mov %r15d,%r12d
12: 4c 8b 7d c8 mov -0x38(%rbp),%r15
16: 4c 89 ef mov %r13,%rdi
19: 48 89 de mov %rbx,%rsi
1c: 4c 89 fa mov %r15,%rdx
1f: 44 89 e1 mov %r12d,%ecx
22: e8 d3 b4 05 00 call 0x5b4fa
27: 48 89 c3 mov %rax,%rbx
2a:* 45 8b 45 30 mov 0x30(%r13),%r8d <-- trapping instruction
2e: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
33: e8 42 c1 bd ff call 0xffffffffffbdc17a
38: 84 c0 test %al,%al
3a: 75 0d jne 0x49
3c: f6 .byte 0xf6
3d: 05 .byte 0x5
3e: ae scas %es:(%rdi),%al
3f: f9 stc
Code starting with the faulting instruction
===========================================
0: 45 8b 45 30 mov 0x30(%r13),%r8d
4: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
9: e8 42 c1 bd ff call 0xffffffffffbdc150
e: 84 c0 test %al,%al
10: 75 0d jne 0x1f
12: f6 .byte 0xf6
13: 05 .byte 0x5
14: ae scas %es:(%rdi),%al
15: f9 stc
[ 9.181316][ T0] RSP: 0000:ffffffff84e07dd0 EFLAGS: 00010046
[ 9.181986][ T0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 9.182866][ T0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 9.183766][ T0] RBP: ffffffff84e07e10 R08: 0000000000000000 R09: 0000000000000000
[ 9.184642][ T0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000dc0
[ 9.185509][ T0] R13: 0000000000000000 R14: 000000000000000c R15: 00000000000003e0
[ 9.186381][ T0] FS: 0000000000000000(0000) GS:0000000000000000(0000) knlGS:0000000000000000
[ 9.187359][ T0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 9.188105][ T0] CR2: 0000000000000030 CR3: 0000000004ed7000 CR4: 00000000000000b0
[ 9.188989][ T0] Call Trace:
[ 9.189338][ T0] <TASK>
[ 9.189655][ T0] ? do_kmem_cache_create (mm/slub.c:2602 mm/slub.c:7637 mm/slub.c:8609)
[ 9.190269][ T0] do_kmem_cache_create (mm/slub.c:2602 mm/slub.c:7637 mm/slub.c:8609)
[ 9.190856][ T0] create_boot_cache (mm/slab_common.c:679)
[ 9.191415][ T0] kmem_cache_init (mm/slub.c:?)
[ 9.191935][ T0] mm_core_init (mm/mm_init.c:2716)
[ 9.192406][ T0] start_kernel (init/main.c:972)
[ 9.192926][ T0] x86_64_start_reservations (??:?)
[ 9.193487][ T0] x86_64_start_kernel (arch/x86/kernel/head64.c:234 (discriminator 2))
[ 9.194033][ T0] common_startup_64 (arch/x86/kernel/head_64.S:419)
[ 9.194613][ T0] </TASK>
[ 9.194924][ T0] Modules linked in:
[ 9.195327][ T0] CR2: 0000000000000030
[ 9.195775][ T0] ---[ end trace 0000000000000000 ]---
[ 9.196363][ T0] RIP: 0010:__kmalloc_noprof (mm/slub.c:5635)
[ 9.197005][ T0] Code: 75 0d 8b 55 d0 48 89 df 31 f6 e8 db 01 73 02 45 89 fc 4c 8b 7d c8 4c 89 ef 48 89 de 4c 89 fa 44 89 e1 e8 d3 b4 05 00 48 89 c3 <45> 8b 45 30 0f 1f 44 00 00 e8 42 c1 bd ff 84 c0 75 0d f6 05 ae f9
All code
========
0: 75 0d jne 0xf
2: 8b 55 d0 mov -0x30(%rbp),%edx
5: 48 89 df mov %rbx,%rdi
8: 31 f6 xor %esi,%esi
a: e8 db 01 73 02 call 0x27301ea
f: 45 89 fc mov %r15d,%r12d
12: 4c 8b 7d c8 mov -0x38(%rbp),%r15
16: 4c 89 ef mov %r13,%rdi
19: 48 89 de mov %rbx,%rsi
1c: 4c 89 fa mov %r15,%rdx
1f: 44 89 e1 mov %r12d,%ecx
22: e8 d3 b4 05 00 call 0x5b4fa
27: 48 89 c3 mov %rax,%rbx
2a:* 45 8b 45 30 mov 0x30(%r13),%r8d <-- trapping instruction
2e: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
33: e8 42 c1 bd ff call 0xffffffffffbdc17a
38: 84 c0 test %al,%al
3a: 75 0d jne 0x49
3c: f6 .byte 0xf6
3d: 05 .byte 0x5
3e: ae scas %es:(%rdi),%al
3f: f9 stc
Code starting with the faulting instruction
===========================================
0: 45 8b 45 30 mov 0x30(%r13),%r8d
4: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
9: e8 42 c1 bd ff call 0xffffffffffbdc150
e: 84 c0 test %al,%al
10: 75 0d jne 0x1f
12: f6 .byte 0xf6
13: 05 .byte 0x5
14: ae scas %es:(%rdi),%al
15: f9 stc
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20251016/202510161341.61ccb50f-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [vbabka:b4/sheaves-for-all] [slab] 16e7d1ea82: BUG:kernel_NULL_pointer_dereference,address
2025-10-16 6:02 [vbabka:b4/sheaves-for-all] [slab] 16e7d1ea82: BUG:kernel_NULL_pointer_dereference,address kernel test robot
@ 2025-10-16 17:06 ` Vlastimil Babka
0 siblings, 0 replies; 2+ messages in thread
From: Vlastimil Babka @ 2025-10-16 17:06 UTC (permalink / raw)
To: kernel test robot; +Cc: oe-lkp, lkp, linux-mm
On 10/16/25 08:02, kernel test robot wrote:
>
>
> Hello,
>
> kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
>
> commit: 16e7d1ea820782b8335c2a52052e4a0d9ca0d4b0 ("slab: add sheaves to most caches")
> https://git.kernel.org/cgit/linux/kernel/git/vbabka/linux.git b4/sheaves-for-all
>
> in testcase: boot
>
> config: x86_64-randconfig-004-20251015
> compiler: clang-20
> test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
>
> (please refer to attached dmesg/kmsg for entire log/backtrace)
>
>
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <oliver.sang@intel.com>
> | Closes: https://lore.kernel.org/oe-lkp/202510161341.61ccb50f-lkp@intel.com
>
Thanks, most likely this, will update the branch.
----8<----
diff --git a/include/linux/slab.h b/include/linux/slab.h
index cf443f064a66..e42aa6a3d202 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -57,9 +57,7 @@ enum _slab_flag_bits {
#endif
_SLAB_OBJECT_POISON,
_SLAB_CMPXCHG_DOUBLE,
-#ifdef CONFIG_SLAB_OBJ_EXT
_SLAB_NO_OBJ_EXT,
-#endif
_SLAB_FLAGS_LAST_BIT
};
@@ -238,11 +236,7 @@ enum _slab_flag_bits {
#define SLAB_TEMPORARY SLAB_RECLAIM_ACCOUNT /* Objects are short-lived */
/* Slab created using create_boot_cache */
-#ifdef CONFIG_SLAB_OBJ_EXT
#define SLAB_NO_OBJ_EXT __SLAB_FLAG_BIT(_SLAB_NO_OBJ_EXT)
-#else
-#define SLAB_NO_OBJ_EXT __SLAB_FLAG_UNUSED
-#endif
/*
* ZERO_SIZE_PTR will be returned for zero sized kmalloc requests.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-10-16 17:06 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-10-16 6:02 [vbabka:b4/sheaves-for-all] [slab] 16e7d1ea82: BUG:kernel_NULL_pointer_dereference,address kernel test robot
2025-10-16 17:06 ` Vlastimil Babka
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox