From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83751C4167B for ; Sun, 1 Jan 2023 05:30:28 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 74EE08E0002; Sun, 1 Jan 2023 00:30:27 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 6FCFD8E0001; Sun, 1 Jan 2023 00:30:27 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5C4B68E0002; Sun, 1 Jan 2023 00:30:27 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 498BA8E0001 for ; Sun, 1 Jan 2023 00:30:27 -0500 (EST) Received: from smtpin08.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 15C9A805FA for ; Sun, 1 Jan 2023 05:30:27 +0000 (UTC) X-FDA: 80305104894.08.7449467 Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) by imf03.hostedemail.com (Postfix) with ESMTP id 5B8B320004 for ; Sun, 1 Jan 2023 05:30:25 +0000 (UTC) Authentication-Results: imf03.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=cVwrdyd8; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf03.hostedemail.com: domain of 42.hyeyoo@gmail.com designates 209.85.216.48 as permitted sender) smtp.mailfrom=42.hyeyoo@gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1672551025; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=ftit7eHKmpp9COAivW7YvJwSHzCaElr3mvQr4opldlw=; b=a2pkCKj1jnjctuLb3kjppjLLk5DNWPAVALzpeZfsRTGEZQaCoPjj5gb5i9psBgguqyNips BdkuVT1ZjEhbDck51cujPgWAat/04skjezIOgIssHqqtgTuDSh2g9b13nDgy+Lstd+g41S 47QbEtn7dW81D/M54w7gSp+YQki/t2I= ARC-Authentication-Results: i=1; imf03.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=cVwrdyd8; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf03.hostedemail.com: domain of 42.hyeyoo@gmail.com designates 209.85.216.48 as permitted sender) smtp.mailfrom=42.hyeyoo@gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1672551025; a=rsa-sha256; cv=none; b=OX87o7iTmaUNwacM4aBW39oSGiMEDUqk5DyxERxX3du0+v4rAPzvCV+jGtbvhrzfbVVBvu IZXFGEGJyIDtHUjoBl8cCM1LgHO3JpSOAeehuzf3XZFWTWbBBrfUdpzmxM8k7m+dD4ZWG6 jjbK54JjJ3zfCF+OUlXGo7eukRYtOYk= Received: by mail-pj1-f48.google.com with SMTP id u4-20020a17090a518400b00223f7eba2c4so25407142pjh.5 for ; Sat, 31 Dec 2022 21:30:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=ftit7eHKmpp9COAivW7YvJwSHzCaElr3mvQr4opldlw=; b=cVwrdyd8RVZP3fP9sHIsNnAe1SFQrCN7S+0N3axvFmZVFN555UhEyFFa62C8BTcQJM GKqYnv6i7lw05eiIPqmo6cTEFIb1Raym6Yf6x0JjlVN4xQ6oHrAaoj7eZgF7sKEdIAp7 rpEZg5O6nYv0aUmkjzgDM8I0h/9ql1atkL8e2vwofnVJ7aw0ea9EYuZ9RyvqykIwqQtI tJXJ2ovv5Vd1JGkxEGtaE4DA1PFKpEn8Hy22N9i7Lex+N0a6SWK6efg4BTKMjMFWBK41 LfAQA/VAMAL9B7YGcbfEbJJ2xQp6SXySl6UK9e+moFyQueT21tFfaW7EdZxIFEavI82r Brhw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=ftit7eHKmpp9COAivW7YvJwSHzCaElr3mvQr4opldlw=; b=gKkbxGcIw/rNwpsJzLygtbx+mrxBDkeePN7Pb2ylwLOGMpcXznJ/ACaCtvYtNfJ4fv KLA7cPYV14wLyPXh4QCQHBEaVWGOEa+XAbSQcPEy59fbfBoNV3U3sFitUM2thxYgPULw PZj4DZL4Uk+XB42EZ+zjNPOnit2EhNW+w8QZLCfZIWgCyJ/LqlD3Hv4iB2q/AdIyW2As gyRO/DbZJP1ngWiQ6CVIdRJwtcuYNPo90hVLg1ikKnAJvFng6MEO4NH4+KXvqEOsNHCJ Um1tzPg8WB7J1FSdwfudIDLHx6A445mnxlMVh4UdKLAvio+v+ya/uu0KUbWjs+WEQecJ icKg== X-Gm-Message-State: AFqh2kq+f9A3dpLw12iASTYzKouYK19UBsp9SCEhl90iocTtAQZ7aVkZ //Inqysihbg9D/jTYHgHDWQ= X-Google-Smtp-Source: AMrXdXtLz4TYlQIqEtzT1wpCY378IpDbpN6Rl4VrCanvcUaNyN1alG5ScPFK5bT3lwL2IvCmNChuLg== X-Received: by 2002:a05:6a20:5487:b0:ad:b4a5:8d2f with SMTP id i7-20020a056a20548700b000adb4a58d2fmr58558321pzk.42.1672551024111; Sat, 31 Dec 2022 21:30:24 -0800 (PST) Received: from hyeyoo ([114.29.91.56]) by smtp.gmail.com with ESMTPSA id b23-20020a17090a551700b00218f9bd50c7sm14946883pji.50.2022.12.31.21.30.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 31 Dec 2022 21:30:23 -0800 (PST) Date: Sun, 1 Jan 2023 14:30:17 +0900 From: Hyeonggon Yoo <42.hyeyoo@gmail.com> To: kernel test robot Cc: Vlastimil Babka , oe-lkp@lists.linux.dev, lkp@intel.com, Mike Rapoport , Christoph Lameter , linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: Re: [linus:master] [mm, slub] 0af8489b02: kernel_BUG_at_include/linux/mm.h Message-ID: References: <202212312021.bc1efe86-oliver.sang@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <202212312021.bc1efe86-oliver.sang@intel.com> X-Rspamd-Queue-Id: 5B8B320004 X-Rspamd-Server: rspam09 X-Rspam-User: X-Stat-Signature: afqdrb4takzpnwdgjs1h1gswf3ayifop X-HE-Tag: 1672551025-48485 X-HE-Meta: U2FsdGVkX18ehDGVjPEX/a5XLumif/lPftbsCtIpc2Hz0NuDzimzgUBHgQq+YS3DHvGl6PGgdh3tJ+rIxVYryOYJJnAu0j6Z2JvM8lktlYiqMQ0qeInN0BKbZrGOM7XCbjnEVjQ9YuPpxbQrweh3SZ+mBpzbtpNEDRtMbkJ3Fh2xgSH+6CD6ia/JXooj+pwSvwJQq2KYTchifgroamJPnq9bp4QH3MVZpD0NgGnd6KYUD2/CkXiQNNlTPUV2bBUA6w43WuJzoe42eTsWgPAu64GYyD0yfZEEmO2uU27/CAuZwIhHthUMbEz0+nKYwkMUK8X03DxvhwlJmYLaxyINgPCg52BJqkhp0ont2+AWod6tJgTrzQIlx9B9CHKV5nvTq3C2cK9wxalSFEKgd5JrgQxE+l9pvRipY4T+qGd3R+9yUNbp/Hp/v1q5UwfYLQCMqpM4gyiEzyiwxW0r1Qipm+TMpnjKSeI9qeosjnijkpr3QWYzUxerxeTmKLqEB+5OcugsVtwZuEFu2NTj3Ag/34IyoyPwAVngWLjM3u6CFlHDxV/z4h30MJlp2ffuCQfUgjAjctCAQcZQlv3gWG+zUcmVY6z7aZnzLiwPRS8dcygDu6QFiGla6kqSZ2PynRhMgz2Z7ftF9bf2qOqhZTtis9uO+Rq7BQ8IuSm4a9gmCa5PywgrbGM7CQbwXZur9++n9HZiW1Fqb75/6uXxYdz+Nhvt2OhViJm5BzyGCv8aonLSm/GC0jTZusp3I6j+pN7zn/lcRJ3AZ0e+H31A9rO7VkdOF1cq+Q9cj1CM0xzJgciUcPfpZQ6k2kUJEiCblu3E9BuRM8OPeO+UIJnem3ih/Q5a64y+eVsYHi/Yla8wmGJuCs2001JAYTRV9eiElO2opj+h4kQkLXbQ4DAJBBTiyFEXAW+yaWX2Uet7FdfIPC693YtA22Sz5AdHtpUktoodNMgLkP/ICyccbS60Wld R770mSxe 72pjBpRl87FrFoBMRCa4wfF17VvJaq9W5+HQkZW/U0ePFbv7wYbvgB4TQhnu7A+OUl+K1a0jorRIigHVFMvfzva7/YoR/PTv1GoCkZc9zpKDDNTbe/oQe7HRIp9Xf0/w+UAztGJ5NFhwt+gXx+GaXhq7uR2Zj4XPqR8/N X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sat, Dec 31, 2022 at 11:26:25PM +0800, kernel test robot wrote: > > Greeting, > > FYI, we noticed kernel_BUG_at_include/linux/mm.h due to commit (built with gcc-11): > > commit: 0af8489b0216fa1dd83e264bef8063f2632633d7 ("mm, slub: remove percpu slabs with CONFIG_SLUB_TINY") > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master > > [test failed on linux-next/master c76083fac3bae1a87ae3d005b5cb1cbc761e31d5] > > in testcase: rcutorture > version: > with following parameters: > > runtime: 300s > test: default > torture_type: tasks-tracing > > test-description: rcutorture is rcutorture kernel module load/unload test. > test-url: https://www.kernel.org/doc/Documentation/RCU/torture.txt > > > on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G > > caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace): > > > If you fix the issue, kindly add following tag > | Reported-by: kernel test robot > | Link: https://lore.kernel.org/oe-lkp/202212312021.bc1efe86-oliver.sang@intel.com > > > Failed to start Update UTMP about System Boot/Shutdown. > See 'systemctl status systemd-update-utmp.service' for details. > page:e660911a refcount:0 mapcount:0 mapping:00000000 index:0xedaeef00 pfn:0x2daee > page:0946d53a refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x2daec > flags: 0x0(zone=0) > raw: 00000000 e764d494 e6f205b4 00000000 00000000 00020000 ffffffff 00000000 > raw: 00000000 00000000 > page dumped because: VM_BUG_ON_FOLIO(!folio_test_large(folio)) > page_owner tracks the page as freed the page is freed state. > page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 208, tgid 208 (systemd-udevd), ts 25780391126, free_ts 25780421356 > post_alloc_hook+0x1fa/0x280 > get_page_from_freelist+0x226/0x310 > __alloc_pages+0xdd/0x360 > alloc_slab_page+0x12d/0x200 > allocate_slab+0x6a/0x350 > new_slab+0x48/0xc0 > __slab_alloc_node+0xfb/0x270 > kmem_cache_alloc+0x8f/0x4e0 > getname_flags+0x33/0x2f0 > getname+0x1a/0x30 > do_sys_openat2+0xa5/0x1f0 > do_sys_open+0x8e/0xe0 > __ia32_sys_openat+0x2b/0x40 > __do_fast_syscall_32+0x72/0xd0 > do_fast_syscall_32+0x32/0x70 > do_SYSENTER_32+0x15/0x20 allocated by slab > page last free stack trace: > free_pcp_prepare+0x34f/0x940 > free_unref_page_prepare+0x29/0x210 > free_unref_page+0x3a/0x3b0 > __free_pages+0x187/0x1f0 > __free_slab+0x1fd/0x350 > free_slab+0x22/0x70 > free_to_partial_list+0x125/0x260 > do_slab_free+0x30/0x70 > kmem_cache_free+0x171/0x1e0 > putname+0x9f/0xf0 > do_sys_openat2+0xe2/0x1f0 > do_sys_open+0x8e/0xe0 > __ia32_sys_openat+0x2b/0x40 > __do_fast_syscall_32+0x72/0xd0 > do_fast_syscall_32+0x32/0x70 > do_SYSENTER_32+0x15/0x20 freed by slab > ------------[ cut here ]------------ > kernel BUG at include/linux/mm.h:825! > invalid opcode: 0000 [#1] SMP > CPU: 0 PID: 214 Comm: udevadm Tainted: G S 6.1.0-rc2-00014-g0af8489b0216 #2 1c4d7707ec0ce574ed62a77e82a8580202758048 > EIP: __dump_page.cold+0x282/0x369 > Code: ff ff 83 05 e8 5d bb c5 01 ba 4c c4 2f c4 89 f8 83 15 ec 5d bb c5 00 e8 f2 92 ed fd 83 05 f8 5d bb c5 01 83 15 fc 5d bb c5 00 <0f> 0b 83 05 00 5e bb c5 01 b8 ac 85 a3 c4 83 15 04 5e bb c5 00 e8 > EAX: 00000000 EBX: e764d530 ECX: 00000003 EDX: 4108888f > ESI: e764d4e0 EDI: e764d4e0 EBP: ed89db3c ESP: ed89db00 > DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 EFLAGS: 00210046 > CR0: 80050033 CR2: 00616abc CR3: 2d878000 CR4: 000406d0 > DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 > DR6: fffe0ff0 DR7: 00000400 > Call Trace: > dump_page+0x2a/0xc0 > ? _raw_spin_lock_irqsave+0x16/0x30 > folio_flags+0x23/0x70 > get_partial_node+0x89/0x290 a page freed by slab is in the partial list? Sounds like use-after-free from SLUB_TINY but not sure yet how that could happen :/ > __slab_alloc_node+0xbb/0x270 > kmem_cache_alloc_lru+0x8d/0x4e0 > ? __lock_release+0x3ec/0x410 > ? iget_locked+0x78/0x310 > alloc_inode+0x93/0x150 > iget_locked+0xdd/0x310 > ? lock_is_held_type+0x80/0xf0 > kernfs_get_inode+0x24/0xb0 > kernfs_iop_lookup+0xb5/0x1a0 > __lookup_slow+0xd9/0x2a0 > lookup_slow+0x50/0x90 > walk_component+0x19c/0x2c0 > path_lookupat+0xa3/0x270 > path_openat+0x307/0x3e0 > do_filp_open+0x7c/0x130 > do_sys_openat2+0x113/0x1f0 > do_sys_open+0x8e/0xe0 > __ia32_sys_openat+0x2b/0x40 > __do_fast_syscall_32+0x72/0xd0 > ? trace_hardirqs_on+0xa2/0x110 > ? __fput+0x19f/0x390 > ? lockdep_hardirqs_on_prepare+0x242/0x400 > ? syscall_exit_to_user_mode+0x5f/0x90 > ? __do_fast_syscall_32+0x7c/0xd0 > ? lockdep_hardirqs_on_prepare+0x242/0x400 > ? syscall_exit_to_user_mode+0x5f/0x90 > ? __do_fast_syscall_32+0x7c/0xd0 > ? __do_fast_syscall_32+0x7c/0xd0 > ? syscall_exit_to_user_mode+0x5f/0x90 > ? __do_fast_syscall_32+0x7c/0xd0 > ? __do_fast_syscall_32+0x7c/0xd0 > ? __do_fast_syscall_32+0x7c/0xd0 > ? irqentry_exit_to_user_mode+0x23/0x30 > ? irqentry_exit+0x7f/0xc0 > do_fast_syscall_32+0x32/0x70 > do_SYSENTER_32+0x15/0x20 > entry_SYSENTER_32+0xa2/0xfb > EIP: 0xb7f8c549 > Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d 76 00 58 b8 77 00 00 00 cd 80 90 8d 76 > EAX: ffffffda EBX: 00000006 ECX: 006142a1 EDX: 002a8000 > ESI: 00000000 EDI: 00000001 EBP: 00614024 ESP: bff3c4a0 > DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b EFLAGS: 00200246 > Modules linked in: > ---[ end trace 0000000000000000 ]--- > EIP: __dump_page.cold+0x282/0x369 > Code: ff ff 83 05 e8 5d bb c5 01 ba 4c c4 2f c4 89 f8 83 15 ec 5d bb c5 00 e8 f2 92 ed fd 83 05 f8 5d bb c5 01 83 15 fc 5d bb c5 00 <0f> 0b 83 05 00 5e bb c5 01 b8 ac 85 a3 c4 83 15 04 5e bb c5 00 e8 > EAX: 00000000 EBX: e764d530 ECX: 00000003 EDX: 4108888f > ESI: e764d4e0 EDI: e764d4e0 EBP: ed89db3c ESP: ed89db00 > DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 EFLAGS: 00210046 > CR0: 80050033 CR2: 00616abc CR3: 2d878000 CR4: 000406d0 > DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 > DR6: fffe0ff0 DR7: 00000400 > Kernel panic - not syncing: Fatal exception > Kernel Offset: disabled -- Thanks, Hyeonggon