* next-20230321: arm64: Unable to handle kernel paging request at virtual address @ 2023-03-21 6:12 Naresh Kamboju 2023-03-21 9:27 ` Petr Mladek 0 siblings, 1 reply; 5+ messages in thread From: Naresh Kamboju @ 2023-03-21 6:12 UTC (permalink / raw) To: open list, Linux-Next Mailing List, lkft-triage, linux-mm Cc: Andrew Morton, Arnd Bergmann, Anders Roxell, Stephen Rothwell, Petr Mladek, Steven Rostedt, Naoya Horiguchi The following kernel crash was noticed on arm64 Juno-r2 and Raspberry Pi 4 Model B on Linux next-20230321. Reported-by: Linux Kernel Functional Testing <lkft@linaro.org> log: ---- [ 3.071500] Unable to handle kernel paging request at virtual address 0000000000001000 [ 3.079432] Mem abort info: [ 3.082225] ESR = 0x0000000096000004 [ 3.085977] EC = 0x25: DABT (current EL), IL = 32 bits [ 3.091295] SET = 0, FnV = 0 [ 3.094350] EA = 0, S1PTW = 0 [ 3.097491] FSC = 0x04: level 0 translation fault [ 3.102373] Data abort info: [ 3.105252] ISV = 0, ISS = 0x00000004 [ 3.109089] CM = 0, WnR = 0 [ 3.112055] [0000000000001000] user address but active_mm is swapper [ 3.114230] usb 1-1: new high-speed USB device number 2 using ehci-platform [ 3.118418] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 3.118426] Modules linked in: [ 3.134717] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.3.0-rc3-next-20230321 #1 [ 3.142126] Hardware name: ARM Juno development board (r2) (DT) [ 3.148052] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 3.155027] pc : string (lib/vsprintf.c:644 lib/vsprintf.c:726) [ 3.158443] lr : vsnprintf (lib/vsprintf.c:2817) [ 3.162196] sp : ffff80000b34b8f0 [ 3.165511] x29: ffff80000b34b8f0 x28: ffff800009d7b1ca x27: ffff80000b34bab0 [ 3.172666] x26: ffff800009d7b1ca x25: 0000000000000020 x24: 0000000000000008 [ 3.179820] x23: 00000000ffffffd8 x22: ffff8000099858a0 x21: ffff80000b34bc30 [ 3.186973] x20: ffff80000b34ba90 x19: ffff80000b34ba98 x18: 000000003c98bfdd [ 3.194127] x17: 000000000000001c x16: 00000000eec48da2 x15: 00000000a9dbdd17 [ 3.201280] x14: ffff80000b0242e8 x13: 0000000057a049ef x12: 00000000cfa47237 [ 3.208433] x11: 0000000000000001 x10: 00000000bd5b8780 x9 : ffff80000812cbec [ 3.215586] x8 : 00000000ffffffff x7 : 0000000000000002 x6 : ffff80000b34ba98 [ 3.222739] x5 : ffffffffffffffff x4 : 0000000000000000 x3 : ffff0a00ffffff04 [ 3.229891] x2 : 0000000000001000 x1 : 0000000000000000 x0 : ffff80000b34bab0 [ 3.237044] Call trace: [ 3.239489] string (lib/vsprintf.c:644 lib/vsprintf.c:726) [ 3.242551] vsnprintf (lib/vsprintf.c:2817) [ 3.245954] vprintk_store (kernel/printk/printk.c:2200) [ 3.249712] vprintk_emit (kernel/printk/printk.c:2297) [ 3.253381] vprintk_default (kernel/printk/printk.c:2328) [ 3.257137] vprintk (kernel/printk/printk_safe.c:50) [ 3.260198] _printk (kernel/printk/printk.c:2341) [ 3.263257] sysctl_err (fs/proc/proc_sysctl.c:1109) [ 3.266577] __register_sysctl_table (fs/proc/proc_sysctl.c:1140 fs/proc/proc_sysctl.c:1383) [ 3.271202] __register_sysctl_init (fs/proc/proc_sysctl.c:1462) [ 3.275569] memory_failure_sysctl_init (mm/memory-failure.c:152) [ 3.280281] do_one_initcall (init/main.c:1306) [ 3.280453] hub 1-1:1.0: USB hub found [ 3.284123] kernel_init_freeable (init/main.c:1378 init/main.c:1395 init/main.c:1414 init/main.c:1634) [ 3.284133] kernel_init (init/main.c:1526) [ 3.288246] hub 1-1:1.0: 4 ports detected [ 3.292239] ret_from_fork (arch/arm64/kernel/entry.S:871) [ 3.292250] Code: 91000400 110004e1 eb08009f 540000c0 (38646845) All code ======== 0:* 00 04 00 add %al,(%rax,%rax,1) <-- trapping instruction 3: 91 xchg %eax,%ecx 4: e1 04 loope 0xa 6: 00 11 add %dl,(%rcx) 8: 9f lahf 9: 00 08 add %cl,(%rax) b: eb c0 jmp 0xffffffffffffffcd d: 00 00 add %al,(%rax) f: 54 push %rsp 10: 45 rex.RB 11: 68 .byte 0x68 12: 64 fs 13: 38 .byte 0x38 Code starting with the faulting instruction =========================================== 0: 45 rex.RB 1: 68 .byte 0x68 2: 64 fs 3: 38 .byte 0x38 [ 3.309416] ---[ end trace 0000000000000000 ]--- [ 3.314037] note: swapper/0[1] exited with irqs disabled [ 3.319392] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b [ 3.327060] SMP: stopping secondary CPUs [ 3.331189] Kernel Offset: disabled [ 3.334678] CPU features: 0x400002,0c3c0400,0000421b [ 3.339649] Memory Limit: none [ 3.342708] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]--- links: ---- - https://qa-reports.linaro.org/lkft/linux-next-master-sanity/build/next-20230321/testrun/15765295/suite/log-parser-test/tests/ - https://qa-reports.linaro.org/lkft/linux-next-master-sanity/build/next-20230321/testrun/15765168/suite/log-parser-test/tests/ - https://qa-reports.linaro.org/lkft/linux-next-master-sanity/build/next-20230321/testrun/15765168/suite/log-parser-test/test/check-kernel-panic/details/ metadata: git_ref: master git_repo: https://gitlab.com/Linaro/lkft/mirrors/next/linux-next git_sha: f3594f0204b756638267242e26d9de611435c3ba git_describe: next-20230321 kernel_version: 6.3.0-rc3 kernel-config: https://storage.tuxsuite.com/public/linaro/lkft/builds/2NJ83YzjXEfP00u1LgnjMjjZfxo/config build-url: https://gitlab.com/Linaro/lkft/mirrors/next/linux-next/-/pipelines/812627412/ artifact-location: https://storage.tuxsuite.com/public/linaro/lkft/builds/2NJ83YzjXEfP00u1LgnjMjjZfxo toolchain: gcc-11 -- Linaro LKFT https://lkft.linaro.org ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: next-20230321: arm64: Unable to handle kernel paging request at virtual address 2023-03-21 6:12 next-20230321: arm64: Unable to handle kernel paging request at virtual address Naresh Kamboju @ 2023-03-21 9:27 ` Petr Mladek 2023-03-21 15:56 ` Nathan Chancellor 0 siblings, 1 reply; 5+ messages in thread From: Petr Mladek @ 2023-03-21 9:27 UTC (permalink / raw) To: Luis Chamberlain Cc: Naresh Kamboju, open list, Linux-Next Mailing List, lkft-triage, linux-mm, Andrew Morton, Arnd Bergmann, Anders Roxell, Stephen Rothwell, Steven Rostedt, Naoya Horiguchi Hi, I add Luis into Cc. On Tue 2023-03-21 11:42:56, Naresh Kamboju wrote: > The following kernel crash was noticed on arm64 Juno-r2 and Raspberry Pi 4 > Model B on Linux next-20230321. > > Reported-by: Linux Kernel Functional Testing <lkft@linaro.org> > > log: > ---- > [ 3.071500] Unable to handle kernel paging request at virtual > address 0000000000001000 I guess that this is exactly PAGE_SIZE (4k). > [ 3.079432] Mem abort info: > [ 3.082225] ESR = 0x0000000096000004 > [ 3.085977] EC = 0x25: DABT (current EL), IL = 32 bits > [ 3.091295] SET = 0, FnV = 0 > [ 3.094350] EA = 0, S1PTW = 0 > [ 3.097491] FSC = 0x04: level 0 translation fault > [ 3.102373] Data abort info: > [ 3.105252] ISV = 0, ISS = 0x00000004 > [ 3.109089] CM = 0, WnR = 0 > [ 3.112055] [0000000000001000] user address but active_mm is swapper > [ 3.114230] usb 1-1: new high-speed USB device number 2 using ehci-platform > [ 3.118418] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP > [ 3.118426] Modules linked in: > [ 3.134717] CPU: 1 PID: 1 Comm: swapper/0 Not tainted > 6.3.0-rc3-next-20230321 #1 > [ 3.142126] Hardware name: ARM Juno development board (r2) (DT) > [ 3.148052] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) > [ 3.155027] pc : string (lib/vsprintf.c:644 lib/vsprintf.c:726) > [ 3.158443] lr : vsnprintf (lib/vsprintf.c:2817) > [ 3.162196] sp : ffff80000b34b8f0 > [ 3.165511] x29: ffff80000b34b8f0 x28: ffff800009d7b1ca x27: ffff80000b34bab0 > [ 3.172666] x26: ffff800009d7b1ca x25: 0000000000000020 x24: 0000000000000008 > [ 3.179820] x23: 00000000ffffffd8 x22: ffff8000099858a0 x21: ffff80000b34bc30 > [ 3.186973] x20: ffff80000b34ba90 x19: ffff80000b34ba98 x18: 000000003c98bfdd > [ 3.194127] x17: 000000000000001c x16: 00000000eec48da2 x15: 00000000a9dbdd17 > [ 3.201280] x14: ffff80000b0242e8 x13: 0000000057a049ef x12: 00000000cfa47237 > [ 3.208433] x11: 0000000000000001 x10: 00000000bd5b8780 x9 : ffff80000812cbec > [ 3.215586] x8 : 00000000ffffffff x7 : 0000000000000002 x6 : ffff80000b34ba98 > [ 3.222739] x5 : ffffffffffffffff x4 : 0000000000000000 x3 : ffff0a00ffffff04 > [ 3.229891] x2 : 0000000000001000 x1 : 0000000000000000 x0 : ffff80000b34bab0 > [ 3.237044] Call trace: > [ 3.239489] string (lib/vsprintf.c:644 lib/vsprintf.c:726) This is the line where vsprintf() reads a string to be printed: static char *string_nocheck(char *buf, char *end, const char *s, struct printf_spec spec) { int len = 0; int lim = spec.precision; while (lim--) { ----> char c = *s++; > [ 3.242551] vsnprintf (lib/vsprintf.c:2817) > [ 3.245954] vprintk_store (kernel/printk/printk.c:2200) > [ 3.249712] vprintk_emit (kernel/printk/printk.c:2297) > [ 3.253381] vprintk_default (kernel/printk/printk.c:2328) > [ 3.257137] vprintk (kernel/printk/printk_safe.c:50) > [ 3.260198] _printk (kernel/printk/printk.c:2341) > [ 3.263257] sysctl_err (fs/proc/proc_sysctl.c:1109) > [ 3.266577] __register_sysctl_table (fs/proc/proc_sysctl.c:1140 > fs/proc/proc_sysctl.c:1383) > [ 3.271202] __register_sysctl_init (fs/proc/proc_sysctl.c:1462) The has been done some reractoring/modification of this code by the patchset ("[PATCH 00/11] sysctl: deprecate register_sysctl_paths()"), see https://lore.kernel.org/lkml/20230302202826.776286-1-mcgrof@kernel.org/ Luis, does it trigger any bell, please? Do you have an idea where this code could pass a pointer PAGE_SIZE as string to printk("%s")? Best Regards, Petr > [ 3.275569] memory_failure_sysctl_init (mm/memory-failure.c:152) > [ 3.280281] do_one_initcall (init/main.c:1306) > [ 3.280453] hub 1-1:1.0: USB hub found > [ 3.284123] kernel_init_freeable (init/main.c:1378 init/main.c:1395 > init/main.c:1414 init/main.c:1634) > [ 3.284133] kernel_init (init/main.c:1526) > [ 3.288246] hub 1-1:1.0: 4 ports detected > [ 3.292239] ret_from_fork (arch/arm64/kernel/entry.S:871) > [ 3.292250] Code: 91000400 110004e1 eb08009f 540000c0 (38646845) > All code > ======== > 0:* 00 04 00 add %al,(%rax,%rax,1) <-- trapping instruction > 3: 91 xchg %eax,%ecx > 4: e1 04 loope 0xa > 6: 00 11 add %dl,(%rcx) > 8: 9f lahf > 9: 00 08 add %cl,(%rax) > b: eb c0 jmp 0xffffffffffffffcd > d: 00 00 add %al,(%rax) > f: 54 push %rsp > 10: 45 rex.RB > 11: 68 .byte 0x68 > 12: 64 fs > 13: 38 .byte 0x38 > > Code starting with the faulting instruction > =========================================== > 0: 45 rex.RB > 1: 68 .byte 0x68 > 2: 64 fs > 3: 38 .byte 0x38 > [ 3.309416] ---[ end trace 0000000000000000 ]--- > [ 3.314037] note: swapper/0[1] exited with irqs disabled > [ 3.319392] Kernel panic - not syncing: Attempted to kill init! > exitcode=0x0000000b > [ 3.327060] SMP: stopping secondary CPUs > [ 3.331189] Kernel Offset: disabled > [ 3.334678] CPU features: 0x400002,0c3c0400,0000421b > [ 3.339649] Memory Limit: none > [ 3.342708] ---[ end Kernel panic - not syncing: Attempted to kill > init! exitcode=0x0000000b ]--- > > links: > ---- > - https://qa-reports.linaro.org/lkft/linux-next-master-sanity/build/next-20230321/testrun/15765295/suite/log-parser-test/tests/ > - https://qa-reports.linaro.org/lkft/linux-next-master-sanity/build/next-20230321/testrun/15765168/suite/log-parser-test/tests/ > - https://qa-reports.linaro.org/lkft/linux-next-master-sanity/build/next-20230321/testrun/15765168/suite/log-parser-test/test/check-kernel-panic/details/ > > metadata: > git_ref: master > git_repo: https://gitlab.com/Linaro/lkft/mirrors/next/linux-next > git_sha: f3594f0204b756638267242e26d9de611435c3ba > git_describe: next-20230321 > kernel_version: 6.3.0-rc3 > kernel-config: > https://storage.tuxsuite.com/public/linaro/lkft/builds/2NJ83YzjXEfP00u1LgnjMjjZfxo/config > build-url: https://gitlab.com/Linaro/lkft/mirrors/next/linux-next/-/pipelines/812627412/ > artifact-location: > https://storage.tuxsuite.com/public/linaro/lkft/builds/2NJ83YzjXEfP00u1LgnjMjjZfxo > toolchain: gcc-11 > > > -- > Linaro LKFT > https://lkft.linaro.org ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: next-20230321: arm64: Unable to handle kernel paging request at virtual address 2023-03-21 9:27 ` Petr Mladek @ 2023-03-21 15:56 ` Nathan Chancellor 2023-03-21 16:59 ` Luis Chamberlain 0 siblings, 1 reply; 5+ messages in thread From: Nathan Chancellor @ 2023-03-21 15:56 UTC (permalink / raw) To: Petr Mladek Cc: Luis Chamberlain, Naresh Kamboju, open list, Linux-Next Mailing List, lkft-triage, linux-mm, Andrew Morton, Arnd Bergmann, Anders Roxell, Stephen Rothwell, Steven Rostedt, Naoya Horiguchi, Kefeng Wang On Tue, Mar 21, 2023 at 10:27:02AM +0100, Petr Mladek wrote: > Hi, > > I add Luis into Cc. > > On Tue 2023-03-21 11:42:56, Naresh Kamboju wrote: > > The following kernel crash was noticed on arm64 Juno-r2 and Raspberry Pi 4 > > Model B on Linux next-20230321. > > > > Reported-by: Linux Kernel Functional Testing <lkft@linaro.org> > > > > log: > > ---- > > [ 3.071500] Unable to handle kernel paging request at virtual > > address 0000000000001000 > > I guess that this is exactly PAGE_SIZE (4k). > > > [ 3.079432] Mem abort info: > > [ 3.082225] ESR = 0x0000000096000004 > > [ 3.085977] EC = 0x25: DABT (current EL), IL = 32 bits > > [ 3.091295] SET = 0, FnV = 0 > > [ 3.094350] EA = 0, S1PTW = 0 > > [ 3.097491] FSC = 0x04: level 0 translation fault > > [ 3.102373] Data abort info: > > [ 3.105252] ISV = 0, ISS = 0x00000004 > > [ 3.109089] CM = 0, WnR = 0 > > [ 3.112055] [0000000000001000] user address but active_mm is swapper > > [ 3.114230] usb 1-1: new high-speed USB device number 2 using ehci-platform > > [ 3.118418] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP > > [ 3.118426] Modules linked in: > > [ 3.134717] CPU: 1 PID: 1 Comm: swapper/0 Not tainted > > 6.3.0-rc3-next-20230321 #1 > > [ 3.142126] Hardware name: ARM Juno development board (r2) (DT) > > [ 3.148052] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) > > [ 3.155027] pc : string (lib/vsprintf.c:644 lib/vsprintf.c:726) > > [ 3.158443] lr : vsnprintf (lib/vsprintf.c:2817) > > [ 3.162196] sp : ffff80000b34b8f0 > > [ 3.165511] x29: ffff80000b34b8f0 x28: ffff800009d7b1ca x27: ffff80000b34bab0 > > [ 3.172666] x26: ffff800009d7b1ca x25: 0000000000000020 x24: 0000000000000008 > > [ 3.179820] x23: 00000000ffffffd8 x22: ffff8000099858a0 x21: ffff80000b34bc30 > > [ 3.186973] x20: ffff80000b34ba90 x19: ffff80000b34ba98 x18: 000000003c98bfdd > > [ 3.194127] x17: 000000000000001c x16: 00000000eec48da2 x15: 00000000a9dbdd17 > > [ 3.201280] x14: ffff80000b0242e8 x13: 0000000057a049ef x12: 00000000cfa47237 > > [ 3.208433] x11: 0000000000000001 x10: 00000000bd5b8780 x9 : ffff80000812cbec > > [ 3.215586] x8 : 00000000ffffffff x7 : 0000000000000002 x6 : ffff80000b34ba98 > > [ 3.222739] x5 : ffffffffffffffff x4 : 0000000000000000 x3 : ffff0a00ffffff04 > > [ 3.229891] x2 : 0000000000001000 x1 : 0000000000000000 x0 : ffff80000b34bab0 > > [ 3.237044] Call trace: > > [ 3.239489] string (lib/vsprintf.c:644 lib/vsprintf.c:726) > > This is the line where vsprintf() reads a string to be printed: > > static char *string_nocheck(char *buf, char *end, const char *s, > struct printf_spec spec) > { > int len = 0; > int lim = spec.precision; > > while (lim--) { > ----> char c = *s++; > > > > [ 3.242551] vsnprintf (lib/vsprintf.c:2817) > > [ 3.245954] vprintk_store (kernel/printk/printk.c:2200) > > [ 3.249712] vprintk_emit (kernel/printk/printk.c:2297) > > [ 3.253381] vprintk_default (kernel/printk/printk.c:2328) > > [ 3.257137] vprintk (kernel/printk/printk_safe.c:50) > > [ 3.260198] _printk (kernel/printk/printk.c:2341) > > [ 3.263257] sysctl_err (fs/proc/proc_sysctl.c:1109) > > [ 3.266577] __register_sysctl_table (fs/proc/proc_sysctl.c:1140 > > fs/proc/proc_sysctl.c:1383) > > [ 3.271202] __register_sysctl_init (fs/proc/proc_sysctl.c:1462) > > The has been done some reractoring/modification of this code > by the patchset ("[PATCH 00/11] sysctl: deprecate > register_sysctl_paths()"), see > https://lore.kernel.org/lkml/20230302202826.776286-1-mcgrof@kernel.org/ > > Luis, does it trigger any bell, please? > Do you have an idea where this code could pass a pointer PAGE_SIZE > as string to printk("%s")? My bisect actually landed on commit cfe7e6ea5ee2 ("mm: memory-failure: Move memory failure sysctls to its own file"). The new sysctl table is missing a sentinel. The following diff resolves it for me. diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 6367714af61d..b2377f12f062 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -143,6 +143,7 @@ static struct ctl_table memory_failure_table[] = { .extra1 = SYSCTL_ZERO, .extra2 = SYSCTL_ONE, }, + { } }; static int __init memory_failure_sysctl_init(void) Cheers, Nathan # bad: [f3594f0204b756638267242e26d9de611435c3ba] Add linux-next specific files for 20230321 # good: [7d31677bb7b1944ac89e9155110dc1b9acbb3895] gpu: host1x: fix uninitialized variable use git bisect start 'f3594f0204b756638267242e26d9de611435c3ba' '7d31677bb7b1944ac89e9155110dc1b9acbb3895' # good: [454faa8515d7c7b90b3e291bc7cc1a84697a23d9] Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git git bisect good 454faa8515d7c7b90b3e291bc7cc1a84697a23d9 # good: [9bfa51aa7b4f87fe6215a200cca280ebd1c111b4] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git git bisect good 9bfa51aa7b4f87fe6215a200cca280ebd1c111b4 # good: [c637c9b5d4540e07ed95698a67770c5fd2241d7e] Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy.git git bisect good c637c9b5d4540e07ed95698a67770c5fd2241d7e # good: [f1fb10a55d81bc43b7c16e96122c8611e0131ca2] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel.git git bisect good f1fb10a55d81bc43b7c16e96122c8611e0131ca2 # good: [d3294413e4518ef8b31ee46535c873ef0b8a1d1a] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching git bisect good d3294413e4518ef8b31ee46535c873ef0b8a1d1a # good: [009e0171be8db0a77624899623fadcb59fc40a12] Merge branch 'main' of git://git.infradead.org/users/willy/xarray.git git bisect good 009e0171be8db0a77624899623fadcb59fc40a12 # bad: [cfe7e6ea5ee2149cf2dfc69d3f8a220ab00cb65d] mm: memory-failure: Move memory failure sysctls to its own file git bisect bad cfe7e6ea5ee2149cf2dfc69d3f8a220ab00cb65d # good: [2e88a8303d02ff107fd6aa5041f9def177483956] proc_sysctl: enhance documentation git bisect good 2e88a8303d02ff107fd6aa5041f9def177483956 # good: [8869a82dcbbf6fbe584ffff16b620b68281b3180] ntfs: simplfy one-level sysctl registration for ntfs_sysctls git bisect good 8869a82dcbbf6fbe584ffff16b620b68281b3180 # good: [7385b7cb60e030f0041c8c83d17d3c63e598c77d] ppc: simplify one-level sysctl registration for nmi_wd_lpm_factor_ctl_table git bisect good 7385b7cb60e030f0041c8c83d17d3c63e598c77d # good: [36657db1c77c1539812cc1303119cf4ad2e8f34a] x86: simplify one-level sysctl registration for itmt_kern_table git bisect good 36657db1c77c1539812cc1303119cf4ad2e8f34a # good: [0234a6faf178985c74806e33bde8a9e3052d3555] arm: simplify two-level sysctl registration for ctl_isa_vars git bisect good 0234a6faf178985c74806e33bde8a9e3052d3555 # first bad commit: [cfe7e6ea5ee2149cf2dfc69d3f8a220ab00cb65d] mm: memory-failure: Move memory failure sysctls to its own file ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: next-20230321: arm64: Unable to handle kernel paging request at virtual address 2023-03-21 15:56 ` Nathan Chancellor @ 2023-03-21 16:59 ` Luis Chamberlain 2023-03-22 1:05 ` Kefeng Wang 0 siblings, 1 reply; 5+ messages in thread From: Luis Chamberlain @ 2023-03-21 16:59 UTC (permalink / raw) To: Nathan Chancellor Cc: Petr Mladek, Naresh Kamboju, open list, Linux-Next Mailing List, lkft-triage, linux-mm, Andrew Morton, Arnd Bergmann, Anders Roxell, Stephen Rothwell, Steven Rostedt, Naoya Horiguchi, Kefeng Wang On Tue, Mar 21, 2023 at 08:56:26AM -0700, Nathan Chancellor wrote: > On Tue, Mar 21, 2023 at 10:27:02AM +0100, Petr Mladek wrote: > > Hi, > > > > I add Luis into Cc. > > > > On Tue 2023-03-21 11:42:56, Naresh Kamboju wrote: > > > The following kernel crash was noticed on arm64 Juno-r2 and Raspberry Pi 4 > > > Model B on Linux next-20230321. > > > > > > Reported-by: Linux Kernel Functional Testing <lkft@linaro.org> > > > > > > log: > > > ---- > > > [ 3.071500] Unable to handle kernel paging request at virtual > > > address 0000000000001000 > > > > I guess that this is exactly PAGE_SIZE (4k). > > > > > [ 3.079432] Mem abort info: > > > [ 3.082225] ESR = 0x0000000096000004 > > > [ 3.085977] EC = 0x25: DABT (current EL), IL = 32 bits > > > [ 3.091295] SET = 0, FnV = 0 > > > [ 3.094350] EA = 0, S1PTW = 0 > > > [ 3.097491] FSC = 0x04: level 0 translation fault > > > [ 3.102373] Data abort info: > > > [ 3.105252] ISV = 0, ISS = 0x00000004 > > > [ 3.109089] CM = 0, WnR = 0 > > > [ 3.112055] [0000000000001000] user address but active_mm is swapper > > > [ 3.114230] usb 1-1: new high-speed USB device number 2 using ehci-platform > > > [ 3.118418] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP > > > [ 3.118426] Modules linked in: > > > [ 3.134717] CPU: 1 PID: 1 Comm: swapper/0 Not tainted > > > 6.3.0-rc3-next-20230321 #1 > > > [ 3.142126] Hardware name: ARM Juno development board (r2) (DT) > > > [ 3.148052] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) > > > [ 3.155027] pc : string (lib/vsprintf.c:644 lib/vsprintf.c:726) > > > [ 3.158443] lr : vsnprintf (lib/vsprintf.c:2817) > > > [ 3.162196] sp : ffff80000b34b8f0 > > > [ 3.165511] x29: ffff80000b34b8f0 x28: ffff800009d7b1ca x27: ffff80000b34bab0 > > > [ 3.172666] x26: ffff800009d7b1ca x25: 0000000000000020 x24: 0000000000000008 > > > [ 3.179820] x23: 00000000ffffffd8 x22: ffff8000099858a0 x21: ffff80000b34bc30 > > > [ 3.186973] x20: ffff80000b34ba90 x19: ffff80000b34ba98 x18: 000000003c98bfdd > > > [ 3.194127] x17: 000000000000001c x16: 00000000eec48da2 x15: 00000000a9dbdd17 > > > [ 3.201280] x14: ffff80000b0242e8 x13: 0000000057a049ef x12: 00000000cfa47237 > > > [ 3.208433] x11: 0000000000000001 x10: 00000000bd5b8780 x9 : ffff80000812cbec > > > [ 3.215586] x8 : 00000000ffffffff x7 : 0000000000000002 x6 : ffff80000b34ba98 > > > [ 3.222739] x5 : ffffffffffffffff x4 : 0000000000000000 x3 : ffff0a00ffffff04 > > > [ 3.229891] x2 : 0000000000001000 x1 : 0000000000000000 x0 : ffff80000b34bab0 > > > [ 3.237044] Call trace: > > > [ 3.239489] string (lib/vsprintf.c:644 lib/vsprintf.c:726) > > > > This is the line where vsprintf() reads a string to be printed: > > > > static char *string_nocheck(char *buf, char *end, const char *s, > > struct printf_spec spec) > > { > > int len = 0; > > int lim = spec.precision; > > > > while (lim--) { > > ----> char c = *s++; > > > > > > > [ 3.242551] vsnprintf (lib/vsprintf.c:2817) > > > [ 3.245954] vprintk_store (kernel/printk/printk.c:2200) > > > [ 3.249712] vprintk_emit (kernel/printk/printk.c:2297) > > > [ 3.253381] vprintk_default (kernel/printk/printk.c:2328) > > > [ 3.257137] vprintk (kernel/printk/printk_safe.c:50) > > > [ 3.260198] _printk (kernel/printk/printk.c:2341) > > > [ 3.263257] sysctl_err (fs/proc/proc_sysctl.c:1109) > > > [ 3.266577] __register_sysctl_table (fs/proc/proc_sysctl.c:1140 > > > fs/proc/proc_sysctl.c:1383) > > > [ 3.271202] __register_sysctl_init (fs/proc/proc_sysctl.c:1462) > > > > The has been done some reractoring/modification of this code > > by the patchset ("[PATCH 00/11] sysctl: deprecate > > register_sysctl_paths()"), see > > https://lore.kernel.org/lkml/20230302202826.776286-1-mcgrof@kernel.org/ > > > > Luis, does it trigger any bell, please? > > Do you have an idea where this code could pass a pointer PAGE_SIZE > > as string to printk("%s")? > > My bisect actually landed on commit cfe7e6ea5ee2 ("mm: memory-failure: > Move memory failure sysctls to its own file"). The new sysctl table is > missing a sentinel. The following diff resolves it for me. > > diff --git a/mm/memory-failure.c b/mm/memory-failure.c > index 6367714af61d..b2377f12f062 100644 > --- a/mm/memory-failure.c > +++ b/mm/memory-failure.c > @@ -143,6 +143,7 @@ static struct ctl_table memory_failure_table[] = { > .extra1 = SYSCTL_ZERO, > .extra2 = SYSCTL_ONE, > }, > + { } > }; Thanks pushed this fix in to sysctl-next. Luis ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: next-20230321: arm64: Unable to handle kernel paging request at virtual address 2023-03-21 16:59 ` Luis Chamberlain @ 2023-03-22 1:05 ` Kefeng Wang 0 siblings, 0 replies; 5+ messages in thread From: Kefeng Wang @ 2023-03-22 1:05 UTC (permalink / raw) To: Luis Chamberlain, Nathan Chancellor Cc: Petr Mladek, Naresh Kamboju, open list, Linux-Next Mailing List, lkft-triage, linux-mm, Andrew Morton, Arnd Bergmann, Anders Roxell, Stephen Rothwell, Steven Rostedt, Naoya Horiguchi On 2023/3/22 0:59, Luis Chamberlain wrote: > On Tue, Mar 21, 2023 at 08:56:26AM -0700, Nathan Chancellor wrote: >> On Tue, Mar 21, 2023 at 10:27:02AM +0100, Petr Mladek wrote: >>> Hi, >>> >>> I add Luis into Cc. >>> >>> On Tue 2023-03-21 11:42:56, Naresh Kamboju wrote: >>>> The following kernel crash was noticed on arm64 Juno-r2 and Raspberry Pi 4 >>>> Model B on Linux next-20230321. >>>> >>>> Reported-by: Linux Kernel Functional Testing <lkft@linaro.org> >>>> >>>> log: >>>> ---- >>>> [ 3.071500] Unable to handle kernel paging request at virtual >>>> address 0000000000001000 >>> >>> I guess that this is exactly PAGE_SIZE (4k). >>> >>>> [ 3.079432] Mem abort info: >>>> [ 3.082225] ESR = 0x0000000096000004 >>>> [ 3.085977] EC = 0x25: DABT (current EL), IL = 32 bits >>>> [ 3.091295] SET = 0, FnV = 0 >>>> [ 3.094350] EA = 0, S1PTW = 0 >>>> [ 3.097491] FSC = 0x04: level 0 translation fault >>>> [ 3.102373] Data abort info: >>>> [ 3.105252] ISV = 0, ISS = 0x00000004 >>>> [ 3.109089] CM = 0, WnR = 0 >>>> [ 3.112055] [0000000000001000] user address but active_mm is swapper >>>> [ 3.114230] usb 1-1: new high-speed USB device number 2 using ehci-platform >>>> [ 3.118418] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP >>>> [ 3.118426] Modules linked in: >>>> [ 3.134717] CPU: 1 PID: 1 Comm: swapper/0 Not tainted >>>> 6.3.0-rc3-next-20230321 #1 >>>> [ 3.142126] Hardware name: ARM Juno development board (r2) (DT) >>>> [ 3.148052] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) >>>> [ 3.155027] pc : string (lib/vsprintf.c:644 lib/vsprintf.c:726) >>>> [ 3.158443] lr : vsnprintf (lib/vsprintf.c:2817) >>>> [ 3.162196] sp : ffff80000b34b8f0 >>>> [ 3.165511] x29: ffff80000b34b8f0 x28: ffff800009d7b1ca x27: ffff80000b34bab0 >>>> [ 3.172666] x26: ffff800009d7b1ca x25: 0000000000000020 x24: 0000000000000008 >>>> [ 3.179820] x23: 00000000ffffffd8 x22: ffff8000099858a0 x21: ffff80000b34bc30 >>>> [ 3.186973] x20: ffff80000b34ba90 x19: ffff80000b34ba98 x18: 000000003c98bfdd >>>> [ 3.194127] x17: 000000000000001c x16: 00000000eec48da2 x15: 00000000a9dbdd17 >>>> [ 3.201280] x14: ffff80000b0242e8 x13: 0000000057a049ef x12: 00000000cfa47237 >>>> [ 3.208433] x11: 0000000000000001 x10: 00000000bd5b8780 x9 : ffff80000812cbec >>>> [ 3.215586] x8 : 00000000ffffffff x7 : 0000000000000002 x6 : ffff80000b34ba98 >>>> [ 3.222739] x5 : ffffffffffffffff x4 : 0000000000000000 x3 : ffff0a00ffffff04 >>>> [ 3.229891] x2 : 0000000000001000 x1 : 0000000000000000 x0 : ffff80000b34bab0 >>>> [ 3.237044] Call trace: >>>> [ 3.239489] string (lib/vsprintf.c:644 lib/vsprintf.c:726) >>> >>> This is the line where vsprintf() reads a string to be printed: >>> >>> static char *string_nocheck(char *buf, char *end, const char *s, >>> struct printf_spec spec) >>> { >>> int len = 0; >>> int lim = spec.precision; >>> >>> while (lim--) { >>> ----> char c = *s++; >>> >>> >>>> [ 3.242551] vsnprintf (lib/vsprintf.c:2817) >>>> [ 3.245954] vprintk_store (kernel/printk/printk.c:2200) >>>> [ 3.249712] vprintk_emit (kernel/printk/printk.c:2297) >>>> [ 3.253381] vprintk_default (kernel/printk/printk.c:2328) >>>> [ 3.257137] vprintk (kernel/printk/printk_safe.c:50) >>>> [ 3.260198] _printk (kernel/printk/printk.c:2341) >>>> [ 3.263257] sysctl_err (fs/proc/proc_sysctl.c:1109) >>>> [ 3.266577] __register_sysctl_table (fs/proc/proc_sysctl.c:1140 >>>> fs/proc/proc_sysctl.c:1383) >>>> [ 3.271202] __register_sysctl_init (fs/proc/proc_sysctl.c:1462) >>> >>> The has been done some reractoring/modification of this code >>> by the patchset ("[PATCH 00/11] sysctl: deprecate >>> register_sysctl_paths()"), see >>> https://lore.kernel.org/lkml/20230302202826.776286-1-mcgrof@kernel.org/ >>> >>> Luis, does it trigger any bell, please? >>> Do you have an idea where this code could pass a pointer PAGE_SIZE >>> as string to printk("%s")? >> >> My bisect actually landed on commit cfe7e6ea5ee2 ("mm: memory-failure: >> Move memory failure sysctls to its own file"). The new sysctl table is >> missing a sentinel. The following diff resolves it for me. >> >> diff --git a/mm/memory-failure.c b/mm/memory-failure.c >> index 6367714af61d..b2377f12f062 100644 >> --- a/mm/memory-failure.c >> +++ b/mm/memory-failure.c >> @@ -143,6 +143,7 @@ static struct ctl_table memory_failure_table[] = { >> .extra1 = SYSCTL_ZERO, >> .extra2 = SYSCTL_ONE, >> }, >> + { } >> }; > Sorry, I don't know why this is removed after v1[1] when resend :( thanks for your fix. [1] https://lkml.org/lkml/2023/3/8/1644 > Thanks pushed this fix in to sysctl-next. > > Luis ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2023-03-22 1:05 UTC | newest] Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2023-03-21 6:12 next-20230321: arm64: Unable to handle kernel paging request at virtual address Naresh Kamboju 2023-03-21 9:27 ` Petr Mladek 2023-03-21 15:56 ` Nathan Chancellor 2023-03-21 16:59 ` Luis Chamberlain 2023-03-22 1:05 ` Kefeng Wang
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox