From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5A2E3C433E0 for ; Fri, 5 Jun 2020 12:48:01 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 0D020206DC for ; Fri, 5 Jun 2020 12:48:00 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="eDCSh3wA" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 0D020206DC Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=oracle.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 9A4B180007; Fri, 5 Jun 2020 08:48:00 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 954C98E0006; Fri, 5 Jun 2020 08:48:00 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 8446880007; Fri, 5 Jun 2020 08:48:00 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0151.hostedemail.com [216.40.44.151]) by kanga.kvack.org (Postfix) with ESMTP id 6B6048E0006 for ; Fri, 5 Jun 2020 08:48:00 -0400 (EDT) Received: from smtpin26.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id F0C44180AD801 for ; Fri, 5 Jun 2020 12:47:59 +0000 (UTC) X-FDA: 76895135478.26.ink68_4f0ba3426da0 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin26.hostedemail.com (Postfix) with ESMTP id C93871804B3A3 for ; Fri, 5 Jun 2020 12:47:59 +0000 (UTC) X-HE-Tag: ink68_4f0ba3426da0 X-Filterd-Recvd-Size: 9882 Received: from userp2130.oracle.com (userp2130.oracle.com [156.151.31.86]) by imf02.hostedemail.com (Postfix) with ESMTP for ; Fri, 5 Jun 2020 12:47:58 +0000 (UTC) Received: from pps.filterd (userp2130.oracle.com [127.0.0.1]) by userp2130.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 055Cg3dp118504; Fri, 5 Jun 2020 12:47:27 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=subject : from : to : cc : references : message-id : date : mime-version : in-reply-to : content-type : content-transfer-encoding; s=corp-2020-01-29; bh=KapCunL+f5y0ROBLNbLpuHlEjvE8kkYsJySPIhLHQcs=; b=eDCSh3wAm7SG1I8hSm6gf1YW6DbY2A+hUXR5XW0emL+T8aXdVq5MhPQYAfxQXCwBv/bh dDO2s7VpihC1HEZPEg3Ld8zouVmmp0NL7TJlub0KYMkJma01RZ3V0i+0RmQZjUQPc1EN B2OpZBAri6repN1dQbshuIAJLmfH8+C1BR5giWfrw/TMPH62E6sJBV4D5ja/IohzO0bH B4YTR7VX3ZOuh0XWdM+Y8CK7oY2zL35u6oU7lHT+/4EefWKWgl8VNlNtZ1AxRaBNPoAS RsuLSsktzjjR0t6odR1jVcaaeapNAZbJmj0iWimfl7mjBHJ0F4XYPEj/Tckcruivalrv hg== Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by userp2130.oracle.com with ESMTP id 31f9242p11-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Fri, 05 Jun 2020 12:47:26 +0000 Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 055Cc7o5038704; Fri, 5 Jun 2020 12:47:26 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserp3020.oracle.com with ESMTP id 31f927f48e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 05 Jun 2020 12:47:26 +0000 Received: from abhmp0013.oracle.com (abhmp0013.oracle.com [141.146.116.19]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id 055ClN8V009606; Fri, 5 Jun 2020 12:47:23 GMT Received: from [10.175.51.78] (/10.175.51.78) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 05 Jun 2020 05:47:23 -0700 Subject: Re: slub freelist issue / BUG: unable to handle page fault for address: 000000003ffe0018 From: Vegard Nossum To: Vlastimil Babka , Kees Cook , Robert Moore , "Rafael J. Wysocki" Cc: Christoph Lameter , Andrew Morton , Marco Elver , Waiman Long , LKML , Linux MM , linux-acpi@vger.kernel.org, Erik Kaneda , Len Brown , Steven Rostedt References: <4dc93ff8-f86e-f4c9-ebeb-6d3153a78d03@oracle.com> <7839183d-1c0b-da02-73a2-bf5e1e8b02b9@suse.cz> <94296941-1073-913c-2adb-bf2e41be9f0f@oracle.com> <202006041054.874AA564@keescook> <34455dce-6675-1fc2-8d61-45bf56f3f554@suse.cz> <6b2b149e-c2bc-f87a-ea2c-3046c5e39bf9@oracle.com> Message-ID: Date: Fri, 5 Jun 2020 14:47:18 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.7.0 MIME-Version: 1.0 In-Reply-To: <6b2b149e-c2bc-f87a-ea2c-3046c5e39bf9@oracle.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9642 signatures=668680 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 mlxlogscore=999 bulkscore=0 suspectscore=0 mlxscore=0 adultscore=0 malwarescore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2006050094 X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9642 signatures=668680 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 clxscore=1015 impostorscore=0 adultscore=0 priorityscore=1501 mlxlogscore=999 mlxscore=0 bulkscore=0 lowpriorityscore=0 cotscore=-2147483648 phishscore=0 spamscore=0 malwarescore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2006050094 X-Rspamd-Queue-Id: C93871804B3A3 X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam01 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 2020-06-05 11:36, Vegard Nossum wrote: >=20 > On 2020-06-05 11:11, Vlastimil Babka wrote: >> On 6/4/20 8:46 PM, Vlastimil Babka wrote: >>> On 6/4/20 7:57 PM, Kees Cook wrote: >>>> On Thu, Jun 04, 2020 at 07:20:18PM +0200, Vegard Nossum wrote: >>>>> On 2020-06-04 19:18, Vlastimil Babka wrote: >>>>>> On 6/4/20 7:14 PM, Vegard Nossum wrote: >>>>>>> >>>>>>> Hi all, >>>>>>> >>>>>>> I ran into a boot problem with latest linus/master >>>>>>> (6929f71e46bdddbf1c4d67c2728648176c67c555) that manifests like th= is: >>>>>> >>>>>> Hi, what's the .config you use? >>>>> >>>>> Pretty much x86_64 defconfig minus a few options (PCI, USB, ...) >>>> >>>> Oh yes indeed. I immediately crash in the same way with this config.= =20 >>>> I'll >>>> start digging... >>>> >>>> (defconfig finishes boot) >>> >>> This is funny, booting with slub_debug=3DF results in: >>> I'm not sure if it's ACPI or ftrace wrong here, but looks like the=20 >>> changed >>> free pointer offset merely exposes a bug in something else. >> >> So, with Kees' patch reverted, booting with slub_debug=3DF (or even mo= re >> specific slub_debug=3DF,ftrace_event_field) also hits this bug below. = I >> wanted to bisect it, but v5.7 was also bad, and also v5.6. Didn't try >> further in history. So it's not new at all, and likely very specific t= o >> your config+QEMU? (and related to the ACPI error messages that precede= =20 >> it?). >=20 > I see it too, but not on v5.0. I can bisect it. commit 67a72420a326b45514deb3f212085fb2cd1595b5 Author: Bob Moore Date: Fri Aug 16 14:43:21 2019 -0700 ACPICA: Increase total number of possible Owner IDs ACPICA commit 1f1652dad88b9d767767bc1f7eb4f7d99e6b5324 From 255 to 4095 possible IDs. Link: https://github.com/acpica/acpica/commit/1f1652da Reported-by: Hedi Berriche Signed-off-by: Bob Moore Signed-off-by: Erik Schmauss Signed-off-by: Rafael J. Wysocki Vegard >>> This would mean acpi_os_release_object() calling=20 >>> kmem_cache_free(ftrace_event_field, x) >>> where x is actually from kmalloc-64? Both parts of that sounds wrong. >>> >>> Thread starts here:=20 >>> https://lore.kernel.org/linux-mm/4dc93ff8-f86e-f4c9-ebeb-6d3153a78d03= @oracle.com/=20 >>> >>> >>> [=C2=A0=C2=A0=C2=A0 0.144386] ACPI: Added _OSI(Module Device) >>> [=C2=A0=C2=A0=C2=A0 0.144496] ACPI: Added _OSI(Processor Device) >>> [=C2=A0=C2=A0=C2=A0 0.144956] ACPI: Added _OSI(3.0 _SCP Extensions) >>> [=C2=A0=C2=A0=C2=A0 0.145432] ACPI: Added _OSI(Processor Aggregator D= evice) >>> [=C2=A0=C2=A0=C2=A0 0.145501] ACPI: Added _OSI(Linux-Dell-Video) >>> [=C2=A0=C2=A0=C2=A0 0.145951] ACPI: Added _OSI(Linux-Lenovo-NV-HDMI-A= udio) >>> [=C2=A0=C2=A0=C2=A0 0.146522] ACPI: Added _OSI(Linux-HPI-Hybrid-Graph= ics) >>> [=C2=A0=C2=A0=C2=A0 0.147070] ACPI Error: AE_BAD_PARAMETER, During Re= gion=20 >>> initialization (20200430/tbxfload-52) >>> [=C2=A0=C2=A0=C2=A0 0.147494] ACPI: Unable to load the System Descrip= tion Tables >>> [=C2=A0=C2=A0=C2=A0 0.148104] ACPI Error: Could not remove SCI handle= r=20 >>> (20200430/evmisc-251) >>> [=C2=A0=C2=A0=C2=A0 0.148507] ------------[ cut here ]------------ >>> [=C2=A0=C2=A0=C2=A0 0.148985] cache_from_obj: Wrong slab cache. ftrac= e_event_field=20 >>> but object is from kmalloc-64 >>> [=C2=A0=C2=A0=C2=A0 0.149502] WARNING: CPU: 0 PID: 1 at mm/slab.h:523= =20 >>> kmem_cache_free+0x248/0x260 >>> [=C2=A0=C2=A0=C2=A0 0.150254] CPU: 0 PID: 1 Comm: swapper/0 Not taint= ed 5.7.0+ #43 >>> [=C2=A0=C2=A0=C2=A0 0.150490] Hardware name: QEMU Standard PC (i440FX= + PIIX, 1996),=20 >>> BIOS rel-1.13.0-0-gf21b5a4-rebuilt.opensuse.org 04/01/2014 >>> [=C2=A0=C2=A0=C2=A0 0.150490] RIP: 0010:kmem_cache_free+0x248/0x260 >>> [=C2=A0=C2=A0=C2=A0 0.150490] Code: ff 0f 0b e9 9d fe ff ff 49 8b 4d = 58 48 8b 55 58=20 >>> 48 c7 c6 10 47 c1 a4 48 c7 c7 f0 c1 d0 a4 c6 05 9f 05 b1 00 01 e8 bc=20 >>> cc eb ff <0f> 0b 48 8b 15 5f 36 9b 00 4c 89 ed e9 d6 fd ff ff 0f 1f=20 >>> 80 00 00 >>> [=C2=A0=C2=A0=C2=A0 0.150490] RSP: 0018:ffffb4dac0013dc0 EFLAGS: 0001= 0282 >>> [=C2=A0=C2=A0=C2=A0 0.150490] RAX: 0000000000000000 RBX: ffffa38a0740= 9e00 RCX:=20 >>> 0000000000000000 >>> [=C2=A0=C2=A0=C2=A0 0.150490] RDX: 0000000000000001 RSI: 000000000000= 0092 RDI:=20 >>> ffffffffa51dd32c >>> [=C2=A0=C2=A0=C2=A0 0.150490] RBP: ffffa38a07403900 R08: ffffb4dac001= 3c7d R09:=20 >>> 00000000000000eb >>> [=C2=A0=C2=A0=C2=A0 0.150490] R10: ffffb4dac0013c78 R11: ffffb4dac001= 3c7d R12:=20 >>> ffffa38a87409e00 >>> [=C2=A0=C2=A0=C2=A0 0.150490] R13: ffffa38a07401d00 R14: 000000000000= 0000 R15:=20 >>> 0000000000000000 >>> [=C2=A0=C2=A0=C2=A0 0.150490] FS:=C2=A0 0000000000000000(0000) GS:fff= fa38a07a00000(0000)=20 >>> knlGS:0000000000000000 >>> [=C2=A0=C2=A0=C2=A0 0.150490] CS:=C2=A0 0010 DS: 0000 ES: 0000 CR0: 0= 000000080050033 >>> [=C2=A0=C2=A0=C2=A0 0.150490] CR2: 0000000000000000 CR3: 000000000560= a000 CR4:=20 >>> 00000000003406f0 >>> [=C2=A0=C2=A0=C2=A0 0.150490] Call Trace: >>> [=C2=A0=C2=A0=C2=A0 0.150490]=C2=A0 acpi_os_release_object+0x5/0x10 >>> [=C2=A0=C2=A0=C2=A0 0.150490]=C2=A0 acpi_ns_delete_children+0x46/0x59 >>> [=C2=A0=C2=A0=C2=A0 0.150490]=C2=A0 acpi_ns_delete_namespace_subtree+= 0x5c/0x79 >>> [=C2=A0=C2=A0=C2=A0 0.150490]=C2=A0 ? acpi_sleep_proc_init+0x1f/0x1f >>> [=C2=A0=C2=A0=C2=A0 0.150490]=C2=A0 acpi_ns_terminate+0xc/0x31 >>> [=C2=A0=C2=A0=C2=A0 0.150490]=C2=A0 acpi_ut_subsystem_shutdown+0x45/0= xa3 >>> [=C2=A0=C2=A0=C2=A0 0.150490]=C2=A0 ? acpi_sleep_proc_init+0x1f/0x1f >>> [=C2=A0=C2=A0=C2=A0 0.150490]=C2=A0 acpi_terminate+0x5/0xf >>> [=C2=A0=C2=A0=C2=A0 0.150490]=C2=A0 acpi_init+0x27b/0x308 >>> [=C2=A0=C2=A0=C2=A0 0.150490]=C2=A0 ? video_setup+0x79/0x79 >>> [=C2=A0=C2=A0=C2=A0 0.150490]=C2=A0 do_one_initcall+0x7b/0x160 >>> [=C2=A0=C2=A0=C2=A0 0.150490]=C2=A0 kernel_init_freeable+0x190/0x1f2 >>> [=C2=A0=C2=A0=C2=A0 0.150490]=C2=A0 ? rest_init+0x9a/0x9a >>> [=C2=A0=C2=A0=C2=A0 0.150490]=C2=A0 kernel_init+0x5/0xf6 >>> [=C2=A0=C2=A0=C2=A0 0.150490]=C2=A0 ret_from_fork+0x22/0x30 >>> [=C2=A0=C2=A0=C2=A0 0.150490] ---[ end trace 967e9fbc065d7911 ]--- >>> >>> >>> >> >=20