Re: [Regression] Bug 216420 - Unable to handle kernel NULL pointer dereference at virtual address 00000008

[Saravana Kannan <saravanak@google.com>]

On Mon, Aug 29, 2022 at 6:54 AM Yann Gautier <yann.gautier@foss.st.com> wrote:
>
> On 8/29/22 13:50, Yann Gautier wrote:
> > On 8/28/22 13:44, Thorsten Leemhuis wrote:
> >> Hi, this is your Linux kernel regression tracker speaking.
> >>
> >> I noticed a regression report in bugzilla.kernel.org. As many (most?)
> >> kernel developer don't keep an eye on it, I decided to forward it (I
> >> hope I picked the right recipients for this mail):
> >>
> >>>   frc.gabriel@gmail.com 2022-08-27 09:36:06 UTC
> >>>
> >>> Created attachment 301682 [details]
> >>> full dmesg output
> >>>
> >>> Hi, good morning!
> >>>
> >>> my device is currently crashing during boot with kernel 6.0.0-rc2. I
> >>> also tried next-20220826 and the outcome is the same.
> >>>
> >>> The full dmesg log can be found attached on crash-boot.txt file.
> >>>
> >>> Thank you and have a good day,
> >>> Gabriel Francisco
> >>
> >>  From that dmesg:
> >>
> >>> [    2.279556] 8<--- cut here ---
> >>> [    2.279734] s4: Bringing 0uV into 815000-815000uV
> >>> [    2.284139] Unable to handle kernel NULL pointer dereference at
> >>> virtual address 00000008
> >>> [    2.288082] s1: Bringing 0uV into 1300000-1300000uV
> >>> [    2.292017] [00000008] *pgd=00000000
> >>> [    2.300784] s2: Bringing 0uV into 2150000-2150000uV
> >>> [    2.304801] Internal error: Oops: 5 [#1] SMP ARM
> >>> [    2.309033] s3: Bringing 0uV into 1800000-1800000uV
> >>> [    2.313196] Modules linked in:
> >>> [    2.313208] CPU: 2 PID: 7 Comm: kworker/u8:0 Not tainted 6.0.0-rc2
> >>> #325
> >>> [    2.313221] Hardware name: Generic DT based system
> >>> [    2.318516] l1: Bringing 0uV into 1225000-1225000uV
> >>> [    2.322655] Workqueue: events_unbound deferred_probe_work_func
> >>> [    2.326162] l2: Bringing 0uV into 1200000-1200000uV
> >>> [    2.332290] PC is at mmci_probe+0x10/0x9b0
> >>> [    2.332308] LR is at amba_probe+0xf0/0x174
> >>> [    2.337399] l3: Bringing 0uV into 1225000-1225000uV
> >>> [    2.341927] pc : [<c0b14e10>]    lr : [<c089036c>]    psr: 80000013
> >>> [    2.348097] l4: Bringing 0uV into 1225000-1225000uV
> >>> [    2.352601] sp : f0839dd0  ip : fffffff8  fp : c1903248
> >>> [    2.352609] r10: c1448b9c  r9 : fffffdfb  r8 : 00000000
> >>> [    2.352616] r7 : c1903000  r6 : eefe45bc  r5 : 00000000  r4 :
> >>> c1903100
> >>> [    2.357020] l5: Bringing 0uV into 1800000-1800000uV
> >>> [    2.360849] r3 : c0b14e00  r2 : 00000000  r1 : 00000000  r0 :
> >>> c1903000
> >>> [    2.365896] l6: Bringing 0uV into 1800000-1800000uV
> >>> [    2.371873] Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM
> >>> Segment none
> >>> [    2.377217] l7: Bringing 0uV into 1800000-1800000uV
> >>> [    2.381944] Control: 10c5787d  Table: 0020406a  DAC: 00000051
> >>> [    2.387543] l8: Bringing 0uV into 1800000-1800000uV
> >>> [    2.393749] Register r0 information: slab kmalloc-1k start
> >>> c1903000 pointer offset 0 size 1024
> >>> [    2.398766] l9: Bringing 0uV into 1800000-1800000uV
> >>> [    2.405119]
> >>> [    2.405124] Register r1 information: NULL pointer
> >>> [    2.405137] Register r2 information:
> >>> [    2.410141] l10: Bringing 0uV into 1800000-1800000uV
> >>> [    2.417186]  NULL pointer
> >>> [    2.417193] Register r3 information: non-slab/vmalloc memory
> >>> [    2.417205] Register r4 information:
> >>> [    2.422124] l11: Bringing 0uV into 1300000-1300000uV
> >>> [    2.427776]  slab kmalloc-1k start c1903000 pointer offset 256
> >>> size 1024
> >>> [    2.432756] l12: Bringing 0uV into 1800000-1800000uV
> >>> [    2.441145]
> >>> [    2.446335] l13: Bringing 0uV into 1800000-1800000uV
> >>> [    2.447655] Register r5 information:
> >>> [    2.452735] l14: Bringing 0uV into 1800000-1800000uV
> >>> [    2.455902]  NULL pointer
> >>> [    2.461123] l15: Bringing 0uV into 2050000-2050000uV
> >>> [    2.463368] Register r6 information: non-slab/vmalloc memory
> >>> [    2.463380] Register r7 information: slab kmalloc-1k start c1903000
> >>> [    2.469373] l16: Bringing 0uV into 2700000-2700000uV
> >>> [    2.472656]  pointer offset 0 size 1024
> >>> [    2.472671] Register r8 information:
> >>> [    2.477868] l17: Bringing 0uV into 2850000-2850000uV
> >>> [    2.484288]  NULL pointer
> >>> [    2.484294] Register r9 information: non-paged memory
> >>> [    2.484305] Register r10 information:
> >>> [    2.489490] l18: Bringing 0uV into 2850000-2850000uV
> >>> [    2.490712]  non-slab/vmalloc memory
> >>> [    2.495937] l19: Bringing 0uV into 3000000-3000000uV
> >>> [    2.499217] Register r11 information:
> >>> [    2.504461] l20: Bringing 0uV into 2950000-2950000uV
> >>> [    2.506683]  slab kmalloc-1k
> >>> [    2.512149] l21: Bringing 0uV into 2950000-2950000uV
> >>> [    2.517361]  start c1903000 pointer offset 584 size 1024
> >>> [    2.517382] Register r12 information:
> >>> [    2.523805] l22: Bringing 0uV into 3000000-3000000uV
> >>> [    2.528556]  non-paged memory
> >>> [    2.532414] l23: Bringing 0uV into 3000000-3000000uV
> >>> [    2.535937] Process kworker/u8:0 (pid: 7, stack limit = 0x(ptrval))
> >>> [    2.541160] l24: Bringing 0uV into 3075000-3075000uV
> >>> [    2.543402] Stack: (0xf0839dd0 to 0xf083a000)
> >>> [    2.543413] 9dc0:                                     c1903000
> >>> c1903000 00000000 7ff15a00
> >>> [    2.543425] 9de0: 60172703 00000000 c1903000 c1903000 20000013
> >>> c1903084 c1903000 c1903100
> >>> [    2.627929] 9e00: 00000000 eefe45bc c1903000 00000000 fffffdfb
> >>> c1448b9c c1903248 c089036c
> >>> [    2.635613] 9e20: c089027c 00000000 c1903000 c1448b9c c147a260
> >>> 00000000 c14672a0 c180f00d
> >>> [    2.643773] 9e40: c18db480 c0940584 c1903000 00000000 c1903000
> >>> c147a260 c1448b9c 0000000d
> >>> [    2.651933] 9e60: 00000000 c0940950 c29b4380 c33d7380 c14c1fe4
> >>> c1448b9c c1903000 00000000
> >>> [    2.660092] 9e80: c14672a0 c180f00d c18db480 c0940ae4 fffffdfb
> >>> c1448b9c f0839ee4 c1903000
> >>> [    2.668252] 9ea0: 00000000 c0941190 00000000 f0839ee4 c09410ec
> >>> c147a260 00000000 c093e658
> >>> [    2.676412] 9ec0: c14672a0 c19dab6c c1b44fb8 cb719486 c1903000
> >>> c1903044 00000001 c0940d9c
> >>> [    2.684572] 9ee0: c147a260 c1903000 00000001 cb719486 c1903000
> >>> c1903000 c13f37dc c093f7a0
> >>> [    2.692731] 9f00: c1903000 c142aeec c142af00 c093fc94 c142af1c
> >>> c1803780 c1806800 c180f000
> >>> [    2.700890] 9f20: 00000000 c033dc60 c1803780 c18db480 c1806800
> >>> c1806800 c180681c c1803780
> >>> [    2.709050] 9f40: c1806800 c1803798 c180681c c1303d40 c18db480
> >>> 00000088 c1806800 c033e148
> >>> [    2.717211] 9f60: c1803780 c1303d40 f0821ea0 c18b7040 c18db480
> >>> c033df2c c1803780 c18b7400
> >>> [    2.725369] 9f80: f0821ea0 00000000 00000000 c03458ac c18b7040
> >>> c03457dc 00000000 00000000
> >>> [    2.733529] 9fa0: 00000000 00000000 00000000 c0300148 00000000
> >>> 00000000 00000000 00000000
> >>> [    2.741688] 9fc0: 00000000 00000000 00000000 00000000 00000000
> >>> 00000000 00000000 00000000
> >>> [    2.749850] 9fe0: 00000000 00000000 00000000 00000000 00000013
> >>> 00000000 00000000 00000000
> >>> [    2.758012]  mmci_probe from amba_probe+0xf0/0x174
> >>> [    2.766161]  amba_probe from really_probe+0xe0/0x40c
> >>> [    2.770847]  really_probe from __driver_probe_device+0xa0/0x204
> >>> [    2.775971]  __driver_probe_device from driver_probe_device+0x30/0xc0
> >>> [    2.781612]  driver_probe_device from
> >>> __device_attach_driver+0xa4/0x11c
> >>> [    2.788209]  __device_attach_driver from bus_for_each_drv+0x80/0xcc
> >>> [    2.794633]  bus_for_each_drv from __device_attach+0xa8/0x1f0
> >>> [    2.800881]  __device_attach from bus_probe_device+0x84/0x8c
> >>> [    2.806784]  bus_probe_device from deferred_probe_work_func+0x8c/0xd4
> >>> [    2.812515]  deferred_probe_work_func from
> >>> process_one_work+0x1fc/0x4c8
> >>> [    2.818854]  process_one_work from worker_thread+0x21c/0x540
> >>> [    2.825275]  worker_thread from kthread+0xd0/0xec
> >>> [    2.831177]  kthread from ret_from_fork+0x14/0x2c
> >>> [    2.835775] Exception stack(0xf0839fb0 to 0xf0839ff8)
> >>> [    2.840465] 9fa0:                                     00000000
> >>> 00000000 00000000 00000000
> >>> [    2.845509] 9fc0: 00000000 00000000 00000000 00000000 00000000
> >>> 00000000 00000000 00000000
> >>> [    2.853668] 9fe0: 00000000 00000000 00000000 00000000 00000013
> >>> 00000000
> >>> [    2.861826] Code: e92d4ff0 e590803c e24dd02c e59061a0 (e5917008)
> >>> [    2.868280] ---[ end trace 0000000000000000 ]---
> >>
> >> See the ticket for more details.
> >>
> >> I'd also like to add the report to the list of tracked regressions to
> >> ensure it's doesn't fall through the cracks in the end:
> >>
> >> #regzbot introduced: v5.19..v6.0-rc2
> >> https://bugzilla.kernel.org/show_bug.cgi?id=216420
> >> #regzbot ignore-activity
> >>
> >> Ciao, Thorsten (wearing his 'the Linux kernel's regression tracker' hat)
> >>
> >> P.S.: As the Linux kernel's regression tracker I deal with a lot of
> >> reports and sometimes miss something important when writing mails like
> >> this. If that's the case here, don't hesitate to tell me in a public
> >> reply, it's in everyone's interest to set the public record straight.
> >
> > Hi,
> >
> > If I'm not wrong, the mmci driver shouldn't be probed for this platform.
> > So either there is something wrong with the device tree, or with the
> > AMBA bus driver.
> >
> >
> > Best regards,
> > Yann
>
> Maybe this is related (corrected?) with this patch:
> https://lkml.org/lkml/2022/8/27/164

This fix is probably this one:
https://lore.kernel.org/lkml/20220818172852.3548-1-isaacmanjarres@google.com/

-Saravana