* [syzbot] general protection fault in wb_timer_fn @ 2021-08-14 11:57 syzbot [not found] ` <20210816091041.3313-1-hdanton@sina.com> 0 siblings, 1 reply; 10+ messages in thread From: syzbot @ 2021-08-14 11:57 UTC (permalink / raw) To: acme, alexander.shishkin, axboe, bp, hpa, jmattson, jolsa, joro, kvm, linux-block, linux-kernel, mark.rutland, mingo, namhyung, pbonzini, peterz, seanjc, syzkaller-bugs, tglx, vkuznets, wanpengli, x86 Hello, syzbot found the following issue on: HEAD commit: 92d00774360d Add linux-next specific files for 20210810 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=127f1f79300000 kernel config: https://syzkaller.appspot.com/x/.config?x=a6933fa6f9a86ca9 dashboard link: https://syzkaller.appspot.com/bug?extid=aa0801b6b32dca9dda82 compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=145a8ff1300000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1496e9fa300000 The issue was bisected to: commit 9483409ab5067941860754e78a4a44a60311d276 Author: Namhyung Kim <namhyung@kernel.org> Date: Mon Mar 15 03:34:36 2021 +0000 perf core: Allocate perf_buffer in the target node memory bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=16fd40f9300000 final oops: https://syzkaller.appspot.com/x/report.txt?x=15fd40f9300000 console output: https://syzkaller.appspot.com/x/log.txt?x=11fd40f9300000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+aa0801b6b32dca9dda82@syzkaller.appspotmail.com Fixes: 9483409ab506 ("perf core: Allocate perf_buffer in the target node memory") general protection fault, probably for non-canonical address 0xdffffc00000000aa: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000550-0x0000000000000557] CPU: 0 PID: 6563 Comm: systemd-udevd Not tainted 5.14.0-rc5-next-20210810-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:latency_exceeded block/blk-wbt.c:237 [inline] RIP: 0010:wb_timer_fn+0x149/0x1740 block/blk-wbt.c:360 Code: 03 80 3c 02 00 0f 85 68 13 00 00 48 8b 9b c8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bb 50 05 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 35 13 00 00 48 8b 9b 50 05 00 00 48 b8 00 00 00 RSP: 0018:ffffc90000007cd8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000100 RDX: 00000000000000aa RSI: ffffffff83d107dd RDI: 0000000000000550 RBP: ffff88801ab3cc00 R08: 0000000000000003 R09: ffff88801ab3cd83 R10: ffffffff83d107d2 R11: 0000000000027e24 R12: 0000000000000003 R13: 0000000000000000 R14: ffff888146318000 R15: ffff88801ab3ccd0 FS: 00007fc1898e38c0(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055aed4a39410 CR3: 0000000025577000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x16e/0x1c0 kernel/softirq.c:636 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1100 </IRQ> asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:tomoyo_domain_quota_is_ok+0x105/0x550 security/tomoyo/util.c:1054 Code: 68 10 48 3b 2c 24 0f 84 f4 00 00 00 49 be 00 00 00 00 00 fc ff df eb 5f e8 f8 8b d7 fd 48 89 e8 48 89 ee 48 c1 e8 03 83 e6 07 <42> 0f b6 0c 30 48 8d 45 07 48 89 c2 48 c1 ea 03 42 0f b6 14 32 40 RSP: 0018:ffffc900011df908 EFLAGS: 00000246 RAX: 1ffff1100f264000 RBX: 0000000000000010 RCX: 0000000000000000 RDX: ffff888019120000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: ffff888079320000 R08: 0000000000000000 R09: 0000000000000010 R10: ffffffff839e1c9a R11: 0000000000000010 R12: 0000000000000002 R13: 00000000000000e1 R14: dffffc0000000000 R15: 0000000000000000 tomoyo_supervisor+0x2f2/0xf00 security/tomoyo/common.c:2089 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline] tomoyo_path_permission security/tomoyo/file.c:587 [inline] tomoyo_path_permission+0x270/0x3a0 security/tomoyo/file.c:573 tomoyo_path_perm+0x2f0/0x400 security/tomoyo/file.c:838 security_inode_getattr+0xcf/0x140 security/security.c:1332 vfs_getattr fs/stat.c:157 [inline] vfs_fstat+0x43/0xb0 fs/stat.c:182 __do_sys_newfstat+0x81/0x100 fs/stat.c:422 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fc1887552e2 Code: 48 8b 05 b9 db 2b 00 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 83 ff 01 77 33 48 63 fe b8 05 00 00 00 48 89 d6 0f 05 <48> 3d 00 f0 ff ff 77 06 f3 c3 0f 1f 40 00 48 8b 15 81 db 2b 00 f7 RSP: 002b:00007ffed32f4de8 EFLAGS: 00000246 ORIG_RAX: 0000000000000005 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc1887552e2 RDX: 00007ffed32f4e00 RSI: 00007ffed32f4e00 RDI: 0000000000000007 RBP: 00007ffed32f4f80 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000080000 R11: 0000000000000246 R12: 000055aed49f40e0 R13: 000055aed4a06f10 R14: 00007ffed32f4ee0 R15: 00007ffed32f4f40 Modules linked in: ---[ end trace 85971c24ea99db54 ]--- RIP: 0010:latency_exceeded block/blk-wbt.c:237 [inline] RIP: 0010:wb_timer_fn+0x149/0x1740 block/blk-wbt.c:360 Code: 03 80 3c 02 00 0f 85 68 13 00 00 48 8b 9b c8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bb 50 05 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 35 13 00 00 48 8b 9b 50 05 00 00 48 b8 00 00 00 RSP: 0018:ffffc90000007cd8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000100 RDX: 00000000000000aa RSI: ffffffff83d107dd RDI: 0000000000000550 RBP: ffff88801ab3cc00 R08: 0000000000000003 R09: ffff88801ab3cd83 R10: ffffffff83d107d2 R11: 0000000000027e24 R12: 0000000000000003 R13: 0000000000000000 R14: ffff888146318000 R15: ffff88801ab3ccd0 FS: 00007fc1898e38c0(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055aed4a39410 CR3: 0000000025577000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches ^ permalink raw reply [flat|nested] 10+ messages in thread
[parent not found: <20210816091041.3313-1-hdanton@sina.com>]
* Re: [syzbot] general protection fault in wb_timer_fn [not found] ` <20210816091041.3313-1-hdanton@sina.com> @ 2021-08-16 9:33 ` Christoph Hellwig 2021-08-19 9:03 ` Sven Schnelle 0 siblings, 1 reply; 10+ messages in thread From: Christoph Hellwig @ 2021-08-16 9:33 UTC (permalink / raw) To: Hillf Danton Cc: syzbot, axboe, Christoph Hellwig, linux-block, linux-kernel, syzkaller-bugs On Mon, Aug 16, 2021 at 05:10:41PM +0800, Hillf Danton wrote: > Remove and free all qos callbacks added, with cb->timer deleted in > blk_stat_remove_callback(). > > only for thoughts. > > +++ x/block/blk-sysfs.c > @@ -800,9 +800,7 @@ static void blk_release_queue(struct kob > > might_sleep(); > > - if (test_bit(QUEUE_FLAG_POLL_STATS, &q->queue_flags)) > - blk_stat_remove_callback(q, q->poll_cb); > - blk_stat_free_callback(q->poll_cb); > + rq_qos_exit(q); rq_qos_exit is already called in blk_cleanup_queue, and the blk-mq pollig doesn't even use the qos framework. So I'm not sure what this is supposed to help. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] general protection fault in wb_timer_fn 2021-08-16 9:33 ` Christoph Hellwig @ 2021-08-19 9:03 ` Sven Schnelle 2021-08-19 9:05 ` Christoph Hellwig 0 siblings, 1 reply; 10+ messages in thread From: Sven Schnelle @ 2021-08-19 9:03 UTC (permalink / raw) To: Christoph Hellwig Cc: Hillf Danton, syzbot, axboe, linux-block, linux-kernel, syzkaller-bugs Christoph Hellwig <hch@lst.de> writes: > On Mon, Aug 16, 2021 at 05:10:41PM +0800, Hillf Danton wrote: >> Remove and free all qos callbacks added, with cb->timer deleted in >> blk_stat_remove_callback(). >> >> only for thoughts. >> >> +++ x/block/blk-sysfs.c >> @@ -800,9 +800,7 @@ static void blk_release_queue(struct kob >> >> might_sleep(); >> >> - if (test_bit(QUEUE_FLAG_POLL_STATS, &q->queue_flags)) >> - blk_stat_remove_callback(q, q->poll_cb); >> - blk_stat_free_callback(q->poll_cb); >> + rq_qos_exit(q); > > rq_qos_exit is already called in blk_cleanup_queue, and the blk-mq > pollig doesn't even use the qos framework. So I'm not sure what this > is supposed to help. I'm seeing a similar crash in our CI: [ 464.072042] nbd0: detected capacity change from 0 to 2097152 [ 464.092297] nbd0: p1 [ 464.244242] EXT4-fs (nbd0p1): mounted filesystem with ordered data mode. Opts: (null). Quota mode: none. [ 468.266306] block nbd0: NBD_DISCONNECT [ 468.266318] block nbd0: Disconnected due to user request. [ 468.266320] block nbd0: shutting down sockets [ 468.291814] Unable to handle kernel pointer dereference in virtual kernel address space [ 468.291817] Failing address: 000002aa264a7000 TEID: 000002aa264a7803 [ 468.291819] Fault in home space mode while using kernel ASCE. [ 468.291822] AS:0000000159c84007 R3:0000000000000024 [ 468.291843] Oops: 003b ilc:3 [#1] SMP [ 468.291846] Modules linked in: nbd(E-) xt_CHECKSUM(E) xt_MASQUERADE(E) xt_conntrack(E) ipt_REJECT(E) xt_tcpudp(E) nft_compat(E) nf_nat_tftp(E) nft_objref(E) nf_conntrack_tftp(E) nft_counter(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) dm_service_time(E) nft_chain_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) ip_set(E) nf_tables(E) nfnetlink(E) sunrpc(E) zfcp(E) scsi_transport_fc(E) dm_multipath(E) scsi_dh_rdac(E) scsi_dh_emc(E) scsi_dh_alua(E) mlx5_ib(E) ib_uverbs(E) ib_core(E) s390_trng(E) vfio_ccw(E) mdev(E) vfio_iommu_type1(E) vfio(E) zcrypt_cex4(E) eadm_sch(E) sch_fq_codel(E) configfs(E) ip_tables(E) x_tables(E) ghash_s390(E) prng(E) aes_s390(E) des_s390(E) libdes(E) sha3_512_s390(E) sha3_256_s390(E) sha512_s390(E) sha256_s390(E) sha1_s390(E) sha_common(E) mlx5_core(E) nvme(E) nvme_core(E) pkey(E) zcrypt(E) rng_core(E) autofs4(E) [ 468.291891] CPU: 4 PID: 0 Comm: swapper/4 Tainted: G E 5.14.0-20210819.rc6.git0.f26c3abc432a.300.fc34.s390x+next #1 [ 468.291894] Hardware name: IBM 8561 T01 703 (LPAR) [ 468.291895] Krnl PSW : 0704c00180000000 0000000158cfe3b6 (wb_timer_fn+0x56/0x538) [ 468.291902] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 [ 468.291905] Krnl GPRS: 0000000000000200 000002aa264a7018 0000000189fc3400 0000000000000000 [ 468.291907] fffffffffffc0000 0000000000000000 00000002f767c000 0000000158cc9420 [ 468.291909] 0000000000000000 0000000189fc3410 00000001e19622a0 0000000138e9a700 [ 468.291911] 0000000080378000 00000002f767c002 0000038000d43ca0 0000038000d43c40 [ 468.291937] Krnl Code: 0000000158cfe3a4: e380b0280004 lg %r8,40(%r11) 0000000158cfe3aa: e31010900004 lg %r1,144(%r1) #0000000158cfe3b0: e31012000004 lg %r1,512(%r1) >0000000158cfe3b6: e36010980004 lg %r6,152(%r1) 0000000158cfe3bc: ec88005e007c cgij %r8,0,8,0000000158cfe478 0000000158cfe3c2: e310b0300002 ltg %r1,48(%r11) 0000000158cfe3c8: a7840058 brc 8,0000000158cfe478 0000000158cfe3cc: c0e5ffce8822 brasl %r14,00000001586cf410 [ 468.291951] Call Trace: [ 468.291953] [<0000000158cfe3b6>] wb_timer_fn+0x56/0x538 [ 468.291956] [<00000001586ca980>] call_timer_fn+0x38/0x178 [ 468.291960] [<00000001586cad58>] __run_timers.part.0+0x298/0x358 [ 468.291962] [<00000001586cae62>] run_timer_softirq+0x4a/0x88 [ 468.291964] [<0000000159149236>] __do_softirq+0x146/0x3c8 [ 468.291967] [<000000015862cbaa>] irq_exit+0xf2/0x120 [ 468.291970] [<000000015913a334>] do_ext_irq+0xd4/0x160 [ 468.291972] [<000000015914769c>] ext_int_handler+0xdc/0x110 [ 468.291974] [<0000000159147826>] psw_idle_exit+0x0/0xa [ 468.291976] ([<00000001585dbfe8>] arch_cpu_idle+0x40/0xd0) [ 468.291978] [<000000015914718a>] default_idle_call+0x42/0x108 [ 468.291980] [<000000015866ab6a>] do_idle+0xd2/0x160 [ 468.291983] [<000000015866adb6>] cpu_startup_entry+0x36/0x40 [ 468.291985] [<00000001585ef74e>] smp_start_secondary+0x86/0x90 [ 468.291987] Last Breaking-Event-Address: [ 468.291989] [<0000038000d43d30>] 0x38000d43d30 [ 468.291992] Kernel panic - not syncing: Fatal exception in interrupt The crash is likely triggered by nbd. wb_timer_fn+0x56 is block/blk-wbt.c: 237 like in the syzbot reported crash. That line was just recently touched, so i wonder whether that's related? ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] general protection fault in wb_timer_fn 2021-08-19 9:03 ` Sven Schnelle @ 2021-08-19 9:05 ` Christoph Hellwig 2021-08-19 9:10 ` Sven Schnelle 2021-08-19 13:10 ` Sven Schnelle 0 siblings, 2 replies; 10+ messages in thread From: Christoph Hellwig @ 2021-08-19 9:05 UTC (permalink / raw) To: Sven Schnelle Cc: Christoph Hellwig, Hillf Danton, syzbot, axboe, linux-block, linux-kernel, syzkaller-bugs On Thu, Aug 19, 2021 at 11:03:42AM +0200, Sven Schnelle wrote: > I'm seeing a similar crash in our CI: This series: https://lore.kernel.org/linux-block/20210816131910.615153-1-hch@lst.de/T/#t should fi it. Can you give it a spin? ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] general protection fault in wb_timer_fn 2021-08-19 9:05 ` Christoph Hellwig @ 2021-08-19 9:10 ` Sven Schnelle 2021-08-19 13:10 ` Sven Schnelle 1 sibling, 0 replies; 10+ messages in thread From: Sven Schnelle @ 2021-08-19 9:10 UTC (permalink / raw) To: Christoph Hellwig Cc: Hillf Danton, syzbot, axboe, linux-block, linux-kernel, syzkaller-bugs Christoph Hellwig <hch@lst.de> writes: > On Thu, Aug 19, 2021 at 11:03:42AM +0200, Sven Schnelle wrote: >> I'm seeing a similar crash in our CI: > > This series: > > https://lore.kernel.org/linux-block/20210816131910.615153-1-hch@lst.de/T/#t > > should fi it. Can you give it a spin? Yes. I'll try to reproduce it outside of CI and test the patch set. Thanks! ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] general protection fault in wb_timer_fn 2021-08-19 9:05 ` Christoph Hellwig 2021-08-19 9:10 ` Sven Schnelle @ 2021-08-19 13:10 ` Sven Schnelle 2021-08-19 13:53 ` Christoph Hellwig 1 sibling, 1 reply; 10+ messages in thread From: Sven Schnelle @ 2021-08-19 13:10 UTC (permalink / raw) To: Christoph Hellwig Cc: Hillf Danton, syzbot, axboe, linux-block, linux-kernel, syzkaller-bugs Christoph Hellwig <hch@lst.de> writes: > On Thu, Aug 19, 2021 at 11:03:42AM +0200, Sven Schnelle wrote: >> I'm seeing a similar crash in our CI: > > This series: > > https://lore.kernel.org/linux-block/20210816131910.615153-1-hch@lst.de/T/#t > > should fi it. Can you give it a spin? I tested it without your patchset and it crashed around every second try. With that patchset, i wasn't able to reproduce it. Thanks! Sven ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] general protection fault in wb_timer_fn 2021-08-19 13:10 ` Sven Schnelle @ 2021-08-19 13:53 ` Christoph Hellwig 2021-08-21 7:48 ` Yi Zhang 0 siblings, 1 reply; 10+ messages in thread From: Christoph Hellwig @ 2021-08-19 13:53 UTC (permalink / raw) To: Sven Schnelle Cc: Christoph Hellwig, Hillf Danton, syzbot, axboe, linux-block, linux-kernel, syzkaller-bugs On Thu, Aug 19, 2021 at 03:10:37PM +0200, Sven Schnelle wrote: > Christoph Hellwig <hch@lst.de> writes: > > > On Thu, Aug 19, 2021 at 11:03:42AM +0200, Sven Schnelle wrote: > >> I'm seeing a similar crash in our CI: > > > > This series: > > > > https://lore.kernel.org/linux-block/20210816131910.615153-1-hch@lst.de/T/#t > > > > should fi it. Can you give it a spin? > > I tested it without your patchset and it crashed around every second > try. With that patchset, i wasn't able to reproduce it. Can you send a Tested-by: for the last patch which should fix this? ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] general protection fault in wb_timer_fn 2021-08-19 13:53 ` Christoph Hellwig @ 2021-08-21 7:48 ` Yi Zhang 2021-08-24 7:23 ` Christoph Hellwig 0 siblings, 1 reply; 10+ messages in thread From: Yi Zhang @ 2021-08-21 7:48 UTC (permalink / raw) To: Christoph Hellwig Cc: Sven Schnelle, Hillf Danton, syzbot, Jens Axboe, linux-block, linux-kernel, syzkaller-bugs On Thu, Aug 19, 2021 at 9:53 PM Christoph Hellwig <hch@lst.de> wrote: > > On Thu, Aug 19, 2021 at 03:10:37PM +0200, Sven Schnelle wrote: > > Christoph Hellwig <hch@lst.de> writes: > > > > > On Thu, Aug 19, 2021 at 11:03:42AM +0200, Sven Schnelle wrote: > > >> I'm seeing a similar crash in our CI: > > > > > > This series: > > > > > > https://lore.kernel.org/linux-block/20210816131910.615153-1-hch@lst.de/T/#t > > > > > > should fi it. Can you give it a spin? > > > > I tested it without your patchset and it crashed around every second > > try. With that patchset, i wasn't able to reproduce it. > > Can you send a Tested-by: for the last patch which should fix this? > Hi Christoph I also met similar issue with blktests, I tried to apply the patchset but with no luck to apply them, any suggestions to fix it. [ 2464.154898] run blktests nvme/012 at 2021-08-20 21:20:29 [ 2464.192252] loop0: detected capacity change from 0 to 2097152 [ 2464.309275] nvmet: adding nsid 1 to subsystem blktests-subsystem-1 [ 2464.396464] nvmet: creating controller 1 for subsystem blktests-subsystem-1 for NQN nqn.2014-08.org.nvmexpress:uuid:a43453b4c0df4cb7bd2303f547ca0f22. [ 2464.410162] nvme nvme0: creating 128 I/O queues. [ 2464.425839] nvme nvme0: new ctrl: "blktests-subsystem-1" [ 2465.483434] XFS (nvme0n1): Mounting V5 Filesystem [ 2465.493142] XFS (nvme0n1): Ending clean mount [ 2465.498278] xfs filesystem being mounted at /mnt/blktests supports timestamps until 2038 (0x7fffffff) [ 2488.544383] XFS (nvme0n1): Unmounting Filesystem [ 2488.559652] nvme nvme0: Removing ctrl: NQN "blktests-subsystem-1" [ 2488.625086] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000308 [ 2488.633871] Mem abort info: [ 2488.636655] ESR = 0x96000004 [ 2488.639698] EC = 0x25: DABT (current EL), IL = 32 bits [ 2488.645000] SET = 0, FnV = 0 [ 2488.648044] EA = 0, S1PTW = 0 [ 2488.651173] FSC = 0x04: level 0 translation fault [ 2488.656039] Data abort info: [ 2488.658908] ISV = 0, ISS = 0x00000004 [ 2488.662732] CM = 0, WnR = 0 [ 2488.665689] user pgtable: 4k pages, 48-bit VAs, pgdp=00000008fd3a0000 [ 2488.672119] [0000000000000308] pgd=0000000000000000, p4d=0000000000000000 [ 2488.678903] Internal error: Oops: 96000004 [#1] SMP [ 2488.683770] Modules linked in: nvme_loop nvme_fabrics nvmet nvme_core loop dm_log_writes dm_flakey rfkill mlx5_ib ib_uverbs ib_core sunrpc coresight_etm4x i2c_smbus coresight_tpiu coresight_replicator coresight_tmc joydev mlx5_core mlxfw psample tls acpi_ipmi ipmi_ssif ipmi_devintf ipmi_msghandler coresight_funnel coresight thunderx2_pmu vfat fat fuse zram ip_tables xfs crct10dif_ce ast ghash_ce i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm_ttm_helper ttm drm gpio_xlp i2c_xlp9xx uas usb_storage aes_neon_bs [last unloaded: nvme_core] [ 2488.735491] CPU: 41 PID: 0 Comm: swapper/41 Not tainted 5.14.0-rc5 #1 [ 2488.751647] pstate: 20400009 (nzCv daif +PAN -UAO -TCO BTYPE=--) [ 2488.757641] pc : latency_exceeded+0x30/0x304 [ 2488.761905] lr : wb_timer_fn+0x48/0x1fc [ 2488.765730] sp : ffff800012b83d00 [ 2488.769031] x29: ffff800012b83d00 x28: ffff800011dc7000 x27: ffff800012b83e80 [ 2488.776156] x26: ffff800011886000 x25: 00000000000000e0 x24: 0000000000000028 [ 2488.783280] x23: ffffffffffffffff x22: ffff0008097ac900 x21: ffff0008097ade80 [ 2488.790404] x20: 0000000000000000 x19: ffff00080adfb300 x18: 0000000000000000 [ 2488.797528] x17: ffff800f4ac9a000 x16: ffff800012b84000 x15: 0000000000004000 [ 2488.804652] x14: 0000000000000000 x13: 0000000000000038 x12: 0000000000000040 [ 2488.811776] x11: 0000000000036e09 x10: ffff0008097ade80 x9 : ffff80001073074c [ 2488.818901] x8 : fffffbffec7ec0b0 x7 : 000000000000003f x6 : 0000000000000000 [ 2488.826024] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 [ 2488.833148] x2 : 0000000000000000 x1 : ffff0008097ade80 x0 : 0000000000000000 [ 2488.840273] Call trace: [ 2488.842707] latency_exceeded+0x30/0x304 [ 2488.846618] wb_timer_fn+0x48/0x1fc [ 2488.850095] blk_stat_timer_fn+0x170/0x190 [ 2488.854183] call_timer_fn+0x3c/0x17c [ 2488.857835] __run_timers.part.0+0x290/0x330 [ 2488.862092] run_timer_softirq+0x48/0x80 [ 2488.866002] __do_softirq+0x128/0x380 [ 2488.869653] __irq_exit_rcu+0x154/0x160 [ 2488.873482] irq_exit+0x1c/0x30 [ 2488.876612] handle_domain_irq+0x70/0x9c [ 2488.880525] gic_handle_irq+0x58/0xd8 [ 2488.884174] call_on_irq_stack+0x2c/0x38 [ 2488.888086] do_interrupt_handler+0x5c/0x70 [ 2488.892257] el1_interrupt+0x30/0x50 [ 2488.895824] el1h_64_irq_handler+0x18/0x24 [ 2488.899908] el1h_64_irq+0x7c/0x80 [ 2488.903297] arch_cpu_idle+0x18/0x2c [ 2488.906861] default_idle_call+0x4c/0x160 [ 2488.910860] cpuidle_idle_call+0x14c/0x1a0 [ 2488.914947] do_idle+0xbc/0x110 [ 2488.918077] cpu_startup_entry+0x30/0x8c [ 2488.921988] secondary_start_kernel+0xec/0x110 [ 2488.926422] __secondary_switched+0x94/0x98 [ 2488.930596] Code: aa0103f5 f9403000 f9401674 f9404800 (f9418400) [ 2488.936789] ---[ end trace 8d092c5fdd268b3c ]--- [ 2488.941394] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 2488.948283] SMP: stopping secondary CPUs [ 2488.952240] Kernel Offset: disabled [ 2488.955715] CPU features: 0x00600051,a3200840 [ 2488.960059] Memory Limit: none [ 2488.963125] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- -- Best Regards, Yi Zhang ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] general protection fault in wb_timer_fn 2021-08-21 7:48 ` Yi Zhang @ 2021-08-24 7:23 ` Christoph Hellwig 2021-08-25 5:59 ` Yi Zhang 0 siblings, 1 reply; 10+ messages in thread From: Christoph Hellwig @ 2021-08-24 7:23 UTC (permalink / raw) To: Yi Zhang Cc: Christoph Hellwig, Sven Schnelle, Hillf Danton, syzbot, Jens Axboe, linux-block, linux-kernel, syzkaller-bugs On Sat, Aug 21, 2021 at 03:48:01PM +0800, Yi Zhang wrote: > I also met similar issue with blktests, I tried to apply the patchset > but with no luck to apply them, any suggestions to fix it. Please just retests the latest for-5.15/block or for-next branch in Jens' tree. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] general protection fault in wb_timer_fn 2021-08-24 7:23 ` Christoph Hellwig @ 2021-08-25 5:59 ` Yi Zhang 0 siblings, 0 replies; 10+ messages in thread From: Yi Zhang @ 2021-08-25 5:59 UTC (permalink / raw) To: Christoph Hellwig Cc: Sven Schnelle, Hillf Danton, syzbot, Jens Axboe, linux-block, linux-kernel, syzkaller-bugs On Tue, Aug 24, 2021 at 3:23 PM Christoph Hellwig <hch@lst.de> wrote: > > On Sat, Aug 21, 2021 at 03:48:01PM +0800, Yi Zhang wrote: > > I also met similar issue with blktests, I tried to apply the patchset > > but with no luck to apply them, any suggestions to fix it. > > Please just retests the latest for-5.15/block or for-next branch in > Jens' tree. > Yeah, the issue was fixed with for-5.15/block -- Best Regards, Yi Zhang ^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2021-08-25 5:59 UTC | newest] Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-08-14 11:57 [syzbot] general protection fault in wb_timer_fn syzbot [not found] ` <20210816091041.3313-1-hdanton@sina.com> 2021-08-16 9:33 ` Christoph Hellwig 2021-08-19 9:03 ` Sven Schnelle 2021-08-19 9:05 ` Christoph Hellwig 2021-08-19 9:10 ` Sven Schnelle 2021-08-19 13:10 ` Sven Schnelle 2021-08-19 13:53 ` Christoph Hellwig 2021-08-21 7:48 ` Yi Zhang 2021-08-24 7:23 ` Christoph Hellwig 2021-08-25 5:59 ` Yi Zhang
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).