[linux-next:master] [fs] cdc4ad36a8: kernel_BUG_at_include/linux/page-flags.h

[kernel test robot <oliver.sang@intel.com>]

Hello,

kernel test robot noticed "kernel_BUG_at_include/linux/page-flags.h" on:

commit: cdc4ad36a871b7ac43fcc6b2891058d332ce60ce ("fs: Convert aops->write_begin to take a folio")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master

[test failed on linux-next/master 1e391b34f6aa043c7afa40a2103163a0ef06d179]

in testcase: boot

compiler: clang-18
test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 4G

(please refer to attached dmesg/kmsg for entire log/backtrace)


+------------------------------------------+------------+------------+
|                                          | 300dd0fa8e | cdc4ad36a8 |
+------------------------------------------+------------+------------+
| boot_successes                           | 36         | 0          |
| boot_failures                            | 0          | 36         |
| kernel_BUG_at_include/linux/page-flags.h | 0          | 36         |
| Oops:invalid_opcode:#[##]PREEMPT         | 0          | 36         |
| EIP:shmem_write_begin                    | 0          | 36         |
| Kernel_panic-not_syncing:Fatal_exception | 0          | 36         |
+------------------------------------------+------------+------------+


If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202408062249.2194d51b-lkp@intel.com


[   11.817454][  T102] ------------[ cut here ]------------
[   11.818309][  T102] kernel BUG at include/linux/page-flags.h:308!
[   11.825783][  T103] aops:shmem_aops ino:8 dentry name:"n2.tmp"
[   11.826808][  T102] Oops: invalid opcode: 0000 [#1] PREEMPT
[   11.827585][  T102] CPU: 0 UID: 0 PID: 102 Comm: udevd Not tainted 6.10.0-12082-gcdc4ad36a871 #1 bef0abbc1afe2d2f07a6410b59dcdae1fe513b9d
[   11.829082][  T102] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 11.830495][ T102] EIP: shmem_write_begin (include/linux/page-flags.h:308) 
[ 11.831231][ T102] Code: 62 ff ff ff 8b 7d 10 01 f7 89 d3 83 d3 00 39 79 34 8b 79 38 19 df 0f 8d 4a ff ff ff eb cb 89 f0 ba 0b 15 3b c2 e8 ec 60 01 00 <0f> 0b 68 18 5c ad c2 e8 d0 fe 6a 00 89 f0 ba f6 f4 3a c2 e8 d4 60
All code
========
   0:	62                   	(bad)
   1:	ff                   	(bad)
   2:	ff                   	(bad)
   3:	ff 8b 7d 10 01 f7    	decl   -0x8feef83(%rbx)
   9:	89 d3                	mov    %edx,%ebx
   b:	83 d3 00             	adc    $0x0,%ebx
   e:	39 79 34             	cmp    %edi,0x34(%rcx)
  11:	8b 79 38             	mov    0x38(%rcx),%edi
  14:	19 df                	sbb    %ebx,%edi
  16:	0f 8d 4a ff ff ff    	jge    0xffffffffffffff66
  1c:	eb cb                	jmp    0xffffffffffffffe9
  1e:	89 f0                	mov    %esi,%eax
  20:	ba 0b 15 3b c2       	mov    $0xc23b150b,%edx
  25:	e8 ec 60 01 00       	call   0x16116
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	68 18 5c ad c2       	push   $0xffffffffc2ad5c18
  31:	e8 d0 fe 6a 00       	call   0x6aff06
  36:	89 f0                	mov    %esi,%eax
  38:	ba f6 f4 3a c2       	mov    $0xc23af4f6,%edx
  3d:	e8                   	.byte 0xe8
  3e:	d4                   	(bad)
  3f:	60                   	(bad)

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	68 18 5c ad c2       	push   $0xffffffffc2ad5c18
   7:	e8 d0 fe 6a 00       	call   0x6afedc
   c:	89 f0                	mov    %esi,%eax
   e:	ba f6 f4 3a c2       	mov    $0xc23af4f6,%edx
  13:	e8                   	.byte 0xe8
  14:	d4                   	(bad)
  15:	60                   	(bad)
[   11.833693][  T102] EAX: 00000000 EBX: 00000001 ECX: 00000000 EDX: 00000000
[   11.834656][  T102] ESI: e7a1f820 EDI: ebad5ac0 EBP: eb4fdd20 ESP: eb4fdd10
[   11.835648][  T102] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010282
[   11.836740][  T102] CR0: 80050033 CR2: 00fb121c CR3: 2b40a000 CR4: 000406d0
[   11.837714][  T102] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[   11.838683][  T102] DR6: fffe0ff0 DR7: 00000400
[   11.839367][  T102] Call Trace:
[ 11.839909][ T102] ? __die_body (arch/x86/kernel/dumpstack.c:478 arch/x86/kernel/dumpstack.c:420) 
[ 11.840561][ T102] ? die (arch/x86/kernel/dumpstack.c:447) 
[ 11.841150][ T102] ? do_trap (arch/x86/kernel/traps.c:? arch/x86/kernel/traps.c:155) 
[ 11.841736][ T102] ? do_error_trap (arch/x86/kernel/traps.c:175) 
[ 11.842383][ T102] ? shmem_write_begin (include/linux/page-flags.h:308) 
[ 11.843047][ T102] ? shmem_write_begin (include/linux/page-flags.h:308) 
[ 11.843761][ T102] ? exc_overflow (arch/x86/kernel/traps.c:252) 
[ 11.844444][ T102] ? handle_invalid_op (arch/x86/kernel/traps.c:212) 
[ 11.845176][ T102] ? shmem_write_begin (include/linux/page-flags.h:308) 
[ 11.845918][ T102] ? exc_invalid_op (arch/x86/kernel/traps.c:267) 
[ 11.846634][ T102] ? handle_exception (arch/x86/entry/entry_32.S:1047) 
[ 11.847347][ T102] ? lru_lazyfree_fn (include/linux/list.h:124 include/linux/list.h:215 include/linux/list.h:229 include/linux/mm_inline.h:355 mm/swap.c:633) 
[ 11.848042][ T102] ? exc_overflow (arch/x86/kernel/traps.c:252) 
[ 11.848686][ T102] ? shmem_write_begin (include/linux/page-flags.h:308) 
[ 11.849348][ T102] ? lru_lazyfree_fn (include/linux/list.h:124 include/linux/list.h:215 include/linux/list.h:229 include/linux/mm_inline.h:355 mm/swap.c:633) 
[ 11.850008][ T102] ? exc_overflow (arch/x86/kernel/traps.c:252) 
[ 11.850650][ T102] ? shmem_write_begin (include/linux/page-flags.h:308) 
[ 11.851371][ T102] generic_perform_write (mm/filemap.c:4018) 
[ 11.852110][ T102] shmem_file_write_iter (mm/shmem.c:?) 
[ 11.852790][ T102] vfs_write (fs/read_write.c:498) 
[ 11.853346][ T102] ? kmem_cache_free (mm/slub.c:4425) 
[ 11.853945][ T102] ? shmem_file_read_iter (mm/shmem.c:3061) 
[ 11.854693][ T102] ksys_write (fs/read_write.c:643) 
[ 11.855325][ T102] __ia32_sys_write (fs/read_write.c:652) 
[ 11.856005][ T102] ia32_sys_call (arch/x86/entry/syscall_32.c:44) 
[ 11.856683][ T102] do_int80_syscall_32 (arch/x86/entry/common.c:?) 
[ 11.857375][ T102] ? syscall_exit_to_user_mode (kernel/entry/common.c:221) 
[ 11.858131][ T102] ? do_int80_syscall_32 (arch/x86/entry/common.c:343) 
[ 11.858864][ T102] ? free_to_partial_list (mm/slub.c:4265) 
[ 11.859637][ T102] ? __slab_free (mm/slub.c:4291) 
[ 11.860288][ T102] ? do_mkdirat (fs/namei.c:4243) 
[ 11.860926][ T102] ? mntput_no_expire (fs/namespace.c:1460) 
[ 11.861609][ T102] ? kmem_cache_free (mm/slub.c:4425) 
[ 11.865615][ T102] ? do_mkdirat (fs/namei.c:4243) 
[ 11.866331][ T102] ? do_mkdirat (fs/namei.c:4243) 
[ 11.866989][ T102] ? syscall_exit_to_user_mode (kernel/entry/common.c:221) 
[ 11.867783][ T102] ? do_int80_syscall_32 (arch/x86/entry/common.c:343) 
[ 11.868435][ T102] ? irqentry_exit_to_user_mode (kernel/entry/common.c:234) 
[ 11.869221][ T102] ? do_fast_syscall_32 (arch/x86/entry/common.c:411) 
[ 11.869855][ T102] entry_INT80_32 (arch/x86/entry/entry_32.S:944) 
[   11.870507][  T102] EIP: 0xb7e536c2
[ 11.871050][ T102] Code: 90 66 90 66 90 66 90 90 56 53 83 ec 14 8b 5c 24 20 8b 4c 24 24 8b 54 24 28 65 a1 0c 00 00 00 85 c0 75 15 b8 04 00 00 00 cd 80 <3d> 00 f0 ff ff 77 47 83 c4 14 5b 5e c3 90 89 54 24 0c 89 4c 24 08
All code
========
   0:	90                   	nop
   1:	66 90                	xchg   %ax,%ax
   3:	66 90                	xchg   %ax,%ax
   5:	66 90                	xchg   %ax,%ax
   7:	90                   	nop
   8:	56                   	push   %rsi
   9:	53                   	push   %rbx
   a:	83 ec 14             	sub    $0x14,%esp
   d:	8b 5c 24 20          	mov    0x20(%rsp),%ebx
  11:	8b 4c 24 24          	mov    0x24(%rsp),%ecx
  15:	8b 54 24 28          	mov    0x28(%rsp),%edx
  19:	65 a1 0c 00 00 00 85 	movabs %gs:0x1575c0850000000c,%eax
  20:	c0 75 15 
  23:	b8 04 00 00 00       	mov    $0x4,%eax
  28:	cd 80                	int    $0x80
  2a:*	3d 00 f0 ff ff       	cmp    $0xfffff000,%eax		<-- trapping instruction
  2f:	77 47                	ja     0x78
  31:	83 c4 14             	add    $0x14,%esp
  34:	5b                   	pop    %rbx
  35:	5e                   	pop    %rsi
  36:	c3                   	ret
  37:	90                   	nop
  38:	89 54 24 0c          	mov    %edx,0xc(%rsp)
  3c:	89 4c 24 08          	mov    %ecx,0x8(%rsp)

Code starting with the faulting instruction
===========================================
   0:	3d 00 f0 ff ff       	cmp    $0xfffff000,%eax
   5:	77 47                	ja     0x4e
   7:	83 c4 14             	add    $0x14,%esp
   a:	5b                   	pop    %rbx
   b:	5e                   	pop    %rsi
   c:	c3                   	ret
   d:	90                   	nop
   e:	89 54 24 0c          	mov    %edx,0xc(%rsp)
  12:	89 4c 24 08          	mov    %ecx,0x8(%rsp)


The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20240806/202408062249.2194d51b-lkp@intel.com



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki