[norov:smp4] [smp] 83790f0851: Oops:general_protection_fault,maybe_for_address#:#[##]SMP_PTI

[norov:smp4] [smp] 83790f0851: Oops:general_protection_fault,maybe_for_address#:#[##]SMP_PTI

[kernel test robot]

Hello,

kernel test robot noticed "Oops:general_protection_fault,maybe_for_address#:#[##]SMP_PTI" on:

commit: 83790f0851d200de2219cfed4b19fa7c2a8d62c0 ("smp: Don't wait until remote work done if not needed in smp_call_function_many_cond()")
https://github.com/norov/linux smp4

in testcase: will-it-scale
version: will-it-scale-x86_64-75f66e4-1_20241103
with following parameters:

	nr_task: 100%
	mode: thread
	test: tlb_flush3
	cpufreq_governor: performance



config: x86_64-rhel-9.4
compiler: gcc-12
test machine: 104 threads 2 sockets (Skylake) with 192G memory

(please refer to attached dmesg/kmsg for entire log/backtrace)



If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202506301054.b89ea5bb-lkp@intel.com


[   40.288049][ T1345]
[   40.297880][ T3517] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1
[   40.789648][    C1] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1
[   42.734725][ T1345] LKP: stdout: 1300: Kernel tests: Boot OK!
[   42.734733][ T1345]
[   43.885512][   C78] Oops: general protection fault, maybe for address 0xffffc9000daa8f40: 0000 [#1] SMP PTI
[   43.895761][   C78] CPU: 78 UID: 0 PID: 4129 Comm: tlb_flush3_thre Tainted: G S                  6.16.0-rc2-00285-g83790f0851d2 #1 VOLUNTARY
[   43.909277][   C78] Tainted: [S]=CPU_OUT_OF_SPEC
[   43.914263][   C78] Hardware name: Intel Corporation S2600BT/S2600BT, BIOS SE5C620.86B.1D.01.0147.121320181755 12/13/2018
[ 43.925590][ C78] RIP: 0010:native_flush_tlb_one_user (kbuild/src/consumer/arch/x86/include/asm/invpcid.h:16 kbuild/src/consumer/arch/x86/include/asm/invpcid.h:29 kbuild/src/consumer/arch/x86/mm/tlb.c:1623) 
[ 43.932049][ C78] Code: 48 8b 0d 9d d8 12 02 f7 c2 00 00 02 00 74 36 48 0f ba e1 2a 73 2f 83 c0 01 48 89 7c 24 08 80 cc 08 0f b7 c0 48 89 04 24 31 c0 <66> 0f 38 82 04 24 48 8b 44 24 18 65 48 2b 05 7f d0 b9 02 75 1e c9
All code
========
   0:	48 8b 0d 9d d8 12 02 	mov    0x212d89d(%rip),%rcx        # 0x212d8a4
   7:	f7 c2 00 00 02 00    	test   $0x20000,%edx
   d:	74 36                	je     0x45
   f:	48 0f ba e1 2a       	bt     $0x2a,%rcx
  14:	73 2f                	jae    0x45
  16:	83 c0 01             	add    $0x1,%eax
  19:	48 89 7c 24 08       	mov    %rdi,0x8(%rsp)
  1e:	80 cc 08             	or     $0x8,%ah
  21:	0f b7 c0             	movzwl %ax,%eax
  24:	48 89 04 24          	mov    %rax,(%rsp)
  28:	31 c0                	xor    %eax,%eax
  2a:*	66 0f 38 82 04 24    	invpcid (%rsp),%rax		<-- trapping instruction
  30:	48 8b 44 24 18       	mov    0x18(%rsp),%rax
  35:	65 48 2b 05 7f d0 b9 	sub    %gs:0x2b9d07f(%rip),%rax        # 0x2b9d0bc
  3c:	02 
  3d:	75 1e                	jne    0x5d
  3f:	c9                   	leave

Code starting with the faulting instruction
===========================================
   0:	66 0f 38 82 04 24    	invpcid (%rsp),%rax
   6:	48 8b 44 24 18       	mov    0x18(%rsp),%rax
   b:	65 48 2b 05 7f d0 b9 	sub    %gs:0x2b9d07f(%rip),%rax        # 0x2b9d092
  12:	02 
  13:	75 1e                	jne    0x33
  15:	c9                   	leave
[   43.952240][   C78] RSP: 0018:ffffc9000daa8f40 EFLAGS: 00010046
[   43.958539][   C78] RAX: 0000000000000000 RBX: ffff8897e0e703c0 RCX: d39ffffb0002000f
[   43.966742][   C78] RDX: 00000000007726f0 RSI: 00007ffcebd0f000 RDI: 0000800000000000
[   43.974943][   C78] RBP: ffffc9000daa8f68 R08: 0000000000000002 R09: 0000000000000000
[   43.983138][   C78] R10: 0000000000000000 R11: ffffc9000daa8ff8 R12: 000000000000004e
[   43.991331][   C78] R13: 0000800000000000 R14: 00000000003017cf R15: 0000000000000068
[   43.999525][   C78] FS:  00007ffe977fe6c0(0000) GS:ffff88b019250000(0000) knlGS:0000000000000000
[   44.008671][   C78] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   44.015466][   C78] CR2: 00007ffd53e4d000 CR3: 0000000226b24005 CR4: 00000000007726f0
[   44.023649][   C78] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   44.031823][   C78] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   44.039983][   C78] PKRU: 55555554
[   44.043721][   C78] Call Trace:
[   44.047187][   C78]  <IRQ>
[ 44.050212][ C78] ? clockevents_program_event (kbuild/src/consumer/kernel/time/clockevents.c:334) 
[ 44.056108][ C78] flush_tlb_func (kbuild/src/consumer/arch/x86/include/asm/paravirt.h:85 kbuild/src/consumer/arch/x86/mm/tlb.c:1630 kbuild/src/consumer/arch/x86/mm/tlb.c:1251) 
[ 44.060961][ C78] ? __pfx_flush_tlb_func (kbuild/src/consumer/arch/x86/mm/tlb.c:1104) 
[ 44.066331][ C78] __flush_smp_call_function_queue (kbuild/src/consumer/kernel/smp.c:134 kbuild/src/consumer/kernel/smp.c:540) 


The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250630/202506301054.b89ea5bb-lkp@intel.com



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki