* [viro-vfs:more.configfs] [configfs] 2bbdcd7eab: BUG:kernel_NULL_pointer_dereference,address
@ 2026-06-05 5:52 kernel test robot
2026-06-05 7:11 ` Al Viro
0 siblings, 1 reply; 3+ messages in thread
From: kernel test robot @ 2026-06-05 5:52 UTC (permalink / raw)
To: Al Viro; +Cc: oe-lkp, lkp, linux-fsdevel, oliver.sang
Hello,
kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
commit: 2bbdcd7eabfcd3a5bd2614ab75ece19323d5f4c2 ("configfs: attach the subtree only when it's completely built")
https://git.kernel.org/cgit/linux/kernel/git/viro/vfs.git more.configfs
in testcase: boot
config: i386-randconfig-013-20260604
compiler: gcc-14
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 32G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202606051115.319be2bc-lkp@intel.com
[ 6.464570][ T1] BUG: kernel NULL pointer dereference, address: 00000020
[ 6.465555][ T1] #PF: supervisor write access in kernel mode
[ 6.465555][ T1] #PF: error_code(0x0002) - not-present page
[ 6.465555][ T1] *pde = 00000000
[ 6.465555][ T1] Oops: Oops: 0002 [#1] SMP
[ 6.465555][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Tainted: G T 7.1.0-rc6-00030-g2bbdcd7eabfc #1 PREEMPT
[ 6.465555][ T1] Tainted: [T]=RANDSTRUCT
[ 6.465555][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 6.465555][ T1] EIP: configfs_register_group (configfs/dir.c:1607)
[ 6.465555][ T1] Code: 89 13 e8 ca 76 fb ff 89 c1 3d 00 f0 ff ff 77 2e 57 31 d2 89 45 ec 89 d8 e8 c8 fe ff ff 8b 4d ec 89 c6 58 85 f6 75 0a 8b 41 74 <81> 48 20 80 00 00 00 89 c8 e8 e1 76 fb ff 85 f6 75 04 eb 1b 89 c6
All code
========
0: 89 13 mov %edx,(%rbx)
2: e8 ca 76 fb ff call 0xfffffffffffb76d1
7: 89 c1 mov %eax,%ecx
9: 3d 00 f0 ff ff cmp $0xfffff000,%eax
e: 77 2e ja 0x3e
10: 57 push %rdi
11: 31 d2 xor %edx,%edx
13: 89 45 ec mov %eax,-0x14(%rbp)
16: 89 d8 mov %ebx,%eax
18: e8 c8 fe ff ff call 0xfffffffffffffee5
1d: 8b 4d ec mov -0x14(%rbp),%ecx
20: 89 c6 mov %eax,%esi
22: 58 pop %rax
23: 85 f6 test %esi,%esi
25: 75 0a jne 0x31
27: 8b 41 74 mov 0x74(%rcx),%eax
2a:* 81 48 20 80 00 00 00 orl $0x80,0x20(%rax) <-- trapping instruction
31: 89 c8 mov %ecx,%eax
33: e8 e1 76 fb ff call 0xfffffffffffb7719
38: 85 f6 test %esi,%esi
3a: 75 04 jne 0x40
3c: eb 1b jmp 0x59
3e: 89 c6 mov %eax,%esi
Code starting with the faulting instruction
===========================================
0: 81 48 20 80 00 00 00 orl $0x80,0x20(%rax)
7: 89 c8 mov %ecx,%eax
9: e8 e1 76 fb ff call 0xfffffffffffb76ef
e: 85 f6 test %esi,%esi
10: 75 04 jne 0x16
12: eb 1b jmp 0x2f
14: 89 c6 mov %eax,%esi
[ 6.465555][ T1] EAX: 00000000 EBX: b1832180 ECX: b3afc7d0 EDX: 00000000
[ 6.465555][ T1] ESI: 00000000 EDI: b183a180 EBP: b1149ec0 ESP: b1149eac
[ 6.465555][ T1] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 EFLAGS: 00010246
[ 6.465555][ T1] CR0: 80050033 CR2: 00000020 CR3: 1720f000 CR4: 000406d0
[ 6.465555][ T1] Call Trace:
[ 6.465555][ T1] configfs_register_default_group (configfs/dir.c:1683)
[ 6.465555][ T1] iio_sw_device_init (iio/industrialio-sw-device.c:164)
[ 6.465555][ T1] do_one_initcall (main.c:1392)
[ 6.465555][ T1] ? iio_configfs_init (industrialio-configfs.c:?)
[ 6.465555][ T1] do_initcalls (main.c:1454 (discriminator 1) main.c:1470 (discriminator 1))
[ 6.465555][ T1] kernel_init_freeable (main.c:1490 main.c:1703)
[ 6.465555][ T1] ? rest_init (main.c:762)
[ 6.465555][ T1] kernel_init (main.c:1593)
[ 6.465555][ T1] ret_from_fork (x86/kernel/process.c:158)
[ 6.465555][ T1] ? rest_init (main.c:762)
[ 6.465555][ T1] ret_from_fork_asm (x86/entry/entry_32.S:736)
[ 6.465555][ T1] entry_INT80_32 (x86/entry/entry_32.S:940)
[ 6.465555][ T1] Modules linked in:
[ 6.465555][ T1] CR2: 0000000000000020
[ 6.465555][ T1] ---[ end trace 0000000000000000 ]---
[ 6.465555][ T1] EIP: configfs_register_group (configfs/dir.c:1607)
[ 6.465555][ T1] Code: 89 13 e8 ca 76 fb ff 89 c1 3d 00 f0 ff ff 77 2e 57 31 d2 89 45 ec 89 d8 e8 c8 fe ff ff 8b 4d ec 89 c6 58 85 f6 75 0a 8b 41 74 <81> 48 20 80 00 00 00 89 c8 e8 e1 76 fb ff 85 f6 75 04 eb 1b 89 c6
All code
========
0: 89 13 mov %edx,(%rbx)
2: e8 ca 76 fb ff call 0xfffffffffffb76d1
7: 89 c1 mov %eax,%ecx
9: 3d 00 f0 ff ff cmp $0xfffff000,%eax
e: 77 2e ja 0x3e
10: 57 push %rdi
11: 31 d2 xor %edx,%edx
13: 89 45 ec mov %eax,-0x14(%rbp)
16: 89 d8 mov %ebx,%eax
18: e8 c8 fe ff ff call 0xfffffffffffffee5
1d: 8b 4d ec mov -0x14(%rbp),%ecx
20: 89 c6 mov %eax,%esi
22: 58 pop %rax
23: 85 f6 test %esi,%esi
25: 75 0a jne 0x31
27: 8b 41 74 mov 0x74(%rcx),%eax
2a:* 81 48 20 80 00 00 00 orl $0x80,0x20(%rax) <-- trapping instruction
31: 89 c8 mov %ecx,%eax
33: e8 e1 76 fb ff call 0xfffffffffffb7719
38: 85 f6 test %esi,%esi
3a: 75 04 jne 0x40
3c: eb 1b jmp 0x59
3e: 89 c6 mov %eax,%esi
Code starting with the faulting instruction
===========================================
0: 81 48 20 80 00 00 00 orl $0x80,0x20(%rax)
7: 89 c8 mov %ecx,%eax
9: e8 e1 76 fb ff call 0xfffffffffffb76ef
e: 85 f6 test %esi,%esi
10: 75 04 jne 0x16
12: eb 1b jmp 0x2f
14: 89 c6 mov %eax,%esi
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20260605/202606051115.319be2bc-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [viro-vfs:more.configfs] [configfs] 2bbdcd7eab: BUG:kernel_NULL_pointer_dereference,address
2026-06-05 5:52 [viro-vfs:more.configfs] [configfs] 2bbdcd7eab: BUG:kernel_NULL_pointer_dereference,address kernel test robot
@ 2026-06-05 7:11 ` Al Viro
2026-06-05 18:39 ` Al Viro
0 siblings, 1 reply; 3+ messages in thread
From: Al Viro @ 2026-06-05 7:11 UTC (permalink / raw)
To: kernel test robot; +Cc: oe-lkp, lkp, linux-fsdevel
On Fri, Jun 05, 2026 at 01:52:28PM +0800, kernel test robot wrote:
>
>
>
> Hello,
>
> kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
>
> commit: 2bbdcd7eabfcd3a5bd2614ab75ece19323d5f4c2 ("configfs: attach the subtree only when it's completely built")
> https://git.kernel.org/cgit/linux/kernel/git/viro/vfs.git more.configfs
>
> in testcase: boot
>
> config: i386-randconfig-013-20260604
> compiler: gcc-14
> test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 32G
>
> (please refer to attached dmesg/kmsg for entire log/backtrace)
D'oh... Minimal incremental to deal with that would probably be something like
the delta below, but it's probably better to have configfs_add_subtree() return
the resulting dentry instead...
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index dacf0187f814..da5e554de58f 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -1448,7 +1448,7 @@ int configfs_register_group(struct config_group *parent_group,
if (!IS_ERR(child)) {
ret = configfs_add_subtree(group, NULL, child, frag);
if (!ret) {
- sd = child->d_fsdata;
+ sd = group->cg_item.ci_dentry->d_fsdata;
sd->s_type |= CONFIGFS_USET_DEFAULT;
}
simple_done_creating(child);
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [viro-vfs:more.configfs] [configfs] 2bbdcd7eab: BUG:kernel_NULL_pointer_dereference,address
2026-06-05 7:11 ` Al Viro
@ 2026-06-05 18:39 ` Al Viro
0 siblings, 0 replies; 3+ messages in thread
From: Al Viro @ 2026-06-05 18:39 UTC (permalink / raw)
To: kernel test robot; +Cc: oe-lkp, lkp, linux-fsdevel
On Fri, Jun 05, 2026 at 08:11:12AM +0100, Al Viro wrote:
> On Fri, Jun 05, 2026 at 01:52:28PM +0800, kernel test robot wrote:
> >
> >
> >
> > Hello,
> >
> > kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
> >
> > commit: 2bbdcd7eabfcd3a5bd2614ab75ece19323d5f4c2 ("configfs: attach the subtree only when it's completely built")
> > https://git.kernel.org/cgit/linux/kernel/git/viro/vfs.git more.configfs
> >
> > in testcase: boot
> >
> > config: i386-randconfig-013-20260604
> > compiler: gcc-14
> > test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 32G
> >
> > (please refer to attached dmesg/kmsg for entire log/backtrace)
>
> D'oh... Minimal incremental to deal with that would probably be something like
> the delta below, but it's probably better to have configfs_add_subtree() return
> the resulting dentry instead...
... as in updated (and force-pushed) branch.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-06-05 18:39 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-05 5:52 [viro-vfs:more.configfs] [configfs] 2bbdcd7eab: BUG:kernel_NULL_pointer_dereference,address kernel test robot
2026-06-05 7:11 ` Al Viro
2026-06-05 18:39 ` Al Viro
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.