From: kernel test robot <oliver.sang@intel.com>
To: Harry Yoo <harry@kernel.org>
Cc: <oe-lkp@lists.linux.dev>, <lkp@intel.com>,
Danielle Constantino <dconstantino@meta.com>,
Shakeel Butt <shakeel.butt@linux.dev>, <linux-mm@kvack.org>,
<oliver.sang@intel.com>
Subject: [harry:kmalloc-no-objext-rfc-v1r1] [mm/slab] 6bc21472e7: BUG:kernel_NULL_pointer_dereference,address
Date: Thu, 9 Jul 2026 16:48:00 +0800 [thread overview]
Message-ID: <202607091002.cdfe5a08-lkp@intel.com> (raw)
Hello,
kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
commit: 6bc21472e7eb9f8c771ffdf86266aa6d9dcb1dac ("mm/slab: prevent unbounded recursion due to obj_exts in free path")
https://git.kernel.org/cgit/linux/kernel/git/harry/linux.git kmalloc-no-objext-rfc-v1r1
in testcase: boot
config: i386-randconfig-2006-20250804
compiler: gcc-14
test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 4G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202607091002.cdfe5a08-lkp@intel.com
[ 0.183091][ T0] BUG: kernel NULL pointer dereference, address: 0000000c
[ 0.183772][ T0] #PF: supervisor read access in kernel mode
[ 0.184312][ T0] #PF: error_code(0x0000) - not-present page
[ 0.184851][ T0] *pde = 00000000
[ 0.185186][ T0] Oops: Oops: 0000 [#1]
[ 0.185561][ T0] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.2.0-rc1+ #1 PREEMPT 27a7cd77b6ab41253c0455bf8bac7f75db905e14
[ 0.186647][ T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 0.187601][ T0] EIP: __kmalloc_flags_noprof (slub.c:5311 slub.c:5506)
[ 0.188122][ T0] Code: 7d d7 00 74 0a 84 d2 74 06 31 c0 89 df f3 aa ff 75 e8 89 da 89 f0 8b 4d dc e8 47 28 00 00 59 8b 45 e0 89 da ff 75 0c ff 75 dc <ff> 76 0c 8b 4d d8 e8 00 da ff ff 83 c4 0c eb 16 8d 45 e0 50 ff 75
All code
========
0: 7d d7 jge 0xffffffffffffffd9
2: 00 74 0a 84 add %dh,-0x7c(%rdx,%rcx,1)
6: d2 74 06 31 shlb %cl,0x31(%rsi,%rax,1)
a: c0 89 df f3 aa ff 75 rorb $0x75,-0x550c21(%rcx)
11: e8 89 da 89 f0 call 0xfffffffff089da9f
16: 8b 4d dc mov -0x24(%rbp),%ecx
19: e8 47 28 00 00 call 0x2865
1e: 59 pop %rcx
1f: 8b 45 e0 mov -0x20(%rbp),%eax
22: 89 da mov %ebx,%edx
24: ff 75 0c push 0xc(%rbp)
27: ff 75 dc push -0x24(%rbp)
2a:* ff 76 0c push 0xc(%rsi) <-- trapping instruction
2d: 8b 4d d8 mov -0x28(%rbp),%ecx
30: e8 00 da ff ff call 0xffffffffffffda35
35: 83 c4 0c add $0xc,%esp
38: eb 16 jmp 0x50
3a: 8d 45 e0 lea -0x20(%rbp),%eax
3d: 50 push %rax
3e: ff .byte 0xff
3f: 75 .byte 0x75
Code starting with the faulting instruction
===========================================
0: ff 76 0c push 0xc(%rsi)
3: 8b 4d d8 mov -0x28(%rbp),%ecx
6: e8 00 da ff ff call 0xffffffffffffda0b
b: 83 c4 0c add $0xc,%esp
e: eb 16 jmp 0x26
10: 8d 45 e0 lea -0x20(%rbp),%eax
13: 50 push %rax
14: ff .byte 0xff
15: 75 .byte 0x75
[ 0.189928][ T0] EAX: b11c8b96 EBX: 00000000 ECX: b18bdac5 EDX: 00000000
[ 0.190574][ T0] ESI: 00000000 EDI: 00000150 EBP: b1e17df0 ESP: b1e17db8
[ 0.191220][ T0] DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00210046
[ 0.191925][ T0] CR0: 80050033 CR2: 0000000c CR3: 0253b000 CR4: 00000090
[ 0.192579][ T0] Call Trace:
[ 0.192877][ T0] ? alloc_from_new_slab (linux/spinlock.h:408 slub.c:4416)
[ 0.193350][ T0] ? alloc_slab_obj_exts (slab.h:39 slub.c:2149)
[ 0.193823][ T0] alloc_slab_obj_exts (slab.h:39 slub.c:2149)
[ 0.194280][ T0] __alloc_tagging_slab_alloc_hook (slub.c:2329 slub.c:2358)
[ 0.194833][ T0] alloc_tagging_slab_alloc_hook (slub.c:2381)
[ 0.195372][ T0] __kmalloc_cache_node_noprof (slub.c:4596 slub.c:4893 slub.c:5482)
[ 0.195903][ T0] ? init_kmem_cache_nodes (linux/slab.h:1192 slub.c:7732)
[ 0.196400][ T0] init_kmem_cache_nodes (linux/slab.h:1192 slub.c:7732)
[ 0.196882][ T0] do_kmem_cache_create (slub.c:8646)
[ 0.197354][ T0] create_boot_cache (slab_common.c:717)
[ 0.197788][ T0] new_kmalloc_cache (slab_common.c:735 slab_common.c:996)
[ 0.198237][ T0] create_kmalloc_caches (slab_common.c:1019)
[ 0.198701][ T0] kmem_cache_init (slub.c:8555)
[ 0.199125][ T0] mm_core_init (mm_init.c:2728)
[ 0.199533][ T0] start_kernel (main.c:1034)
[ 0.199939][ T0] i386_start_kernel (x86/kernel/head32.c:79)
[ 0.200368][ T0] startup_32_smp (x86/kernel/head_32.S:292)
[ 0.200791][ T0] Modules linked in:
[ 0.201141][ T0] CR2: 000000000000000c
[ 0.201513][ T0] ---[ end trace 0000000000000000 ]---
[ 0.202004][ T0] EIP: __kmalloc_flags_noprof (slub.c:5311 slub.c:5506)
[ 0.202522][ T0] Code: 7d d7 00 74 0a 84 d2 74 06 31 c0 89 df f3 aa ff 75 e8 89 da 89 f0 8b 4d dc e8 47 28 00 00 59 8b 45 e0 89 da ff 75 0c ff 75 dc <ff> 76 0c 8b 4d d8 e8 00 da ff ff 83 c4 0c eb 16 8d 45 e0 50 ff 75
All code
========
0: 7d d7 jge 0xffffffffffffffd9
2: 00 74 0a 84 add %dh,-0x7c(%rdx,%rcx,1)
6: d2 74 06 31 shlb %cl,0x31(%rsi,%rax,1)
a: c0 89 df f3 aa ff 75 rorb $0x75,-0x550c21(%rcx)
11: e8 89 da 89 f0 call 0xfffffffff089da9f
16: 8b 4d dc mov -0x24(%rbp),%ecx
19: e8 47 28 00 00 call 0x2865
1e: 59 pop %rcx
1f: 8b 45 e0 mov -0x20(%rbp),%eax
22: 89 da mov %ebx,%edx
24: ff 75 0c push 0xc(%rbp)
27: ff 75 dc push -0x24(%rbp)
2a:* ff 76 0c push 0xc(%rsi) <-- trapping instruction
2d: 8b 4d d8 mov -0x28(%rbp),%ecx
30: e8 00 da ff ff call 0xffffffffffffda35
35: 83 c4 0c add $0xc,%esp
38: eb 16 jmp 0x50
3a: 8d 45 e0 lea -0x20(%rbp),%eax
3d: 50 push %rax
3e: ff .byte 0xff
3f: 75 .byte 0x75
Code starting with the faulting instruction
===========================================
0: ff 76 0c push 0xc(%rsi)
3: 8b 4d d8 mov -0x28(%rbp),%ecx
6: e8 00 da ff ff call 0xffffffffffffda0b
b: 83 c4 0c add $0xc,%esp
e: eb 16 jmp 0x26
10: 8d 45 e0 lea -0x20(%rbp),%eax
13: 50 push %rax
14: ff .byte 0xff
15: 75 .byte 0x75
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20260709/202607091002.cdfe5a08-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-07-09 8:48 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-09 8:48 kernel test robot [this message]
2026-07-09 9:26 ` [harry:kmalloc-no-objext-rfc-v1r1] [mm/slab] 6bc21472e7: BUG:kernel_NULL_pointer_dereference,address Harry Yoo
2026-07-10 7:21 ` Oliver Sang
2026-07-10 10:04 ` Harry Yoo
2026-07-12 8:14 ` Oliver Sang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202607091002.cdfe5a08-lkp@intel.com \
--to=oliver.sang@intel.com \
--cc=dconstantino@meta.com \
--cc=harry@kernel.org \
--cc=linux-mm@kvack.org \
--cc=lkp@intel.com \
--cc=oe-lkp@lists.linux.dev \
--cc=shakeel.butt@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.