From: kernel test robot <oliver.sang@intel.com>
To: Harry Yoo <harry@kernel.org>
Cc: <oe-lkp@lists.linux.dev>, <lkp@intel.com>,
Danielle Constantino <dconstantino@meta.com>,
Shakeel Butt <shakeel.butt@linux.dev>, <linux-mm@kvack.org>,
<oliver.sang@intel.com>
Subject: [harry:kmalloc-no-objext-rfc-v1r1] [mm/slab] 6bc21472e7: BUG:kernel_NULL_pointer_dereference,address
Date: Thu, 9 Jul 2026 16:48:00 +0800 [thread overview]
Message-ID: <202607091002.cdfe5a08-lkp@intel.com> (raw)
Hello,
kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
commit: 6bc21472e7eb9f8c771ffdf86266aa6d9dcb1dac ("mm/slab: prevent unbounded recursion due to obj_exts in free path")
https://git.kernel.org/cgit/linux/kernel/git/harry/linux.git kmalloc-no-objext-rfc-v1r1
in testcase: boot
config: i386-randconfig-2006-20250804
compiler: gcc-14
test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 4G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202607091002.cdfe5a08-lkp@intel.com
[ 0.183091][ T0] BUG: kernel NULL pointer dereference, address: 0000000c
[ 0.183772][ T0] #PF: supervisor read access in kernel mode
[ 0.184312][ T0] #PF: error_code(0x0000) - not-present page
[ 0.184851][ T0] *pde = 00000000
[ 0.185186][ T0] Oops: Oops: 0000 [#1]
[ 0.185561][ T0] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.2.0-rc1+ #1 PREEMPT 27a7cd77b6ab41253c0455bf8bac7f75db905e14
[ 0.186647][ T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 0.187601][ T0] EIP: __kmalloc_flags_noprof (slub.c:5311 slub.c:5506)
[ 0.188122][ T0] Code: 7d d7 00 74 0a 84 d2 74 06 31 c0 89 df f3 aa ff 75 e8 89 da 89 f0 8b 4d dc e8 47 28 00 00 59 8b 45 e0 89 da ff 75 0c ff 75 dc <ff> 76 0c 8b 4d d8 e8 00 da ff ff 83 c4 0c eb 16 8d 45 e0 50 ff 75
All code
========
0: 7d d7 jge 0xffffffffffffffd9
2: 00 74 0a 84 add %dh,-0x7c(%rdx,%rcx,1)
6: d2 74 06 31 shlb %cl,0x31(%rsi,%rax,1)
a: c0 89 df f3 aa ff 75 rorb $0x75,-0x550c21(%rcx)
11: e8 89 da 89 f0 call 0xfffffffff089da9f
16: 8b 4d dc mov -0x24(%rbp),%ecx
19: e8 47 28 00 00 call 0x2865
1e: 59 pop %rcx
1f: 8b 45 e0 mov -0x20(%rbp),%eax
22: 89 da mov %ebx,%edx
24: ff 75 0c push 0xc(%rbp)
27: ff 75 dc push -0x24(%rbp)
2a:* ff 76 0c push 0xc(%rsi) <-- trapping instruction
2d: 8b 4d d8 mov -0x28(%rbp),%ecx
30: e8 00 da ff ff call 0xffffffffffffda35
35: 83 c4 0c add $0xc,%esp
38: eb 16 jmp 0x50
3a: 8d 45 e0 lea -0x20(%rbp),%eax
3d: 50 push %rax
3e: ff .byte 0xff
3f: 75 .byte 0x75
Code starting with the faulting instruction
===========================================
0: ff 76 0c push 0xc(%rsi)
3: 8b 4d d8 mov -0x28(%rbp),%ecx
6: e8 00 da ff ff call 0xffffffffffffda0b
b: 83 c4 0c add $0xc,%esp
e: eb 16 jmp 0x26
10: 8d 45 e0 lea -0x20(%rbp),%eax
13: 50 push %rax
14: ff .byte 0xff
15: 75 .byte 0x75
[ 0.189928][ T0] EAX: b11c8b96 EBX: 00000000 ECX: b18bdac5 EDX: 00000000
[ 0.190574][ T0] ESI: 00000000 EDI: 00000150 EBP: b1e17df0 ESP: b1e17db8
[ 0.191220][ T0] DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00210046
[ 0.191925][ T0] CR0: 80050033 CR2: 0000000c CR3: 0253b000 CR4: 00000090
[ 0.192579][ T0] Call Trace:
[ 0.192877][ T0] ? alloc_from_new_slab (linux/spinlock.h:408 slub.c:4416)
[ 0.193350][ T0] ? alloc_slab_obj_exts (slab.h:39 slub.c:2149)
[ 0.193823][ T0] alloc_slab_obj_exts (slab.h:39 slub.c:2149)
[ 0.194280][ T0] __alloc_tagging_slab_alloc_hook (slub.c:2329 slub.c:2358)
[ 0.194833][ T0] alloc_tagging_slab_alloc_hook (slub.c:2381)
[ 0.195372][ T0] __kmalloc_cache_node_noprof (slub.c:4596 slub.c:4893 slub.c:5482)
[ 0.195903][ T0] ? init_kmem_cache_nodes (linux/slab.h:1192 slub.c:7732)
[ 0.196400][ T0] init_kmem_cache_nodes (linux/slab.h:1192 slub.c:7732)
[ 0.196882][ T0] do_kmem_cache_create (slub.c:8646)
[ 0.197354][ T0] create_boot_cache (slab_common.c:717)
[ 0.197788][ T0] new_kmalloc_cache (slab_common.c:735 slab_common.c:996)
[ 0.198237][ T0] create_kmalloc_caches (slab_common.c:1019)
[ 0.198701][ T0] kmem_cache_init (slub.c:8555)
[ 0.199125][ T0] mm_core_init (mm_init.c:2728)
[ 0.199533][ T0] start_kernel (main.c:1034)
[ 0.199939][ T0] i386_start_kernel (x86/kernel/head32.c:79)
[ 0.200368][ T0] startup_32_smp (x86/kernel/head_32.S:292)
[ 0.200791][ T0] Modules linked in:
[ 0.201141][ T0] CR2: 000000000000000c
[ 0.201513][ T0] ---[ end trace 0000000000000000 ]---
[ 0.202004][ T0] EIP: __kmalloc_flags_noprof (slub.c:5311 slub.c:5506)
[ 0.202522][ T0] Code: 7d d7 00 74 0a 84 d2 74 06 31 c0 89 df f3 aa ff 75 e8 89 da 89 f0 8b 4d dc e8 47 28 00 00 59 8b 45 e0 89 da ff 75 0c ff 75 dc <ff> 76 0c 8b 4d d8 e8 00 da ff ff 83 c4 0c eb 16 8d 45 e0 50 ff 75
All code
========
0: 7d d7 jge 0xffffffffffffffd9
2: 00 74 0a 84 add %dh,-0x7c(%rdx,%rcx,1)
6: d2 74 06 31 shlb %cl,0x31(%rsi,%rax,1)
a: c0 89 df f3 aa ff 75 rorb $0x75,-0x550c21(%rcx)
11: e8 89 da 89 f0 call 0xfffffffff089da9f
16: 8b 4d dc mov -0x24(%rbp),%ecx
19: e8 47 28 00 00 call 0x2865
1e: 59 pop %rcx
1f: 8b 45 e0 mov -0x20(%rbp),%eax
22: 89 da mov %ebx,%edx
24: ff 75 0c push 0xc(%rbp)
27: ff 75 dc push -0x24(%rbp)
2a:* ff 76 0c push 0xc(%rsi) <-- trapping instruction
2d: 8b 4d d8 mov -0x28(%rbp),%ecx
30: e8 00 da ff ff call 0xffffffffffffda35
35: 83 c4 0c add $0xc,%esp
38: eb 16 jmp 0x50
3a: 8d 45 e0 lea -0x20(%rbp),%eax
3d: 50 push %rax
3e: ff .byte 0xff
3f: 75 .byte 0x75
Code starting with the faulting instruction
===========================================
0: ff 76 0c push 0xc(%rsi)
3: 8b 4d d8 mov -0x28(%rbp),%ecx
6: e8 00 da ff ff call 0xffffffffffffda0b
b: 83 c4 0c add $0xc,%esp
e: eb 16 jmp 0x26
10: 8d 45 e0 lea -0x20(%rbp),%eax
13: 50 push %rax
14: ff .byte 0xff
15: 75 .byte 0x75
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20260709/202607091002.cdfe5a08-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-07-09 8:48 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-09 8:48 kernel test robot [this message]
2026-07-09 9:26 ` [harry:kmalloc-no-objext-rfc-v1r1] [mm/slab] 6bc21472e7: BUG:kernel_NULL_pointer_dereference,address Harry Yoo
2026-07-10 7:21 ` Oliver Sang
2026-07-10 10:04 ` Harry Yoo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202607091002.cdfe5a08-lkp@intel.com \
--to=oliver.sang@intel.com \
--cc=dconstantino@meta.com \
--cc=harry@kernel.org \
--cc=linux-mm@kvack.org \
--cc=lkp@intel.com \
--cc=oe-lkp@lists.linux.dev \
--cc=shakeel.butt@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox