* [harry:kmalloc-no-objext-rfc-v1r1] [mm/slab] 6bc21472e7: BUG:kernel_NULL_pointer_dereference,address
@ 2026-07-09 8:48 kernel test robot
2026-07-09 9:26 ` Harry Yoo
0 siblings, 1 reply; 4+ messages in thread
From: kernel test robot @ 2026-07-09 8:48 UTC (permalink / raw)
To: Harry Yoo
Cc: oe-lkp, lkp, Danielle Constantino, Shakeel Butt, linux-mm,
oliver.sang
Hello,
kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
commit: 6bc21472e7eb9f8c771ffdf86266aa6d9dcb1dac ("mm/slab: prevent unbounded recursion due to obj_exts in free path")
https://git.kernel.org/cgit/linux/kernel/git/harry/linux.git kmalloc-no-objext-rfc-v1r1
in testcase: boot
config: i386-randconfig-2006-20250804
compiler: gcc-14
test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 4G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202607091002.cdfe5a08-lkp@intel.com
[ 0.183091][ T0] BUG: kernel NULL pointer dereference, address: 0000000c
[ 0.183772][ T0] #PF: supervisor read access in kernel mode
[ 0.184312][ T0] #PF: error_code(0x0000) - not-present page
[ 0.184851][ T0] *pde = 00000000
[ 0.185186][ T0] Oops: Oops: 0000 [#1]
[ 0.185561][ T0] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.2.0-rc1+ #1 PREEMPT 27a7cd77b6ab41253c0455bf8bac7f75db905e14
[ 0.186647][ T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 0.187601][ T0] EIP: __kmalloc_flags_noprof (slub.c:5311 slub.c:5506)
[ 0.188122][ T0] Code: 7d d7 00 74 0a 84 d2 74 06 31 c0 89 df f3 aa ff 75 e8 89 da 89 f0 8b 4d dc e8 47 28 00 00 59 8b 45 e0 89 da ff 75 0c ff 75 dc <ff> 76 0c 8b 4d d8 e8 00 da ff ff 83 c4 0c eb 16 8d 45 e0 50 ff 75
All code
========
0: 7d d7 jge 0xffffffffffffffd9
2: 00 74 0a 84 add %dh,-0x7c(%rdx,%rcx,1)
6: d2 74 06 31 shlb %cl,0x31(%rsi,%rax,1)
a: c0 89 df f3 aa ff 75 rorb $0x75,-0x550c21(%rcx)
11: e8 89 da 89 f0 call 0xfffffffff089da9f
16: 8b 4d dc mov -0x24(%rbp),%ecx
19: e8 47 28 00 00 call 0x2865
1e: 59 pop %rcx
1f: 8b 45 e0 mov -0x20(%rbp),%eax
22: 89 da mov %ebx,%edx
24: ff 75 0c push 0xc(%rbp)
27: ff 75 dc push -0x24(%rbp)
2a:* ff 76 0c push 0xc(%rsi) <-- trapping instruction
2d: 8b 4d d8 mov -0x28(%rbp),%ecx
30: e8 00 da ff ff call 0xffffffffffffda35
35: 83 c4 0c add $0xc,%esp
38: eb 16 jmp 0x50
3a: 8d 45 e0 lea -0x20(%rbp),%eax
3d: 50 push %rax
3e: ff .byte 0xff
3f: 75 .byte 0x75
Code starting with the faulting instruction
===========================================
0: ff 76 0c push 0xc(%rsi)
3: 8b 4d d8 mov -0x28(%rbp),%ecx
6: e8 00 da ff ff call 0xffffffffffffda0b
b: 83 c4 0c add $0xc,%esp
e: eb 16 jmp 0x26
10: 8d 45 e0 lea -0x20(%rbp),%eax
13: 50 push %rax
14: ff .byte 0xff
15: 75 .byte 0x75
[ 0.189928][ T0] EAX: b11c8b96 EBX: 00000000 ECX: b18bdac5 EDX: 00000000
[ 0.190574][ T0] ESI: 00000000 EDI: 00000150 EBP: b1e17df0 ESP: b1e17db8
[ 0.191220][ T0] DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00210046
[ 0.191925][ T0] CR0: 80050033 CR2: 0000000c CR3: 0253b000 CR4: 00000090
[ 0.192579][ T0] Call Trace:
[ 0.192877][ T0] ? alloc_from_new_slab (linux/spinlock.h:408 slub.c:4416)
[ 0.193350][ T0] ? alloc_slab_obj_exts (slab.h:39 slub.c:2149)
[ 0.193823][ T0] alloc_slab_obj_exts (slab.h:39 slub.c:2149)
[ 0.194280][ T0] __alloc_tagging_slab_alloc_hook (slub.c:2329 slub.c:2358)
[ 0.194833][ T0] alloc_tagging_slab_alloc_hook (slub.c:2381)
[ 0.195372][ T0] __kmalloc_cache_node_noprof (slub.c:4596 slub.c:4893 slub.c:5482)
[ 0.195903][ T0] ? init_kmem_cache_nodes (linux/slab.h:1192 slub.c:7732)
[ 0.196400][ T0] init_kmem_cache_nodes (linux/slab.h:1192 slub.c:7732)
[ 0.196882][ T0] do_kmem_cache_create (slub.c:8646)
[ 0.197354][ T0] create_boot_cache (slab_common.c:717)
[ 0.197788][ T0] new_kmalloc_cache (slab_common.c:735 slab_common.c:996)
[ 0.198237][ T0] create_kmalloc_caches (slab_common.c:1019)
[ 0.198701][ T0] kmem_cache_init (slub.c:8555)
[ 0.199125][ T0] mm_core_init (mm_init.c:2728)
[ 0.199533][ T0] start_kernel (main.c:1034)
[ 0.199939][ T0] i386_start_kernel (x86/kernel/head32.c:79)
[ 0.200368][ T0] startup_32_smp (x86/kernel/head_32.S:292)
[ 0.200791][ T0] Modules linked in:
[ 0.201141][ T0] CR2: 000000000000000c
[ 0.201513][ T0] ---[ end trace 0000000000000000 ]---
[ 0.202004][ T0] EIP: __kmalloc_flags_noprof (slub.c:5311 slub.c:5506)
[ 0.202522][ T0] Code: 7d d7 00 74 0a 84 d2 74 06 31 c0 89 df f3 aa ff 75 e8 89 da 89 f0 8b 4d dc e8 47 28 00 00 59 8b 45 e0 89 da ff 75 0c ff 75 dc <ff> 76 0c 8b 4d d8 e8 00 da ff ff 83 c4 0c eb 16 8d 45 e0 50 ff 75
All code
========
0: 7d d7 jge 0xffffffffffffffd9
2: 00 74 0a 84 add %dh,-0x7c(%rdx,%rcx,1)
6: d2 74 06 31 shlb %cl,0x31(%rsi,%rax,1)
a: c0 89 df f3 aa ff 75 rorb $0x75,-0x550c21(%rcx)
11: e8 89 da 89 f0 call 0xfffffffff089da9f
16: 8b 4d dc mov -0x24(%rbp),%ecx
19: e8 47 28 00 00 call 0x2865
1e: 59 pop %rcx
1f: 8b 45 e0 mov -0x20(%rbp),%eax
22: 89 da mov %ebx,%edx
24: ff 75 0c push 0xc(%rbp)
27: ff 75 dc push -0x24(%rbp)
2a:* ff 76 0c push 0xc(%rsi) <-- trapping instruction
2d: 8b 4d d8 mov -0x28(%rbp),%ecx
30: e8 00 da ff ff call 0xffffffffffffda35
35: 83 c4 0c add $0xc,%esp
38: eb 16 jmp 0x50
3a: 8d 45 e0 lea -0x20(%rbp),%eax
3d: 50 push %rax
3e: ff .byte 0xff
3f: 75 .byte 0x75
Code starting with the faulting instruction
===========================================
0: ff 76 0c push 0xc(%rsi)
3: 8b 4d d8 mov -0x28(%rbp),%ecx
6: e8 00 da ff ff call 0xffffffffffffda0b
b: 83 c4 0c add $0xc,%esp
e: eb 16 jmp 0x26
10: 8d 45 e0 lea -0x20(%rbp),%eax
13: 50 push %rax
14: ff .byte 0xff
15: 75 .byte 0x75
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20260709/202607091002.cdfe5a08-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [harry:kmalloc-no-objext-rfc-v1r1] [mm/slab] 6bc21472e7: BUG:kernel_NULL_pointer_dereference,address
2026-07-09 8:48 [harry:kmalloc-no-objext-rfc-v1r1] [mm/slab] 6bc21472e7: BUG:kernel_NULL_pointer_dereference,address kernel test robot
@ 2026-07-09 9:26 ` Harry Yoo
2026-07-10 7:21 ` Oliver Sang
0 siblings, 1 reply; 4+ messages in thread
From: Harry Yoo @ 2026-07-09 9:26 UTC (permalink / raw)
To: kernel test robot
Cc: oe-lkp, lkp, Danielle Constantino, Shakeel Butt, linux-mm
[-- Attachment #1.1: Type: text/plain, Size: 5975 bytes --]
On 7/9/26 5:48 PM, kernel test robot wrote:
>
>
> Hello,
>
> kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
>
> commit: 6bc21472e7eb9f8c771ffdf86266aa6d9dcb1dac ("mm/slab: prevent unbounded recursion due to obj_exts in free path")
> https://git.kernel.org/cgit/linux/kernel/git/harry/linux.git kmalloc-no-objext-rfc-v1r1
This is v1r1, and I posted v1r3, because it was bootstrapping sheaves
for normal kmalloc only. This crashed the kernel but was fixed in v1r2.
Apologies for the confusion, I discovered bugs after exposing it in my
tree (force pushing isn't great, you know...) I should probably have
deleted that broken one, though. :)
Will be posting v2 that fixes false warnings w/ memalloc profiling
debug shortly.
> in testcase: boot
>
> config: i386-randconfig-2006-20250804
> compiler: gcc-14
> test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 4G
>
> (please refer to attached dmesg/kmsg for entire log/backtrace)
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <oliver.sang@intel.com>
> | Closes: https://lore.kernel.org/oe-lkp/202607091002.cdfe5a08-lkp@intel.com
>
> [ 0.183091][ T0] BUG: kernel NULL pointer dereference, address: 0000000c
> [ 0.183772][ T0] #PF: supervisor read access in kernel mode
> [ 0.184312][ T0] #PF: error_code(0x0000) - not-present page
> [ 0.184851][ T0] *pde = 00000000
> [ 0.185186][ T0] Oops: Oops: 0000 [#1]
> [ 0.185561][ T0] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.2.0-rc1+ #1 PREEMPT 27a7cd77b6ab41253c0455bf8bac7f75db905e14
> [ 0.186647][ T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [ 0.187601][ T0] EIP: __kmalloc_flags_noprof (slub.c:5311 slub.c:5506)
> [ 0.189928][ T0] EAX: b11c8b96 EBX: 00000000 ECX: b18bdac5 EDX: 00000000
> [ 0.190574][ T0] ESI: 00000000 EDI: 00000150 EBP: b1e17df0 ESP: b1e17db8
> [ 0.191220][ T0] DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00210046
> [ 0.191925][ T0] CR0: 80050033 CR2: 0000000c CR3: 0253b000 CR4: 00000090
> [ 0.192579][ T0] Call Trace:
> [ 0.192877][ T0] ? alloc_from_new_slab (linux/spinlock.h:408 slub.c:4416)
> [ 0.193350][ T0] ? alloc_slab_obj_exts (slab.h:39 slub.c:2149)
> [ 0.193823][ T0] alloc_slab_obj_exts (slab.h:39 slub.c:2149)
> [ 0.194280][ T0] __alloc_tagging_slab_alloc_hook (slub.c:2329 slub.c:2358)
> [ 0.194833][ T0] alloc_tagging_slab_alloc_hook (slub.c:2381)
> [ 0.195372][ T0] __kmalloc_cache_node_noprof (slub.c:4596 slub.c:4893 slub.c:5482)
> [ 0.195903][ T0] ? init_kmem_cache_nodes (linux/slab.h:1192 slub.c:7732)
> [ 0.196400][ T0] init_kmem_cache_nodes (linux/slab.h:1192 slub.c:7732)
Here we're allocating kmem_cache_node for KMALLOC_NO_OBJ_EXT, but
kmem_cache_node itself needs obj_exts array.
> [ 0.196882][ T0] do_kmem_cache_create (slub.c:8646)
> [ 0.197354][ T0] create_boot_cache (slab_common.c:717)
> [ 0.197788][ T0] new_kmalloc_cache (slab_common.c:735 slab_common.c:996)
> [ 0.198237][ T0] create_kmalloc_caches (slab_common.c:1019)
> [ 0.198701][ T0] kmem_cache_init (slub.c:8555)
> [ 0.199125][ T0] mm_core_init (mm_init.c:2728)
> [ 0.199533][ T0] start_kernel (main.c:1034)
> [ 0.199939][ T0] i386_start_kernel (x86/kernel/head32.c:79)
> [ 0.200368][ T0] startup_32_smp (x86/kernel/head_32.S:292)
> [ 0.200791][ T0] Modules linked in:
> [ 0.201141][ T0] CR2: 000000000000000c
> [ 0.201513][ T0] ---[ end trace 0000000000000000 ]---
> [ 0.202004][ T0] EIP: __kmalloc_flags_noprof (slub.c:5311 slub.c:5506)
> [ 0.202522][ T0] Code: 7d d7 00 74 0a 84 d2 74 06 31 c0 89 df f3 aa ff 75 e8 89 da 89 f0 8b 4d dc e8 47 28 00 00 59 8b 45 e0 89 da ff 75 0c ff 75 dc <ff> 76 0c 8b 4d d8 e8 00 da ff ff 83 c4 0c eb 16 8d 45 e0 50 ff 75
> All code
> ========
> 0: 7d d7 jge 0xffffffffffffffd9
> 2: 00 74 0a 84 add %dh,-0x7c(%rdx,%rcx,1)
> 6: d2 74 06 31 shlb %cl,0x31(%rsi,%rax,1)
> a: c0 89 df f3 aa ff 75 rorb $0x75,-0x550c21(%rcx)
> 11: e8 89 da 89 f0 call 0xfffffffff089da9f
> 16: 8b 4d dc mov -0x24(%rbp),%ecx
> 19: e8 47 28 00 00 call 0x2865
> 1e: 59 pop %rcx
> 1f: 8b 45 e0 mov -0x20(%rbp),%eax
> 22: 89 da mov %ebx,%edx
> 24: ff 75 0c push 0xc(%rbp)
> 27: ff 75 dc push -0x24(%rbp)
> 2a:* ff 76 0c push 0xc(%rsi) <-- trapping instruction
> 2d: 8b 4d d8 mov -0x28(%rbp),%ecx
> 30: e8 00 da ff ff call 0xffffffffffffda35
> 35: 83 c4 0c add $0xc,%esp
> 38: eb 16 jmp 0x50
> 3a: 8d 45 e0 lea -0x20(%rbp),%eax
> 3d: 50 push %rax
> 3e: ff .byte 0xff
> 3f: 75 .byte 0x75
>
> Code starting with the faulting instruction
> ===========================================
> 0: ff 76 0c push 0xc(%rsi)
> 3: 8b 4d d8 mov -0x28(%rbp),%ecx
> 6: e8 00 da ff ff call 0xffffffffffffda0b
> b: 83 c4 0c add $0xc,%esp
> e: eb 16 jmp 0x26
> 10: 8d 45 e0 lea -0x20(%rbp),%eax
> 13: 50 push %rax
> 14: ff .byte 0xff
> 15: 75 .byte 0x75
>
>
> The kernel config and materials to reproduce are available at:
> https://download.01.org/0day-ci/archive/20260709/202607091002.cdfe5a08-lkp@intel.com
--
Cheers,
Harry / Hyeonggon
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [harry:kmalloc-no-objext-rfc-v1r1] [mm/slab] 6bc21472e7: BUG:kernel_NULL_pointer_dereference,address
2026-07-09 9:26 ` Harry Yoo
@ 2026-07-10 7:21 ` Oliver Sang
2026-07-10 10:04 ` Harry Yoo
0 siblings, 1 reply; 4+ messages in thread
From: Oliver Sang @ 2026-07-10 7:21 UTC (permalink / raw)
To: Harry Yoo
Cc: oe-lkp, lkp, Danielle Constantino, Shakeel Butt, linux-mm,
oliver.sang
hi, Harry Yoo,
On Thu, Jul 09, 2026 at 06:26:54PM +0900, Harry Yoo wrote:
>
>
> On 7/9/26 5:48 PM, kernel test robot wrote:
> >
> >
> > Hello,
> >
> > kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
> >
> > commit: 6bc21472e7eb9f8c771ffdf86266aa6d9dcb1dac ("mm/slab: prevent unbounded recursion due to obj_exts in free path")
> > https://git.kernel.org/cgit/linux/kernel/git/harry/linux.git kmalloc-no-objext-rfc-v1r1
>
> This is v1r1, and I posted v1r3, because it was bootstrapping sheaves
> for normal kmalloc only. This crashed the kernel but was fixed in v1r2.
>
> Apologies for the confusion, I discovered bugs after exposing it in my
> tree (force pushing isn't great, you know...) I should probably have
> deleted that broken one, though. :)
>
> Will be posting v2 that fixes false warnings w/ memalloc profiling
> debug shortly.
thanks a lot for information! sorry that our bot still cannot analyze branch
version so far. we will check the latest branch in your repo before reporting
in the future.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [harry:kmalloc-no-objext-rfc-v1r1] [mm/slab] 6bc21472e7: BUG:kernel_NULL_pointer_dereference,address
2026-07-10 7:21 ` Oliver Sang
@ 2026-07-10 10:04 ` Harry Yoo
0 siblings, 0 replies; 4+ messages in thread
From: Harry Yoo @ 2026-07-10 10:04 UTC (permalink / raw)
To: Oliver Sang; +Cc: oe-lkp, lkp, Danielle Constantino, Shakeel Butt, linux-mm
[-- Attachment #1.1: Type: text/plain, Size: 1323 bytes --]
On 7/10/26 4:21 PM, Oliver Sang wrote:
> hi, Harry Yoo,
Hi Oliver,
> On Thu, Jul 09, 2026 at 06:26:54PM +0900, Harry Yoo wrote:
>> On 7/9/26 5:48 PM, kernel test robot wrote:
>>>
>>>
>>> Hello,
>>>
>>> kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
>>>
>>> commit: 6bc21472e7eb9f8c771ffdf86266aa6d9dcb1dac ("mm/slab: prevent unbounded recursion due to obj_exts in free path")
>>> https://git.kernel.org/cgit/linux/kernel/git/harry/linux.git kmalloc-no-objext-rfc-v1r1
>>
>> This is v1r1, and I posted v1r3, because it was bootstrapping sheaves
>> for normal kmalloc only. This crashed the kernel but was fixed in v1r2.
>>
>> Apologies for the confusion, I discovered bugs after exposing it in my
>> tree (force pushing isn't great, you know...) I should probably have
>> deleted that broken one, though. :)
>>
>> Will be posting v2 that fixes false warnings w/ memalloc profiling
>> debug shortly.
>
> thanks a lot for information! sorry that our bot still cannot analyze branch
> version so far.
No worries :)
Is there any way to tell the bot that a branch is broken,
e.g.) deleting a broken branch from the repository?
> we will check the latest branch in your repo before reporting
> in the future.
Thanks!
--
Cheers,
Harry / Hyeonggon
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-07-10 10:05 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-09 8:48 [harry:kmalloc-no-objext-rfc-v1r1] [mm/slab] 6bc21472e7: BUG:kernel_NULL_pointer_dereference,address kernel test robot
2026-07-09 9:26 ` Harry Yoo
2026-07-10 7:21 ` Oliver Sang
2026-07-10 10:04 ` Harry Yoo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox