From: Harry Yoo <harry@kernel.org>
To: kernel test robot <oliver.sang@intel.com>
Cc: oe-lkp@lists.linux.dev, lkp@intel.com,
Danielle Costantino <dcostantino@meta.com>,
Shakeel Butt <shakeel.butt@linux.dev>,
linux-mm@kvack.org
Subject: Re: [harry:kmalloc-no-objext-rfc-v1r3] [mm/slab] d6967566f4: RIP:mark_obj_codetag_empty
Date: Thu, 16 Jul 2026 11:27:11 +0900 [thread overview]
Message-ID: <7bdfdc92-7e75-4dc6-9549-e75b46218b93@kernel.org> (raw)
In-Reply-To: <202607142131.f70bbad3-lkp@intel.com>
[-- Attachment #1.1: Type: text/plain, Size: 9725 bytes --]
Thanks for reporting!
Indeed I've seen this false warning and it was fixed in v2.
On 7/14/26 10:48 PM, kernel test robot wrote:
> Hello,
>
> kernel test robot noticed "RIP:mark_obj_codetag_empty" on:
>
> commit: d6967566f41090d5e58861f3b5d3d9b1293ccb0f ("mm/slab: prevent unbounded recursion in free path with new kmalloc type")
> https://git.kernel.org/cgit/linux/kernel/git/harry/linux.git kmalloc-no-objext-rfc-v1r3
>
> in testcase: locktorture
> version:
> with following parameters:
>
> runtime: 300s
> test: cpuhotplug
>
>
>
> config: x86_64-randconfig-073-20260706
> compiler: clang-22
> test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 32G
>
> (please refer to attached dmesg/kmsg for entire log/backtrace)
>
>
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <oliver.sang@intel.com>
> | Closes: https://lore.kernel.org/oe-lkp/202607142131.f70bbad3-lkp@intel.com
>
>
>
> [ 7.170805][ T1] ------------[ cut here ]------------
> [ 7.173964][ T1] ext->ref.ct
> [ 7.173973][ T1] WARNING: mm/slub.c:2085 at mark_obj_codetag_empty+0x12d/0x180, CPU#1: swapper/0/1
> [ 7.180958][ T1] Modules linked in:
> [ 7.183435][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Tainted: G T 7.2.0-rc1+ #1 PREEMPTLAZY
> [ 7.198751][ T1] Tainted: [T]=RANDSTRUCT
> [ 7.200585][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [ 7.204811][ T1] RIP: 0010:mark_obj_codetag_empty (slub.c:2079 (discriminator 256))
> [ 7.206959][ T1] Code: 31 c0 31 c9 31 ff 31 d2 31 f6 e9 6e e6 02 00 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 c9 31 ff 31 d2 31 f6 c3 48 83 f8 01 74 cc <0f> 0b eb b4 89 de 41 0f b6 d7 48 c7 c7 d0 01 0f 87 e8 fd 56 87 01
> All code
> ========
> 0: 31 c0 xor %eax,%eax
> 2: 31 c9 xor %ecx,%ecx
> 4: 31 ff xor %edi,%edi
> 6: 31 d2 xor %edx,%edx
> 8: 31 f6 xor %esi,%esi
> a: e9 6e e6 02 00 jmp 0x2e67d
> f: 5b pop %rbx
> 10: 41 5c pop %r12
> 12: 41 5d pop %r13
> 14: 41 5e pop %r14
> 16: 41 5f pop %r15
> 18: 5d pop %rbp
> 19: 31 c0 xor %eax,%eax
> 1b: 31 c9 xor %ecx,%ecx
> 1d: 31 ff xor %edi,%edi
> 1f: 31 d2 xor %edx,%edx
> 21: 31 f6 xor %esi,%esi
> 23: c3 ret
> 24: 48 83 f8 01 cmp $0x1,%rax
> 28: 74 cc je 0xfffffffffffffff6
> 2a:* 0f 0b ud2 <-- trapping instruction
> 2c: eb b4 jmp 0xffffffffffffffe2
> 2e: 89 de mov %ebx,%esi
> 30: 41 0f b6 d7 movzbl %r15b,%edx
> 34: 48 c7 c7 d0 01 0f 87 mov $0xffffffff870f01d0,%rdi
> 3b: e8 fd 56 87 01 call 0x187573d
>
> Code starting with the faulting instruction
> ===========================================
> 0: 0f 0b ud2
> 2: eb b4 jmp 0xffffffffffffffb8
> 4: 89 de mov %ebx,%esi
> 6: 41 0f b6 d7 movzbl %r15b,%edx
> a: 48 c7 c7 d0 01 0f 87 mov $0xffffffff870f01d0,%rdi
> 11: e8 fd 56 87 01 call 0x1875713
> [ 7.216881][ T1] RSP: 0000:ffffc9000001f700 EFLAGS: 00010282
> [ 7.218936][ T1] RAX: ffffffff87f3cc38 RBX: 0000000000000800 RCX: 000000000000000a
> [ 7.226952][ T1] RDX: ffffea0004151200 RSI: ffffea00041524c0 RDI: ffff888105448800
> [ 7.229430][ T1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
> [ 7.232919][ T1] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888105448410
> [ 7.236484][ T1] R13: ffffea0004151200 R14: 000000000000000a R15: 0000000000000a01
> [ 7.238648][ T1] FS: 0000000000000000(0000) GS:ffff888795e7f000(0000) knlGS:0000000000000000
> [ 7.241013][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 7.242973][ T1] CR2: 0000000000000000 CR3: 0000000006b26000 CR4: 00000000000406f0
> [ 7.245167][ T1] Call Trace:
> [ 7.246092][ T1] <TASK>
> [ 7.246905][ T1] __free_slab (slub.c:2244)
> [ 7.248085][ T1] ___cache_free (slub.c:6436 (discriminator 1))
> [ 7.249275][ T1] qlist_free_all (kasan/quarantine.c:163 (discriminator 1) kasan/quarantine.c:179 (discriminator 1))
> [ 7.250498][ T1] kasan_quarantine_remove_cache (kasan/quarantine.c:364)
> [ 7.252073][ T1] kmem_cache_shrink (slab_common.c:604)
> [ 7.253337][ T1] acpi_os_purge_cache (acpi/osl.c:1622)
> [ 7.254628][ T1] acpi_purge_cached_objects (acpi/acpica/utxface.c:237 (discriminator 512))
> [ 7.256086][ T1] acpi_initialize_objects (acpi/acpica/utxfinit.c:250)
> [ 7.257334][ T1] acpi_bus_init (acpi/bus.c:1503)
> [ 7.258535][ T1] ? acpi_init (bus.c:?)
> [ 7.259714][ T1] ? __kasan_kmalloc (kasan/common.c:398 kasan/common.c:415)
> [ 7.261025][ T1] ? __kmalloc_cache_noprof (linux/kasan.h:263 slub.c:5474)
> [ 7.262488][ T1] ? kobject_init (linux/instrumented.h:97 linux/atomic/atomic-instrumented.h:67 linux/refcount.h:134 linux/kref.h:31 kobject.c:201 kobject.c:352)
> [ 7.263709][ T1] ? kobject_create_and_add (kobject.c:798)
> [ 7.265173][ T1] acpi_init (acpi/bus.c:1592)
> [ 7.266287][ T1] do_one_initcall (main.c:1347)
> [ 7.267461][ T1] ? acpi_arch_init+0x40/0x40
> [ 7.268701][ T1] ? perf_trace_initcall_finish (main.c:?)
> [ 7.270254][ T1] ? do_raw_spin_lock (linux/instrumented.h:55 linux/atomic/atomic-instrumented.h:1301 asm-generic/qspinlock.h:111 locking/spinlock_debug.c:116)
> [ 7.271619][ T1] ? find_held_lock (locking/lockdep.c:5350)
> [ 7.272891][ T1] ? stack_depot_save_flags (stackdepot.c:728 (discriminator 1))
> [ 7.274356][ T1] ? _raw_spin_unlock_irqrestore (linux/spinlock_api_smp.h:178 (discriminator 2))
> [ 7.275877][ T1] ? stack_depot_save_flags (stackdepot.c:728 (discriminator 1))
> [ 7.277336][ T1] ? do_initcalls (linux/slab.h:985 linux/slab.h:1302 main.c:1418)
> [ 7.278561][ T1] ? kasan_save_track (kasan/common.c:58 kasan/common.c:78)
> [ 7.280348][ T1] ? kasan_save_track (kasan/common.c:57 kasan/common.c:78)
> [ 7.288349][ T1] ? __kasan_kmalloc (kasan/common.c:398 kasan/common.c:415)
> [ 7.290315][ T1] ? __kmalloc_noprof (linux/kasan.h:263 slub.c:5317 slub.c:5342)
> [ 7.292347][ T1] ? do_initcalls (linux/slab.h:985 linux/slab.h:1302 main.c:1418)
> [ 7.294211][ T1] ? kernel_init_freeable (main.c:1658)
> [ 7.296477][ T1] ? kernel_init (main.c:1548)
> [ 7.298274][ T1] ? ret_from_fork (x86/kernel/process.c:158)
> [ 7.300206][ T1] ? ret_from_fork_asm (x86/entry/entry_64.S:245)
> [ 7.302217][ T1] ? __lock_acquire (locking/lockdep.c:4674)
> [ 7.307839][ T1] ? _raw_spin_unlock_irqrestore (linux/spinlock_api_smp.h:178 (discriminator 2))
> [ 7.310305][ T1] ? parameq (linux/fortify-string.h:218 params.c:99)
> [ 7.312115][ T1] ? parse_args (params.c:153)
> [ 7.314076][ T1] ? lock_acquire (locking/lockdep.c:5868)
> [ 7.316041][ T1] ? local_trylock_acquire (linux/local_lock_internal.h:53)
> [ 7.317915][ T1] ? parameq (params.c:99)
> [ 7.319735][ T1] ? __kmalloc_noprof (linux/local_lock_internal.h:53)
> [ 7.321920][ T1] ? __kmalloc_noprof (linux/local_lock_internal.h:53)
> [ 7.326225][ T1] ? trace_kmalloc (trace/events/kmem.h:57 (discriminator 6))
> [ 7.327722][ T1] do_initcall_level (main.c:1409 (discriminator 1))
> [ 7.329722][ T1] do_initcalls (main.c:1425)
> [ 7.331702][ T1] ? kernel_init (main.c:1548)
> [ 7.333605][ T1] kernel_init_freeable (main.c:1658)
> [ 7.335051][ T1] ? rest_init (main.c:?)
> [ 7.336248][ T1] kernel_init (main.c:1548)
> [ 7.337273][ T1] ? rest_init (main.c:?)
> [ 7.338461][ T1] ret_from_fork (x86/kernel/process.c:158)
> [ 7.339695][ T1] ? exit_thread (x86/kernel/process.c:138)
> [ 7.340878][ T1] ? __switch_to (linux/instrumented.h:82 asm-generic/bitops/instrumented-non-atomic.h:141 linux/thread_info.h:133 linux/sched.h:2087 x86/include/asm/fpu/sched.h:34 x86/kernel/process_64.c:619)
> [ 7.342110][ T1] ? rest_init (main.c:?)
> [ 7.343300][ T1] ret_from_fork_asm (x86/entry/entry_64.S:245)
> [ 7.344579][ T1] </TASK>
> [ 7.345444][ T1] irq event stamp: 29481
> [ 7.346581][ T1] hardirqs last enabled at (29495): __console_unlock (printk/printk.c:347 (discriminator 3) printk/printk.c:2932 (discriminator 3))
> [ 7.348686][ T1] hardirqs last disabled at (29510): __console_unlock (printk/printk.c:345 (discriminator 6) printk/printk.c:2932 (discriminator 6))
> [ 7.351184][ T1] softirqs last enabled at (29232): handle_softirqs (softirq.c:468 (discriminator 2))
> [ 7.353729][ T1] softirqs last disabled at (29227): __irq_exit_rcu (softirq.c:656 softirq.c:496 softirq.c:735)
> [ 7.356197][ T1] ---[ end trace 0000000000000000 ]---
>
>
> The kernel config and materials to reproduce are available at:
> https://download.01.org/0day-ci/archive/20260714/202607142131.f70bbad3-lkp@intel.com
>
>
>
--
Cheers,
Harry / Hyeonggon
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
prev parent reply other threads:[~2026-07-16 2:27 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-14 13:48 [harry:kmalloc-no-objext-rfc-v1r3] [mm/slab] d6967566f4: RIP:mark_obj_codetag_empty kernel test robot
2026-07-16 2:27 ` Harry Yoo [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7bdfdc92-7e75-4dc6-9549-e75b46218b93@kernel.org \
--to=harry@kernel.org \
--cc=dcostantino@meta.com \
--cc=linux-mm@kvack.org \
--cc=lkp@intel.com \
--cc=oe-lkp@lists.linux.dev \
--cc=oliver.sang@intel.com \
--cc=shakeel.butt@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox