Re: [harry:kmalloc-no-objext-rfc-v1r1] [mm/slab] 6bc21472e7: BUG:kernel_NULL_pointer_dereference,address

[Harry Yoo <harry@kernel.org>]

[-- Attachment #1.1: Type: text/plain, Size: 5975 bytes --]



On 7/9/26 5:48 PM, kernel test robot wrote:
> 
> 
> Hello,
> 
> kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
> 
> commit: 6bc21472e7eb9f8c771ffdf86266aa6d9dcb1dac ("mm/slab: prevent unbounded recursion due to obj_exts in free path")
> https://git.kernel.org/cgit/linux/kernel/git/harry/linux.git kmalloc-no-objext-rfc-v1r1

This is v1r1, and I posted v1r3, because it was bootstrapping sheaves
for normal kmalloc only. This crashed the kernel but was fixed in v1r2.

Apologies for the confusion, I discovered bugs after exposing it in my
tree (force pushing isn't great, you know...) I should probably have
deleted that broken one, though. :)

Will be posting v2 that fixes false warnings w/ memalloc profiling
debug shortly.

> in testcase: boot
> 
> config: i386-randconfig-2006-20250804
> compiler: gcc-14
> test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 4G
> 
> (please refer to attached dmesg/kmsg for entire log/backtrace)
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <oliver.sang@intel.com>
> | Closes: https://lore.kernel.org/oe-lkp/202607091002.cdfe5a08-lkp@intel.com
> 
> [    0.183091][    T0] BUG: kernel NULL pointer dereference, address: 0000000c
> [    0.183772][    T0] #PF: supervisor read access in kernel mode
> [    0.184312][    T0] #PF: error_code(0x0000) - not-present page
> [    0.184851][    T0] *pde = 00000000
> [    0.185186][    T0] Oops: Oops: 0000 [#1]
> [    0.185561][    T0] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.2.0-rc1+ #1 PREEMPT  27a7cd77b6ab41253c0455bf8bac7f75db905e14
> [    0.186647][    T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [    0.187601][    T0] EIP: __kmalloc_flags_noprof (slub.c:5311 slub.c:5506)
> [    0.189928][    T0] EAX: b11c8b96 EBX: 00000000 ECX: b18bdac5 EDX: 00000000
> [    0.190574][    T0] ESI: 00000000 EDI: 00000150 EBP: b1e17df0 ESP: b1e17db8
> [    0.191220][    T0] DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00210046
> [    0.191925][    T0] CR0: 80050033 CR2: 0000000c CR3: 0253b000 CR4: 00000090
> [    0.192579][    T0] Call Trace:
> [    0.192877][    T0]  ? alloc_from_new_slab (linux/spinlock.h:408 slub.c:4416)
> [    0.193350][    T0]  ? alloc_slab_obj_exts (slab.h:39 slub.c:2149)
> [    0.193823][    T0]  alloc_slab_obj_exts (slab.h:39 slub.c:2149)
> [    0.194280][    T0]  __alloc_tagging_slab_alloc_hook (slub.c:2329 slub.c:2358)
> [    0.194833][    T0]  alloc_tagging_slab_alloc_hook (slub.c:2381)
> [    0.195372][    T0]  __kmalloc_cache_node_noprof (slub.c:4596 slub.c:4893 slub.c:5482)
> [    0.195903][    T0]  ? init_kmem_cache_nodes (linux/slab.h:1192 slub.c:7732)
> [    0.196400][    T0]  init_kmem_cache_nodes (linux/slab.h:1192 slub.c:7732)

Here we're allocating kmem_cache_node for KMALLOC_NO_OBJ_EXT, but
kmem_cache_node itself needs obj_exts array.

> [    0.196882][    T0]  do_kmem_cache_create (slub.c:8646)
> [    0.197354][    T0]  create_boot_cache (slab_common.c:717)
> [    0.197788][    T0]  new_kmalloc_cache (slab_common.c:735 slab_common.c:996)
> [    0.198237][    T0]  create_kmalloc_caches (slab_common.c:1019)
> [    0.198701][    T0]  kmem_cache_init (slub.c:8555)
> [    0.199125][    T0]  mm_core_init (mm_init.c:2728)
> [    0.199533][    T0]  start_kernel (main.c:1034)
> [    0.199939][    T0]  i386_start_kernel (x86/kernel/head32.c:79)
> [    0.200368][    T0]  startup_32_smp (x86/kernel/head_32.S:292)
> [    0.200791][    T0] Modules linked in:
> [    0.201141][    T0] CR2: 000000000000000c
> [    0.201513][    T0] ---[ end trace 0000000000000000 ]---
> [    0.202004][    T0] EIP: __kmalloc_flags_noprof (slub.c:5311 slub.c:5506)
> [    0.202522][    T0] Code: 7d d7 00 74 0a 84 d2 74 06 31 c0 89 df f3 aa ff 75 e8 89 da 89 f0 8b 4d dc e8 47 28 00 00 59 8b 45 e0 89 da ff 75 0c ff 75 dc <ff> 76 0c 8b 4d d8 e8 00 da ff ff 83 c4 0c eb 16 8d 45 e0 50 ff 75
> All code
> ========
>    0:	7d d7                	jge    0xffffffffffffffd9
>    2:	00 74 0a 84          	add    %dh,-0x7c(%rdx,%rcx,1)
>    6:	d2 74 06 31          	shlb   %cl,0x31(%rsi,%rax,1)
>    a:	c0 89 df f3 aa ff 75 	rorb   $0x75,-0x550c21(%rcx)
>   11:	e8 89 da 89 f0       	call   0xfffffffff089da9f
>   16:	8b 4d dc             	mov    -0x24(%rbp),%ecx
>   19:	e8 47 28 00 00       	call   0x2865
>   1e:	59                   	pop    %rcx
>   1f:	8b 45 e0             	mov    -0x20(%rbp),%eax
>   22:	89 da                	mov    %ebx,%edx
>   24:	ff 75 0c             	push   0xc(%rbp)
>   27:	ff 75 dc             	push   -0x24(%rbp)
>   2a:*	ff 76 0c             	push   0xc(%rsi)		<-- trapping instruction
>   2d:	8b 4d d8             	mov    -0x28(%rbp),%ecx
>   30:	e8 00 da ff ff       	call   0xffffffffffffda35
>   35:	83 c4 0c             	add    $0xc,%esp
>   38:	eb 16                	jmp    0x50
>   3a:	8d 45 e0             	lea    -0x20(%rbp),%eax
>   3d:	50                   	push   %rax
>   3e:	ff                   	.byte 0xff
>   3f:	75                   	.byte 0x75
> 
> Code starting with the faulting instruction
> ===========================================
>    0:	ff 76 0c             	push   0xc(%rsi)
>    3:	8b 4d d8             	mov    -0x28(%rbp),%ecx
>    6:	e8 00 da ff ff       	call   0xffffffffffffda0b
>    b:	83 c4 0c             	add    $0xc,%esp
>    e:	eb 16                	jmp    0x26
>   10:	8d 45 e0             	lea    -0x20(%rbp),%eax
>   13:	50                   	push   %rax
>   14:	ff                   	.byte 0xff
>   15:	75                   	.byte 0x75
> 
> 
> The kernel config and materials to reproduce are available at:
> https://download.01.org/0day-ci/archive/20260709/202607091002.cdfe5a08-lkp@intel.com

-- 
Cheers,
Harry / Hyeonggon

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 228 bytes --]