Re: [PATCH 6.12 000/277] 6.12.54-rc1 review

[Naresh Kamboju <naresh.kamboju@linaro.org>]

On Fri, 17 Oct 2025 at 20:45, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.12.54 release.
> There are 277 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 19 Oct 2025 14:50:59 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.54-rc1.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

The following kernel crash noticed on the stable-rc 6.12.54-rc1 while running
LTP syscalls listmount04 test case.

This is a known regression on the Linux next and reported [1] and fixed [2].

This was caused by,
listmount: don't call path_put() under namespace semaphore
commit c1f86d0ac322c7e77f6f8dbd216c65d39358ffc0 upstream.

And there is a follow up patch to fix this.

mount: handle NULL values in mnt_ns_release()
[ Upstream commit 6c7ca6a02f8f9549a438a08a23c6327580ecf3d6 ]

When calling in listmount() mnt_ns_release() may be passed a NULL
pointer. Handle that case gracefully.

Christian Brauner <brauner@kernel.org>

First seen on 6.12.54-rc1
Good: v6.12.53
Bad: 6.12.54-rc1

Regression Analysis:
- New regression? yes
- Reproducibility? yes

Test regression: 6.12.54-rc1 Internal error: Oops: mnt_ns_release
__arm64_sys_listmount (fs/namespace.c:5526)

Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>

### LTP syscalls failures:
    ltp-syscalls/listmount04
    ltp-syscalls/madvise06
    ltp-syscalls/sendmsg03
    ltp-syscalls/sendto03
    ltp-syscalls/setsockopt05
    ltp-syscalls/setsockopt09
    ltp-syscalls/timerfd_settime02
    ltp-syscalls/wait403
    ltp-containers/userns08


### LTP test log listmount04
[ 3587.449309] <LAVA_SIGNAL_STARTTC listmount04>
Received signal: <STARTTC> listmount04
tst_buffers.c:57: TINFO: Test is using guarded buffers
tst_test.c:2021: TINFO: LTP version: 20250930
tst_test.c:2024: TINFO: Tested kernel: 6.12.54-rc1 #1 SMP PREEMPT
@1760715935 aarch64
tst_kconfig.c:88: TINFO: Parsing kernel config '/proc/config.gz'
tst_kconfig.c:676: TINFO: CONFIG_TRACE_IRQFLAGS kernel option detected
which might slow the execution
tst_test.c:1842: TINFO: Overall timeout per run is 0h 21m 36s
[ 3587.464366] <LAVA_SIGNAL_ENDTC listmount04>
Received signal: <ENDTC> listmount04
tst_test.c:1920: TBROK: Test killed by SIGSEGV!
Summary:
passed   0
failed   0
broken   1
skipped  0
warnings 0
[ 3587.523917] <LAVA_SIGNAL_TESTCASE TEST_CASE_ID=listmount04 RESULT=fail>


### Test cash log
listmount04: [ 1440.660118] /usr/local/bin/kirk[418]: listmount04:
start (command: listmount04)
[ 1440.761870] Unable to handle kernel NULL pointer dereference at
virtual address 0000000000000080
[ 1440.762768] Mem abort info:
[ 1440.763156]   ESR = 0x0000000096000004
[ 1440.763722]   EC = 0x25: DABT (current EL), IL = 32 bits
[ 1440.764204]   SET = 0, FnV = 0
[ 1440.764486]   EA = 0, S1PTW = 0
[ 1440.764883]   FSC = 0x04: level 0 translation fault
[ 1440.765393] Data abort info:
[ 1440.765795]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[ 1440.766288]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 1440.766738]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 1440.767213] user pgtable: 4k pages, 48-bit VAs, pgdp=000000000d4c1000
[ 1440.767819] [0000000000000080] pgd=0000000000000000, p4d=0000000000000000
[ 1440.768448] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[ 1440.769002] Modules linked in: tun overlay btrfs xor xor_neon
raid6_pq zstd_compress libcrc32c snd_soc_hdmi_codec hantro_vpu
dw_hdmi_cec dw_hdmi_i2s_audio brcmfmac rockchipdrm v4l2_h264
dw_mipi_dsi v4l2_vp9 hci_uart brcmutil analogix_dp crct10dif_ce btqca
v4l2_jpeg panfrost dw_hdmi v4l2_mem2mem btbcm snd_soc_simple_card
snd_soc_audio_graph_card snd_soc_spdif_tx cec gpu_sched
snd_soc_simple_card_utils bluetooth cfg80211 drm_display_helper
videobuf2_v4l2 drm_shmem_helper snd_soc_rockchip_i2s
videobuf2_dma_contig pwrseq_core phy_rockchip_pcie drm_dma_helper
rtc_rk808 videobuf2_memops drm_kms_helper videobuf2_common rfkill
snd_soc_es8316 rockchip_saradc industrialio_triggered_buffer
rockchip_thermal kfifo_buf pcie_rockchip_host coresight_cpu_debug drm
fuse backlight ip_tables x_tables
[ 1440.775190] CPU: 3 UID: 0 PID: 131415 Comm: listmount04 Not tainted
6.12.54-rc1 #1
[ 1440.775866] Hardware name: Radxa ROCK Pi 4B (DT)
[ 1440.776277] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 1440.776893] pc : mnt_ns_release
(arch/arm64/include/asm/atomic_ll_sc.h:96
arch/arm64/include/asm/atomic.h:51
include/linux/atomic/atomic-arch-fallback.h:944
include/linux/atomic/atomic-instrumented.h:401
include/linux/refcount.h:264 include/linux/refcount.h:307
include/linux/refcount.h:325 fs/namespace.c:156)
[ 1440.777267] lr : __arm64_sys_listmount (fs/namespace.c:?
fs/namespace.c:5569 fs/namespace.c:5526 fs/namespace.c:5526)
[ 1440.777694] sp : ffff80008d663d30
[ 1440.777987] x29: ffff80008d663d30 x28: ffff0000bba30000 x27: 0000000000000000
[ 1440.778622] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
[ 1440.779256] x23: 0000000000000000 x22: 0000000000000020 x21: fffffffffffffff2
[ 1440.779890] x20: 0000000000000100 x19: 0000aaaab5ee1110 x18: 0000000000000000
[ 1440.780524] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
[ 1440.781158] x14: 0000000000000000 x13: ffff80008d660000 x12: ffff80008d664000
[ 1440.781791] x11: 0000000000000000 x10: 0000000000000001 x9 : ffff80008044cdf0
[ 1440.782425] x8 : 0000000000000080 x7 : 0000000000000000 x6 : 0000000000000000
[ 1440.783059] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008d663e00
[ 1440.783692] x2 : ffff800081700c70 x1 : ffff80008d663d50 x0 : 0000000000000000
[ 1440.784326] Call trace:
[ 1440.784545]  mnt_ns_release
(arch/arm64/include/asm/atomic_ll_sc.h:96
arch/arm64/include/asm/atomic.h:51
include/linux/atomic/atomic-arch-fallback.h:944
include/linux/atomic/atomic-instrumented.h:401
include/linux/refcount.h:264 include/linux/refcount.h:307
include/linux/refcount.h:325 fs/namespace.c:156)
[ 1440.784882]  __arm64_sys_listmount (fs/namespace.c:?
fs/namespace.c:5569 fs/namespace.c:5526 fs/namespace.c:5526)
[ 1440.785278]  invoke_syscall (arch/arm64/kernel/syscall.c:50)
[ 1440.785618]  el0_svc_common (include/linux/thread_info.h:127
arch/arm64/kernel/syscall.c:140)
[ 1440.785948]  do_el0_svc (arch/arm64/kernel/syscall.c:152)
[ 1440.786247]  el0_svc (arch/arm64/kernel/entry-common.c:165)
[ 1440.786524]  el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:789)
[ 1440.786904]  el0t_64_sync (arch/arm64/kernel/entry.S:598)
[ 1440.787238] Code: aa1303e0 14000019 5280002a f9800111 (885f7d09)
All code
========
   0: aa1303e0 mov x0, x19
   4: 14000019 b 0x68
   8: 5280002a mov w10, #0x1                    // #1
   c: f9800111 prfm pstl1strm, [x8]
  10:* 885f7d09 ldxr w9, [x8] <-- trapping instruction

Code starting with the faulting instruction
===========================================
   0: 885f7d09 ldxr w9, [x8]
[ 1440.787776] ---[ end trace 0000000000000000 ]---


## Lore link,
[1] https://lore.kernel.org/all/CA+G9fYueO8kP8mXVNmbHkyrFPKpt-onPfeyNXLuLGGjiO1WFfQ@mail.gmail.com/
[2] https://lore.kernel.org/all/20251017145215.505418259@linuxfoundation.org/

## Build
* kernel: 6.12.54-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: 6122296b30b695962026ca4d1b434cae639373e0
* git describe: v6.12.53-278-g6122296b30b6
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.12.y/build/v6.12.53-278-g6122296b30b6

## Build
* Test log: https://lkft.validation.linaro.org/scheduler/job/8496757#L6787
* Test details:
https://regressions.linaro.org/lkft/linux-stable-rc-linux-6.12.y/v6.12.53-278-g6122296b30b6/log-parser-test/internal-error-oops-Oops_PREEMPT_SMP__mnt_ns_release-064d7f50/
* Build plan: https://tuxapi.tuxsuite.com/v1/groups/linaro/projects/lkft/tests/34CRZ9uzNjZKMeKVqBaBBIUC2Z9
* Build link: https://storage.tuxsuite.com/public/linaro/lkft/builds/34CRXmuzdt1HaZluq4cBw4zG4lh/
* Kernel config:
https://storage.tuxsuite.com/public/linaro/lkft/builds/34CRXmuzdt1HaZluq4cBw4zG4lh/config

--
Linaro LKFT