next-20250604: qemu-riscv64 ltp tracing warning kernel trace trace.c ignore_event

next-20250604: qemu-riscv64 ltp tracing warning kernel trace trace.c ignore_event

[Naresh Kamboju]

Regression while running LTP tracing on the Linux next-20250604 and
next-20250605
the following kernel warnings found on the qemu-riscv64.

Regressions found on qemu-riscv64
 - LTP tracing

Regression Analysis:
 - New regression? Yes
 - Reproducibility? Yes

First seen on the next-20250604
Good: next-20250603
Bad:  next-20250604

Test regression: qemu-riscv64 ltp tracing warning kernel trace trace.c
ignore_event

Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>

## Test error

------------[ cut here ]------------
[   28.134981] event 'ma_read' has unsafe pointer field 'fn'
[   28.135550] WARNING: CPU: 1 PID: 302 at kernel/trace/trace.c:3823
ignore_event+0x1de/0x1fa
[   28.135609] Modules linked in: drm drm_panel_orientation_quirks
backlight configfs ip_tables x_tables
[   28.135937] CPU: 1 UID: 0 PID: 302 Comm: cat Not tainted
6.15.0-next-20250604 #1 NONE
[   28.135973] Hardware name: riscv-virtio,qemu (DT)
[   28.136072] epc : ignore_event+0x1de/0x1fa
[   28.136115]  ra : ignore_event+0x1de/0x1fa
[   28.136147] epc : ffffffff80151ca4 ra : ffffffff80151ca4 sp :
ff200000006ebbe0
[   28.136164]  gp : ffffffff81c61428 tp : ff60000084efd100 t0 :
ff200000006eb9b8
[   28.136181]  t1 : ffffffffffffe000 t2 : 205b2d2d2d2d2d2d s0 :
ff200000006ebc50
[   28.136197]  s1 : ff60000080066150 a0 : 000000000000002d a1 :
ff6000008103e730
[   28.136213]  a2 : ff600000fffcd980 a3 : ffffffff80104e22 a4 :
0000000000000000
[   28.136229]  a5 : 0000000000000000 a6 : 000000000000003a a7 :
0000000000000a00
[   28.136245]  s2 : ffffffff81801608 s3 : ff60000087cd8078 s4 :
ffffffff81bebe70
[   28.136262]  s5 : ff60000087cda090 s6 : ff60000087cda054 s7 :
ff60000087f9ea40
[   28.136278]  s8 : ffffffff81200000 s9 : ffffffff81800000 s10:
ffffffff81bfa290
[   28.136294]  s11: ff60000087cdc000 t3 : ffffffff81c615d8 t4 :
ffffffff8001f8e0
[   28.136321]  t5 : ffffffff8014156c t6 : ff200000006eb9b8
[   28.136337] status: 0000000200000120 badaddr: ffffffff80151ca4
cause: 0000000000000003
[   28.136395] [<ffffffff80151ca4>] ignore_event+0x1de/0x1fa
[   28.136456] [<ffffffff80157548>] trace_event_printf+0x46/0x88
[   28.136471] [<ffffffff80d2d54c>] trace_raw_output_ma_read+0x5e/0x7a
[   28.136489] [<ffffffff801530f6>] print_trace_line+0x1c2/0x438
[   28.136506] [<ffffffff80153948>] tracing_read_pipe+0x1a2/0x2ee
[   28.136522] [<ffffffff802f3eb8>] vfs_read+0xb0/0x294
[   28.136538] [<ffffffff802f48ac>] ksys_read+0x78/0xde
[   28.136554] [<ffffffff802f4934>] __riscv_sys_read+0x22/0x2c
[   28.136569] [<ffffffff80d49cd8>] do_trap_ecall_u+0x1ba/0x392
[   28.136584] [<ffffffff80d56b6e>] handle_exception+0x146/0x152
[   28.136654] ---[ end trace 0000000000000000 ]---

## Source
* Kernel version: 6.15.0-next-20250605 and 6.15.0-next-20250604
* Git tree: https://kernel.googlesource.com/pub/scm/linux/kernel/git/next/linux-next.git
* Git sha: 4f27f06ec12190c7c62c722e99ab6243dea81a94
* Toolchain: gcc-13

## Build
* Test log: https://qa-reports.linaro.org/api/testruns/28662756/log_file/
* Build link: https://storage.tuxsuite.com/public/linaro/lkft/builds/2y1tW4N08hDuUrUZt7mmMMyQJag/
* Kernel config:
https://storage.tuxsuite.com/public/linaro/lkft/builds/2y1tW4N08hDuUrUZt7mmMMyQJag/config

--
Linaro LKFT
https://lkft.linaro.org

Re: next-20250604: qemu-riscv64 ltp tracing warning kernel trace trace.c ignore_event

[Steven Rostedt]

On Thu, 5 Jun 2025 18:24:08 +0530
Naresh Kamboju <naresh.kamboju@linaro.org> wrote:

> Regression while running LTP tracing on the Linux next-20250604 and
> next-20250605
> the following kernel warnings found on the qemu-riscv64.
> 
> Regressions found on qemu-riscv64
>  - LTP tracing
> 
> Regression Analysis:
>  - New regression? Yes
>  - Reproducibility? Yes
> 
> First seen on the next-20250604
> Good: next-20250603
> Bad:  next-20250604
> 
> Test regression: qemu-riscv64 ltp tracing warning kernel trace trace.c

Does riscv64 place __func__ in rodata? If not, this may consider the
string unsafe to use in an event. 

> ignore_event
> 
> Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
> 
> ## Test error
> 
> ------------[ cut here ]------------
> [   28.134981] event 'ma_read' has unsafe pointer field 'fn'

In lib/maple_tree.c we have:

        trace_ma_read(__func__, &mas);

Where it records the address of "__func__" into the ring buffer 'fn' field.

At a much later time (when the ring buffer is read), that pointer is
dereferenced. As rodata doesn't change for the life of the kernel, it
is safe to dereference. But if riscv doesn't place __func__ into
rodata, this will be considered unsafe to use.

-- Steve