Re: [linus:master] [tracing] b5cc230af5: WARNING:at_kernel/trace/trace_events.c:#test_double_dereference

[Steven Rostedt <rostedt@goodmis.org>]

On Fri, 06 Nov 2026 04:54:33 +0000
"Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:

> On Fri, 6 Nov 2026 11:07:56 +0800, kernel test robot <yi1.lai@intel.com> wrote:
> > 
> > 
> > Hello,
> > 
> > kernel test robot noticed "WARNING:at_kernel/trace/trace_events.c:#test_double_dereference" on:
> > 
> > commit: b5cc230af5e536ff752f8bd5c30e23612936d5c3 ("tracing: Warn when an event dereferences a pointer in TP_printk()") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
> > 
> > [test failed on linux-next/master ddfe51b0a0f5dc9e415cc2c8ad8db17532dd426b]
> > 
> > in testcase: boot
> > 
> > config: x86_64-randconfig-r2309-20261012
> > compiler: gcc-14
> > test machine: qemu-system-x86_64 -enable-kvm -cpu Cascadelake-Server-noTSX,enforce -smp 4 -m 16G
> > 
> > (please refer to attached dmesg/kmsg for entire log/backtrace)
> > 
> > 
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <yi1.lai@intel.com>
> > | Closes: https://lore.kernel.org/oe-lkp/202611060303.c90f27a7-lkp@intel.com
> > 
> > 
> > [    0.808840][    T0] ------------[ cut here ]------------
> > [    0.810236][    T0] Event hfi1_txq_complete has double dereference in TP_printk: REC->sde ? REC->sde->this_idx : 0  
> 
> This seems to be expected behavior. Because "REC->sde" can point already
> freed/reused object, this should not be allowed. The event must save the
> sde->this_idx at TP_fast_assign() instead of recording sde.
> 
> In drivers/infiniband/hw/hfi1/trace_tx.h:
> 
> DECLARE_EVENT_CLASS(/* AIP  */
>         hfi1_ipoib_txq_template,
> 	...
>         TP_printk(/* print  */
>                 "[%s] txq %llx idx %u sde %llx:%u cpu %d head %lx tail %lx flow %x used %u stops %d no_desc %d stopped %u",
>                 __get_str(dev),
>                 (unsigned long long)__entry->txq,
>                 __entry->idx,
>                 (unsigned long long)__entry->sde,
>                 __entry->sde ? __entry->sde->this_idx : 0, // this must be recorded as a value
>                 __entry->sde ? __entry->sde->cpu : 0,	// ditto
> 
> 
> So this is a bug in an infiniband driver.

Yep, I'm working on a fix, unless you are already doing it.

-- Steve

> 
> Thank you,
>