From: "Paul E. McKenney" <paulmck@kernel.org>
To: mingo@redhat.com, peterz@infradead.org, juri.lelli@redhat.com,
vincent.guittot@linaro.org, dietmar.eggemann@arm.com,
rostedt@goodmis.org, bsegall@google.com, mgorman@suse.de,
tglx@linutronix.de
Cc: linux-kernel@vger.kernel.org
Subject: BUG: kernel NULL pointer dereference from check_preempt_wakeup()
Date: Thu, 4 Jun 2020 15:54:45 -0700 [thread overview]
Message-ID: <20200604225445.GA32319@paulmck-ThinkPad-P72> (raw)
Hello!
I get the splat below at a rate of roughly two per thirty hours when
running rcutorture scenario TREE03 on x86 at the June 3rd mainline commit:
cb8e59cc8720 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next")
Running 140 hours of this same scenario at the following June 2nd mainline
commit shows no errors:
d9afbb350990 ("Merge branch 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security")
I have started a bisection, but it is likely to take several days to
complete. I am looking at ways of speeding this up, but in the meantime,
I figured that I should check to see if others are also encountering this.
Thoughts?
Thanx, Paul
------------------------------------------------------------------------
BUG: kernel NULL pointer dereference, address: 0000000000000150
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 9 PID: 196 Comm: rcu_torture_rea Not tainted 5.7.0+ #3923
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.11.0-2.el7 04/01/2014
RIP: 0010:check_preempt_wakeup+0xb1/0x180
Code: 83 ea 01 48 8b 9b 48 01 00 00 39 d0 75 f2 48 39 bb 50 01 00 00 75 05 48 85 ff 75 29 48 8b ad 48 01 00 00 48 8b 9b 48 01 00 00 <48> 8b bd 50 01 00 00 48 39 bb 50 01 00 00 0f 95 c2 48 85 ff 0f 94
RSP: 0018:ffffaccdc02ecd38 EFLAGS: 00010006
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffafa0bc20
RDX: 0000000000000000 RSI: ffff946b5df50000 RDI: ffff946b5f469340
RBP: 0000000000000000 R08: ffff946b5df80d00 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: ffff946b5f469300
R13: 0000000000000001 R14: ffff946b5df80d00 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff946b5f440000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000150 CR3: 0000000016e0a000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
check_preempt_curr+0x5d/0x90
ttwu_do_wakeup.isra.93+0xf/0x100
sched_ttwu_pending+0x66/0x90
smp_call_function_single_interrupt+0x2d/0xf0
call_function_single_interrupt+0xf/0x20
RIP: 0010:_raw_spin_unlock_irqrestore+0x5/0x30
Code: 81 4e ff c3 90 c6 07 00 fb bf 01 00 00 00 e8 62 b0 57 ff 65 8b 05 f3 e0 af 50 85 c0 74 01 c3 e8 a1 81 4e ff c3 c6 07 00 56 9d <bf> 01 00 00 00 e8 41 b0 57 ff 65 8b 05 d2 e0 af 50 85 c0 74 01 c3
RSP: 0018:ffffaccdc02ece80 EFLAGS: 00000287 ORIG_RAX: ffffffffffffff04
RAX: 0000000000000001 RBX: ffff946b5df50000 RCX: ffff946b5ed62700
RDX: 00000000000000fb RSI: 0000000000000287 RDI: ffff946b5df50784
RBP: 0000000000000009 R08: 0000166489fdaf46 R09: ffff946b5f45cf28
R10: ffffaccdc02ecf18 R11: ffffaccdc06a3c40 R12: 0000000000000000
R13: ffff946b5df50784 R14: 0000000000000287 R15: ffff946b5f5e9300
? call_function_single_interrupt+0xa/0x20
try_to_wake_up+0x205/0x510
? trace_raw_output_hrtimer_start+0x70/0x70
? trace_raw_output_hrtimer_start+0x70/0x70
call_timer_fn+0x28/0x150
run_timer_softirq+0x17b/0x220
? kvm_clock_read+0x14/0x30
? ktime_get+0x31/0x90
? hpet_assign_irq+0x90/0x90
? lapic_next_event+0x17/0x20
__do_softirq+0xf7/0x322
do_softirq_own_stack+0x2a/0x40
</IRQ>
do_softirq.part.15+0x32/0x40
__local_bh_enable_ip+0x6b/0x80
rcutorture_one_extend+0x1a1/0x2e0
rcu_torture_one_read+0x186/0x3a0
? rcu_torture_one_read+0x3a0/0x3a0
rcu_torture_reader+0x9d/0x1d0
? rcu_torture_stats+0x50/0x50
kthread+0x134/0x160
? kthread_create_on_node+0x60/0x60
ret_from_fork+0x22/0x30
Modules linked in:
CR2: 0000000000000150
---[ end trace 04d9c8a56ef5df54 ]---
RIP: 0010:check_preempt_wakeup+0xb1/0x180
Code: 83 ea 01 48 8b 9b 48 01 00 00 39 d0 75 f2 48 39 bb 50 01 00 00 75 05 48 85 ff 75 29 48 8b ad 48 01 00 00 48 8b 9b 48 01 00 00 <48> 8b bd 50 01 00 00 48 39 bb 50 01 00 00 0f 95 c2 48 85 ff 0f 94
RSP: 0018:ffffaccdc02ecd38 EFLAGS: 00010006
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffafa0bc20
RDX: 0000000000000000 RSI: ffff946b5df50000 RDI: ffff946b5f469340
RBP: 0000000000000000 R08: ffff946b5df80d00 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: ffff946b5f469300
R13: 0000000000000001 R14: ffff946b5df80d00 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff946b5f440000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000150 CR3: 0000000016e0a000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Kernel panic - not syncing: Fatal exception in interrupt
Kernel Offset: 0x2da00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
next reply other threads:[~2020-06-04 22:54 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-04 22:54 Paul E. McKenney [this message]
2020-06-05 10:38 ` BUG: kernel NULL pointer dereference from check_preempt_wakeup() Peter Zijlstra
2020-06-05 10:56 ` Peter Zijlstra
2020-06-05 13:14 ` Peter Zijlstra
2020-06-05 14:16 ` Paul E. McKenney
2020-06-05 18:41 ` Paul E. McKenney
[not found] ` <20200606005126.GA21507@paulmck-ThinkPad-P72>
2020-06-06 17:29 ` Paul E. McKenney
2020-06-07 18:57 ` Paul E. McKenney
2020-06-09 15:40 ` Paul E. McKenney
2020-06-13 2:48 ` Paul E. McKenney
2020-06-13 7:26 ` Thomas Gleixner
2020-06-13 14:57 ` Paul E. McKenney
2020-06-13 23:40 ` Paul E. McKenney
2020-06-15 8:29 ` Peter Zijlstra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200604225445.GA32319@paulmck-ThinkPad-P72 \
--to=paulmck@kernel.org \
--cc=bsegall@google.com \
--cc=dietmar.eggemann@arm.com \
--cc=juri.lelli@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mgorman@suse.de \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=rostedt@goodmis.org \
--cc=tglx@linutronix.de \
--cc=vincent.guittot@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox