[peterz-queue:locking/core] [futex] 58141fa298: Oops:general_protection_fault,probably_for_non-canonical_address#:#[##]SMP

[peterz-queue:locking/core] [futex] 58141fa298: Oops:general_protection_fault,probably_for_non-canonical_address#:#[##]SMP

[kernel test robot]

Hello,

kernel test robot noticed "Oops:general_protection_fault,probably_for_non-canonical_address#:#[##]SMP" on:

commit: 58141fa298f3f1df4ee145835eb3491cfe68f652 ("futex: Use runtime constants for __futex_hash() hot path")
https://git.kernel.org/cgit/linux/kernel/git/peterz/queue.git locking/core

in testcase: boot

config: x86_64-randconfig-012-20260704
compiler: gcc-14
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 32G

(please refer to attached dmesg/kmsg for entire log/backtrace)



If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202607091538.58e3f39-lkp@intel.com



[    1.259631][    T1] Running RCU Tasks Trace wait API self tests
[    1.261867][    T1] posixtimers hash table entries: 1024 (order: 5, 81920 bytes, linear)
[    1.264376][    T1] Oops: general protection fault, probably for non-canonical address 0x123456789abcdef: 0000 [#1] SMP
[    1.267507][    T1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc1+ #1 PREEMPTLAZY
[    1.267699][    T1] RIP: futex_init+0x1e4/0x2c0
[    1.267699][    T1] Code: c1 e7 07 4c 01 e7 e8 bb f7 5c fb 4c 89 f6 48 89 ef e8 b0 f6 5f fb 4c 39 f5 75 d9 e8 a6 f4 5f fb 89 d8 8d 53 01 be 00 04 00 00 <4d> 89 24 c7 48 63 d2 48 c7 c7 80 f1 3c 85 e8 c9 fb 22 fc e9 2c ff
All code
========
   0:	c1 e7 07             	shl    $0x7,%edi
   3:	4c 01 e7             	add    %r12,%rdi
   6:	e8 bb f7 5c fb       	call   0xfffffffffb5cf7c6
   b:	4c 89 f6             	mov    %r14,%rsi
   e:	48 89 ef             	mov    %rbp,%rdi
  11:	e8 b0 f6 5f fb       	call   0xfffffffffb5ff6c6
  16:	4c 39 f5             	cmp    %r14,%rbp
  19:	75 d9                	jne    0xfffffffffffffff4
  1b:	e8 a6 f4 5f fb       	call   0xfffffffffb5ff4c6
  20:	89 d8                	mov    %ebx,%eax
  22:	8d 53 01             	lea    0x1(%rbx),%edx
  25:	be 00 04 00 00       	mov    $0x400,%esi
  2a:*	4d 89 24 c7          	mov    %r12,(%r15,%rax,8)		<-- trapping instruction
  2e:	48 63 d2             	movslq %edx,%rdx
  31:	48 c7 c7 80 f1 3c 85 	mov    $0xffffffff853cf180,%rdi
  38:	e8 c9 fb 22 fc       	call   0xfffffffffc22fc06
  3d:	e9                   	.byte 0xe9
  3e:	2c ff                	sub    $0xff,%al

Code starting with the faulting instruction
===========================================
   0:	4d 89 24 c7          	mov    %r12,(%r15,%rax,8)
   4:	48 63 d2             	movslq %edx,%rdx
   7:	48 c7 c7 80 f1 3c 85 	mov    $0xffffffff853cf180,%rdi
   e:	e8 c9 fb 22 fc       	call   0xfffffffffc22fbdc
  13:	e9                   	.byte 0xe9
  14:	2c ff                	sub    $0xff,%al
[    1.267699][    T1] RSP: 0000:ffffc90000013de8 EFLAGS: 00010246
[    1.267699][    T1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[    1.267699][    T1] RDX: 0000000000000001 RSI: 0000000000000400 RDI: 0000000000000000
[    1.267699][    T1] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[    1.267699][    T1] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888100450000
[    1.267699][    T1] R13: 0000000000010000 R14: 0000000000000200 R15: 0123456789abcdef
[    1.267699][    T1] FS:  0000000000000000(0000) GS:ffff888899778000(0000) knlGS:0000000000000000
[    1.267699][    T1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    1.267699][    T1] CR2: ffff88883ffff000 CR3: 0000000004ab8000 CR4: 00000000000406b0
[    1.267699][    T1] Call Trace:
[    1.267699][    T1]  <TASK>
[    1.267699][    T1]  ? fail_futex_debugfs+0x80/0x80
[    1.267699][    T1]  do_one_initcall+0x62/0x280
[    1.267699][    T1]  do_initcalls+0x177/0x1c0
[    1.267699][    T1]  kernel_init_freeable+0x11c/0x1c0


The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20260709/202607091538.58e3f39-lkp@intel.com



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [peterz-queue:locking/core] [futex] 58141fa298: Oops:general_protection_fault,probably_for_non-canonical_address#:#[##]SMP

[K Prateek Nayak]

Hello Oliver,

On 7/9/2026 1:47 PM, kernel test robot wrote:
> [    1.259631][    T1] Running RCU Tasks Trace wait API self tests
> [    1.261867][    T1] posixtimers hash table entries: 1024 (order: 5, 81920 bytes, linear)
> [    1.264376][    T1] Oops: general protection fault, probably for non-canonical address 0x123456789abcdef: 0000 [#1] SMP

Thank you for the report! This is an unpatched address for the runtime
constant which suggests we are using the address before it is patched.
Following seems to solve it for me on your config:

  (Prepared on top of queue:locking/core)

diff --git a/kernel/futex/core.c b/kernel/futex/core.c
index c6af6edf5d7ae..0864c6e8cde78 100644
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -2027,6 +2027,8 @@ static int __init futex_init(void)
 	runtime_const_init(mask,  __futex_mask);
 	runtime_const_init(ptr,   __futex_queues);
 
+	barrier();
+
 	BUG_ON(!futex_queues());
 
 	for_each_node(n) {
---

Could you please check if this is the same issue you are hitting too?

My default config seems to have been much less aggressive at
optimization to have exposed this problem.

-- 
Thanks and Regards,
Prateek