* Re: [CRASH] kunit failures in platform-device-devm
2026-03-01 14:06 [CRASH] kunit failures in platform-device-devm Alice Ryhl
@ 2026-03-01 20:17 ` Greg Kroah-Hartman
2026-03-01 21:21 ` Alice Ryhl
2026-03-02 12:31 ` Sasha Levin
` (2 subsequent siblings)
3 siblings, 1 reply; 10+ messages in thread
From: Greg Kroah-Hartman @ 2026-03-01 20:17 UTC (permalink / raw)
To: Alice Ryhl; +Cc: Rafael J. Wysocki, Danilo Krummrich, driver-core, linux-kernel
On Sun, Mar 01, 2026 at 02:06:49PM +0000, Alice Ryhl wrote:
> Hi DRIVER CORE, KOBJECTS, DEBUGFS AND SYSFS,
>
> I've experienced a fair number of different crashes when running kunit
> locally. I just ran this command on v7.0-rc1 or upstream/master:
>
> ./tools/testing/kunit/kunit.py run --make_options LLVM=1 --arch x86_64 --kconfig_add CONFIG_RUST=y --kconfig_add CONFIG_PCI=y
>
> Please find a sample crash below, but I've seen a fair number of
> different crashes.
>
> [13:19:32] ============ platform-device-devm (4 subtests) =============
> [13:19:32] Oops: general protection fault, probably for non-canonical address 0xb4c3c33fcc9f57f6: 0000 [#3] SMP PTI
> [13:19:32] CPU: 0 UID: 0 PID: 2500 Comm: kunit_try_catch Tainted: G D W N 7.0.0-rc1-00138-g0c21570fbd3d-dirty #3 PREEMPT(lazy)
> [13:19:32] Tainted: [D]=DIE, [W]=WARN, [N]=TEST
> [13:19:32] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.1 11/11/2019
> [13:19:32] RIP: 0010:queued_spin_lock_slowpath+0x120/0x1c0
> [13:19:32] Code: c8 c1 e8 10 66 87 47 02 66 85 c0 74 40 0f b7 c0 89 c6 83 e6 03 c1 e6 04 83 e0 fc 49 c7 c0 f8 ff ff ff 49 8b 84 40 80 89 e4 8b <48> 89 94 06 c0 fd 44 8c 83 7a 08 00 75 08 f3 90 83 7a 08 00 74 f8
> [13:19:32] RSP: 0000:ffffb222800e3cb0 EFLAGS: 00010206
> [13:19:32] RAX: b4c3c340405a5a26 RBX: ffffb222800e3ce8 RCX: 0000000000050000
> [13:19:32] RDX: ffffa0a4fec1ddd0 RSI: 0000000000000010 RDI: ffffa0a4c2b43340
> [13:19:32] RBP: 0000000000000000 R08: fffffffffffffff8 R09: ffffffff8bbbd99f
> [13:19:32] R10: 0000000000000000 R11: ffffffff8bb32010 R12: ffffa0a4c2b43340
> [13:19:32] R13: ffffb222800e3ce8 R14: ffffa0a4c122bde8 R15: 39206b6f20202020
> [13:19:32] FS: 0000000000000000(0000) GS:ffffa0a5727ce000(0000) knlGS:0000000000000000
> [13:19:32] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [13:19:32] CR2: 00007ffff7ffe000 CR3: 000000000922c000 CR4: 00000000000006f0
> [13:19:32] Call Trace:
> [13:19:32] <TASK>
> [13:19:32] klist_iter_exit+0x2c/0x70
> [13:19:32] ? __pfx___device_attach_driver+0x10/0x10
> [13:19:32] bus_for_each_drv+0x12a/0x160
> [13:19:32] __device_attach+0xbf/0x160
> [13:19:32] device_initial_probe+0x2f/0x50
> [13:19:32] bus_probe_device+0x8f/0x110
> [13:19:32] device_add+0x23f/0x3d0
> [13:19:32] platform_device_add+0x137/0x1d0
> [13:19:32] platform_device_devm_register_unregister_test+0x6c/0x2e0
> [13:19:32] ? kunit_add_action_or_reset+0x12/0x30
> [13:19:32] ? kunit_kmalloc_array+0x34/0x60
> [13:19:32] kunit_try_run_case+0x8f/0x190
> [13:19:32] kunit_generic_run_threadfn_adapter+0x1d/0x40
> [13:19:32] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
> [13:19:32] kthread+0x142/0x160
> [13:19:32] ? __pfx_kthread+0x10/0x10
> [13:19:32] ret_from_fork+0xc7/0x1f0
> [13:19:32] ? __pfx_kthread+0x10/0x10
> [13:19:32] ret_from_fork_asm+0x1a/0x30
> [13:19:32] </TASK>
> [13:19:32] ---[ end trace 0000000000000000 ]---
> [13:19:32] RIP: 0010:kunit_test_null_dereference+0x15/0x80
> [13:19:32] Code: 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 83 ec 10 65 48 8b 05 c0 19 b1 00 48 89 44 24 08 <c7> 04 25 00 00 00 00 00 00 00 00 48 c7 87 a0 01 00 00 b8 2b e1 8b
> [13:19:32] RSP: 0000:ffffb222800f3ed8 EFLAGS: 00010286
> [13:19:32] RAX: 544a2a581abcdc00 RBX: ffffa0a4c1a9d4c0 RCX: 0000000000000001
> [13:19:32] RDX: ffffa0a4fec1d1c0 RSI: 0000000000000282 RDI: ffffb22280013c28
> [13:19:32] RBP: ffffa0a4c122bd80 R08: ffffa0a4c1260cc0 R09: 0000000000000800
> [13:19:32] R10: 0000000000000000 R11: ffffffff8b934650 R12: ffffa0a4c12612ec
> [13:19:32] R13: ffffa0a4c122bda8 R14: ffffa0a4c1a9d4c0 R15: ffffa0a4c1260c40
> [13:19:32] FS: 0000000000000000(0000) GS:ffffa0a5727ce000(0000) knlGS:0000000000000000
> [13:19:32] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [13:19:32] CR2: 00007ffff7ffe000 CR3: 000000000922c000 CR4: 00000000000006f0
> [13:19:32] note: kunit_try_catch[2500] exited with preempt_count 1
> [13:19:32] # platform_device_devm_register_unregister_test: try faulted: last line seen drivers/base/test/platform-device-test.c:65
> [13:19:32] # platform_device_devm_register_unregister_test: internal error occurred preventing test case from running: -4
> [13:19:32] [FAILED] platform_device_devm_register_unregister_test
> Command '['qemu-system-x86_64', '-nodefaults', '-m', '1024', '-kernel', '.kunit/arch/x86/boot/bzImage', '-append', 'kunit.enable=1 console=ttyS0 kunit_shutdown=reboot', '-no-reboot', '-nographic', '-accel', 'kvm', '-accel', 'hvf', '-accel', 'tcg', '-serial', 'stdio', '-bios', 'qboo
> t.rom']' timed out after 300 seconds
> [13:23:30] [ERROR] Test: platform-device-devm: missing expected subtest!
> [13:23:30] sysfs: cannot create duplicate filename '/devices/platform/test'
> [13:23:30] CPU: 0 UID: 0 PID: 2502 Comm: kunit_try_catch Tainted: G D W N 7.0.0-rc1-00138-g0c21570fbd3d-dirty #3 PREEMPT(lazy)
> [13:23:30] Tainted: [D]=DIE, [W]=WARN, [N]=TEST
> [13:23:30] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.1 11/11/2019
> [13:23:30] Call Trace:
> [13:23:30] <TASK>
> [13:23:30] dump_stack_lvl+0x2d/0x70
> [13:23:30] sysfs_create_dir_ns+0xe8/0x130
> [13:23:30] kobject_add_internal+0x1dd/0x360
> [13:23:30] kobject_add+0x88/0xf0
> [13:23:30] device_add+0x171/0x3d0
> [13:23:30] platform_device_add+0x137/0x1d0
> [13:23:30] platform_device_devm_register_get_unregister_with_devm_test+0x6c/0x2f0
> [13:23:30] ? kunit_add_action_or_reset+0x12/0x30
> [13:23:30] ? kunit_kmalloc_array+0x34/0x60
> [13:23:30] kunit_try_run_case+0x8f/0x190
> [13:23:30] kunit_generic_run_threadfn_adapter+0x1d/0x40
> [13:23:30] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
> [13:23:30] kthread+0x142/0x160
> [13:23:30] ? __pfx_kthread+0x10/0x10
> [13:23:30] ret_from_fork+0xc7/0x1f0
> [13:23:30] ? __pfx_kthread+0x10/0x10
> [13:23:30] ret_from_fork_asm+0x1a/0x30
> [13:23:30] </TASK>
> [13:23:30] kobject: kobject_add_internal failed for test with -EEXIST, don't try to register things with the same name in the same directory.
> [13:23:30] # platform_device_devm_register_get_unregister_with_devm_test: ASSERTION FAILED at drivers/base/test/platform-device-test.c:97
> [13:23:30] Expected ret == 0, but
> [13:23:30] ret == -17 (0xffffffffffffffef)
> [13:23:30] qemu-system-x86_64: terminating on signal 15 from pid 2622478 (python3)
> [13:23:30] [CRASHED]
> [13:23:30] [ERROR] Test: platform-device-devm: missing expected subtest!
> [13:23:30] [CRASHED]
> [13:23:30] [ERROR] Test: platform-device-devm: missing expected subtest!
> [13:23:30] [CRASHED]
> [13:23:30] [ERROR] Test: platform-device-devm: missing subtest result line!
> [13:23:30] # module: platform_device_test
> [13:23:30] ============== [CRASHED] platform-device-devm ==============
> [13:23:30] [ERROR] Test: main: missing expected subtest!
> [13:23:30] [CRASHED]
> [13:23:30] [ERROR] Test: main: missing expected subtest!
> [13:23:30] [CRASHED]
> [13:23:30] [ERROR] Test: main: missing expected subtest!
> [13:23:30] [CRASHED]
> [13:23:30] ============================================================
> [13:23:30] Testing complete. Ran 1239 tests: passed: 1154, failed: 2, crashed: 6, skipped: 77, errors: 7
> [13:23:30] Failures: kunit_platform_driver.kunit_platform_device_prepare_wait_for_probe_completes_when_already_probed, platform-device-devm, , ,
> The kernel seems to have crashed; you can decode the stack traces with:
> $ scripts/decode_stacktrace.sh .kunit/vmlinux .kunit < .kunit/test.log | tee .kunit/decoded.log | ./tools/testing/kunit/kunit.py parse
> [13:23:30] Elapsed time: 367.085s total, 0.002s configuring, 67.017s building, 300.065s running
>
Odd, does this also crash on 6.19?
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [CRASH] kunit failures in platform-device-devm
2026-03-01 20:17 ` Greg Kroah-Hartman
@ 2026-03-01 21:21 ` Alice Ryhl
0 siblings, 0 replies; 10+ messages in thread
From: Alice Ryhl @ 2026-03-01 21:21 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Rafael J. Wysocki, Danilo Krummrich, driver-core, linux-kernel
On Sun, Mar 01, 2026 at 03:17:53PM -0500, Greg Kroah-Hartman wrote:
> On Sun, Mar 01, 2026 at 02:06:49PM +0000, Alice Ryhl wrote:
> > Hi DRIVER CORE, KOBJECTS, DEBUGFS AND SYSFS,
> >
> > I've experienced a fair number of different crashes when running kunit
> > locally. I just ran this command on v7.0-rc1 or upstream/master:
So I saw that there was a driver-core fixes PR that just landed, which
was not included in my previous run. But I'm still getting crashes with
that included. Please see the crash below, which was taken on commit
eb71ab2bf722 with no additional changes.
> > ./tools/testing/kunit/kunit.py run --make_options LLVM=1 --arch x86_64 --kconfig_add CONFIG_RUST=y --kconfig_add CONFIG_PCI=y
> >
> > Please find a sample crash below, but I've seen a fair number of
> > different crashes.
> >
>
> Odd, does this also crash on 6.19?
Nope.
I guess I'll start a bisect script and let you know tomorrow what it has
got to say.
Crash from commit eb71ab2bf722:
[16:45:05] ============ pm_runtime_test_cases (6 subtests) ============
[16:45:05] [PASSED] pm_runtime_depth_test
[16:45:05] [PASSED] pm_runtime_already_suspended_test
[16:45:05] [PASSED] pm_runtime_idle_test
[16:45:05] [PASSED] pm_runtime_disabled_test
[16:45:09] [ERROR] Test: pm_runtime_test_cases: missing expected subtest!
[16:45:09] ------------[ cut here ]------------
[16:45:09] refcount_t: addition on 0; use-after-free.
[16:45:09] WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x52/0xa0, CPU#0: kunit_try_catch/2462
[16:45:09] CPU: 0 UID: 0 PID: 2462 Comm: kunit_try_catch Tainted: G D W N 7.0.0-rc1-00375-geb71ab2bf722 #5 PREEMPT(lazy)
[16:45:09] Tainted: [D]=DIE, [W]=WARN, [N]=TEST
[16:45:09] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.1 11/11/2019
[16:45:09] RIP: 0010:refcount_warn_saturate (??:?)
[16:45:09] Code: b9 3a e9 51 66 2d 00 cc 85 f6 74 3b 83 fe 01 75 48 48 8d 3d 60 ec 99 00 67 48 0f b9 3a c3 cc cc cc cc cc 48 8d 3d 5e ec 99 00 <67> 48 0f b9 3a c3 cc cc cc cc cc 48 8d 3d 5c ec 99 00 67 48 0f b9
[16:45:09] All code
[16:45:09] ========
[16:45:09] 0: b9 3a e9 51 66 mov $0x6651e93a,%ecx
[16:45:09] 5: 2d 00 cc 85 f6 sub $0xf685cc00,%eax
[16:45:09] a: 74 3b je 0x47
[16:45:09] c: 83 fe 01 cmp $0x1,%esi
[16:45:09] f: 75 48 jne 0x59
[16:45:09] 11: 48 8d 3d 60 ec 99 00 lea 0x99ec60(%rip),%rdi # 0x99ec78
[16:45:09] 18: 67 48 0f b9 3a ud1 (%edx),%rdi
[16:45:09] 1d: c3 ret
[16:45:09] 1e: cc int3
[16:45:09] 1f: cc int3
[16:45:09] 20: cc int3
[16:45:09] 21: cc int3
[16:45:09] 22: cc int3
[16:45:09] 23: 48 8d 3d 5e ec 99 00 lea 0x99ec5e(%rip),%rdi # 0x99ec88
[16:45:09] 2a:* 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
[16:45:09] 2f: c3 ret
[16:45:09] 30: cc int3
[16:45:09] 31: cc int3
[16:45:09] 32: cc int3
[16:45:09] 33: cc int3
[16:45:09] 34: cc int3
[16:45:09] 35: 48 8d 3d 5c ec 99 00 lea 0x99ec5c(%rip),%rdi # 0x99ec98
[16:45:09] 3c: 67 addr32
[16:45:09] 3d: 48 rex.W
[16:45:09] 3e: 0f .byte 0xf
[16:45:09] 3f: b9 .byte 0xb9
[16:45:09]
[16:45:09] Code starting with the faulting instruction
[16:45:09] ===========================================
[16:45:09] 0: 67 48 0f b9 3a ud1 (%edx),%rdi
[16:45:09] 5: c3 ret
[16:45:09] 6: cc int3
[16:45:09] 7: cc int3
[16:45:09] 8: cc int3
[16:45:09] 9: cc int3
[16:45:09] a: cc int3
[16:45:09] b: 48 8d 3d 5c ec 99 00 lea 0x99ec5c(%rip),%rdi # 0x99ec6e
[16:45:09] 12: 67 addr32
[16:45:09] 13: 48 rex.W
[16:45:09] 14: 0f .byte 0xf
[16:45:09] 15: b9 .byte 0xb9
[16:45:09] RSP: 0000:ffff94de400fbcc0 EFLAGS: 00010046
[16:45:09] RAX: 0000000000000000 RBX: ffff94de400fbd00 RCX: 0000000000000001
[16:45:09] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffffffffaa556b10
[16:45:09] RBP: ffff8b5941a415a8 R08: ffffffffaa903b00 R09: ffffffffa9e5a7bf
[16:45:09] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000246
[16:45:09] R13: ffff8b5941a415c0 R14: 0000000000000000 R15: 0000000000000000
[16:45:09] FS: 0000000000000000(0000) GS:ffff8b59d4323000(0000) knlGS:0000000000000000
[16:45:09] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[16:45:09] CR2: 00007ffff7ffe000 CR3: 000000002dc2c000 CR4: 00000000000006f0
[16:45:09] Call Trace:
[16:45:09] <TASK>
[16:45:09] klist_next (??:?)
[16:45:09] ? __pfx___device_attach_driver (dd.c:?)
[16:45:09] bus_for_each_drv (??:?)
[16:45:09] __device_attach (dd.c:?)
[16:45:09] device_initial_probe (??:?)
[16:45:09] bus_probe_device (??:?)
[16:45:09] device_add (??:?)
[16:45:09] kunit_device_register_internal (device.c:?)
[16:45:09] kunit_device_register (??:?)
[16:45:09] pm_runtime_error_test (runtime-test.c:?)
[16:45:09] ? __pfx_read_tsc (tsc.c:?)
[16:45:09] ? ktime_get_ts64 (??:?)
[16:45:09] kunit_try_run_case (test.c:?)
[16:45:09] kunit_generic_run_threadfn_adapter (try-catch.c:?)
[16:45:09] ? __pfx_kunit_generic_run_threadfn_adapter (try-catch.c:?)
[16:45:09] kthread (kthread.c:?)
[16:45:09] ? __pfx_kthread (kthread.c:?)
[16:45:09] ret_from_fork (??:?)
[16:45:09] ? __pfx_kthread (kthread.c:?)
[16:45:09] ret_from_fork_asm (??:?)
[16:45:09] </TASK>
[16:45:09] ---[ end trace 0000000000000000 ]---
[16:45:09] BUG: kernel NULL pointer dereference, address: 0000000000000020
[16:45:09] #PF: supervisor read access in kernel mode
[16:45:09] #PF: error_code(0x0000) - not-present page
[16:45:09] PGD 0 P4D 0
[16:45:09] Oops: Oops: 0000 [#3] SMP PTI
[16:45:09] CPU: 0 UID: 0 PID: 2462 Comm: kunit_try_catch Tainted: G D W N 7.0.0-rc1-00375-geb71ab2bf722 #5 PREEMPT(lazy)
[16:45:09] Tainted: [D]=DIE, [W]=WARN, [N]=TEST
[16:45:09] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.1 11/11/2019
[16:45:09] RIP: 0010:klist_iter_exit (??:?)
[16:45:09] Code: 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 41 57 41 56 41 54 53 4c 8b 77 08 4d 85 f6 74 46 48 89 fb 4d 8b 26 49 83 e4 fe <4d> 8b 7c 24 20 4c 89 e7 e8 a4 48 03 00 4c 89 f7 e8 2c 01 00 00 89
[16:45:09] All code
[16:45:09] ========
[16:45:09] 0: 90 nop
[16:45:09] 1: 90 nop
[16:45:09] 2: 90 nop
[16:45:09] 3: 90 nop
[16:45:09] 4: 90 nop
[16:45:09] 5: 90 nop
[16:45:09] 6: 90 nop
[16:45:09] 7: 90 nop
[16:45:09] 8: 90 nop
[16:45:09] 9: 90 nop
[16:45:09] a: 90 nop
[16:45:09] b: f3 0f 1e fa endbr64
[16:45:09] f: 55 push %rbp
[16:45:09] 10: 41 57 push %r15
[16:45:09] 12: 41 56 push %r14
[16:45:09] 14: 41 54 push %r12
[16:45:09] 16: 53 push %rbx
[16:45:09] 17: 4c 8b 77 08 mov 0x8(%rdi),%r14
[16:45:09] 1b: 4d 85 f6 test %r14,%r14
[16:45:09] 1e: 74 46 je 0x66
[16:45:09] 20: 48 89 fb mov %rdi,%rbx
[16:45:09] 23: 4d 8b 26 mov (%r14),%r12
[16:45:09] 26: 49 83 e4 fe and $0xfffffffffffffffe,%r12
[16:45:09] 2a:* 4d 8b 7c 24 20 mov 0x20(%r12),%r15 <-- trapping instruction
[16:45:09] 2f: 4c 89 e7 mov %r12,%rdi
[16:45:09] 32: e8 a4 48 03 00 call 0x348db
[16:45:09] 37: 4c 89 f7 mov %r14,%rdi
[16:45:09] 3a: e8 2c 01 00 00 call 0x16b
[16:45:09] 3f: 89 .byte 0x89
[16:45:09]
[16:45:09] Code starting with the faulting instruction
[16:45:09] ===========================================
[16:45:09] 0: 4d 8b 7c 24 20 mov 0x20(%r12),%r15
[16:45:09] 5: 4c 89 e7 mov %r12,%rdi
[16:45:09] 8: e8 a4 48 03 00 call 0x348b1
[16:45:09] d: 4c 89 f7 mov %r14,%rdi
[16:45:09] 10: e8 2c 01 00 00 call 0x141
[16:45:09] 15: 89 .byte 0x89
[16:45:09] RSP: 0000:ffff94de400fbcd0 EFLAGS: 00010246
[16:45:09] RAX: ffff8b5941a415a8 RBX: ffff94de400fbd00 RCX: 0000000000000001
[16:45:09] RDX: 0000000000000000 RSI: 0000000000000246 RDI: ffff94de400fbd00
[16:45:09] RBP: 0000000000000000 R08: ffffffffaa903b00 R09: ffffffffa9e5a7bf
[16:45:09] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[16:45:09] R13: ffff94de400fbd00 R14: ffff8b5941a415a8 R15: ffff8b5941892600
[16:45:09] FS: 0000000000000000(0000) GS:ffff8b59d4323000(0000) knlGS:0000000000000000
[16:45:09] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[16:45:09] CR2: 0000000000000020 CR3: 000000002dc2c000 CR4: 00000000000006f0
[16:45:09] Call Trace:
[16:45:09] <TASK>
[16:45:09] ? __pfx___device_attach_driver (dd.c:?)
[16:45:09] bus_for_each_drv (??:?)
[16:45:09] __device_attach (dd.c:?)
[16:45:09] device_initial_probe (??:?)
[16:45:09] bus_probe_device (??:?)
[16:45:09] device_add (??:?)
[16:45:09] kunit_device_register_internal (device.c:?)
[16:45:09] kunit_device_register (??:?)
[16:45:09] pm_runtime_error_test (runtime-test.c:?)
[16:45:09] ? __pfx_read_tsc (tsc.c:?)
[16:45:09] ? ktime_get_ts64 (??:?)
[16:45:09] kunit_try_run_case (test.c:?)
[16:45:09] kunit_generic_run_threadfn_adapter (try-catch.c:?)
[16:45:09] ? __pfx_kunit_generic_run_threadfn_adapter (try-catch.c:?)
[16:45:09] kthread (kthread.c:?)
[16:45:09] ? __pfx_kthread (kthread.c:?)
[16:45:09] ret_from_fork (??:?)
[16:45:09] ? __pfx_kthread (kthread.c:?)
[16:45:09] ret_from_fork_asm (??:?)
[16:45:09] </TASK>
[16:45:09] CR2: 0000000000000020
[16:45:09] ---[ end trace 0000000000000000 ]---
[16:45:09] RIP: 0010:kunit_test_null_dereference (kunit-test.c:?)
[16:45:09] Code: 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 83 ec 10 65 48 8b 05 60 93 d2 00 48 89 44 24 08 <c7> 04 25 00 00 00 00 00 00 00 00 48 c7 87 a0 01 00 00 9c da 24 aa
[16:45:09] All code
[16:45:09] ========
[16:45:09] 0: 00 00 add %al,(%rax)
[16:45:09] 2: 00 00 add %al,(%rax)
[16:45:09] 4: 00 90 90 90 90 90 add %dl,-0x6f6f6f70(%rax)
[16:45:09] a: 90 nop
[16:45:09] b: 90 nop
[16:45:09] c: 90 nop
[16:45:09] d: 90 nop
[16:45:09] e: 90 nop
[16:45:09] f: 90 nop
[16:45:09] 10: 90 nop
[16:45:09] 11: 90 nop
[16:45:09] 12: 90 nop
[16:45:09] 13: 90 nop
[16:45:09] 14: 90 nop
[16:45:09] 15: f3 0f 1e fa endbr64
[16:45:09] 19: 48 83 ec 10 sub $0x10,%rsp
[16:45:09] 1d: 65 48 8b 05 60 93 d2 mov %gs:0xd29360(%rip),%rax # 0xd29385
[16:45:09] 24: 00
[16:45:09] 25: 48 89 44 24 08 mov %rax,0x8(%rsp)
[16:45:09] 2a:* c7 04 25 00 00 00 00 movl $0x0,0x0 <-- trapping instruction
[16:45:09] 31: 00 00 00 00
[16:45:09] 35: 48 c7 87 a0 01 00 00 movq $0xffffffffaa24da9c,0x1a0(%rdi)
[16:45:09] 3c: 9c da 24 aa
[16:45:09]
[16:45:09] Code starting with the faulting instruction
[16:45:09] ===========================================
[16:45:09] 0: c7 04 25 00 00 00 00 movl $0x0,0x0
[16:45:09] 7: 00 00 00 00
[16:45:09] b: 48 c7 87 a0 01 00 00 movq $0xffffffffaa24da9c,0x1a0(%rdi)
[16:45:09] 12: 9c da 24 aa
[16:45:09] RSP: 0000:ffff94de400ebed8 EFLAGS: 00010286
[16:45:09] RAX: e9aa2cfc638c3000 RBX: ffff8b594198b900 RCX: 0000000000000001
[16:45:09] RDX: ffff8b597ec25a40 RSI: 0000000000000286 RDI: ffff94de40013c28
[16:45:09] RBP: ffff94de400fbd50 R08: ffff8b5941983f00 R09: 0000000000000800
[16:45:09] R10: 0000000000000000 R11: ffffffffa9bc7cb0 R12: ffff8b5941983e80
[16:45:09] R13: ffff8b594198ba00 R14: ffff8b594198b900 R15: ffff8b5941a41540
[16:45:09] FS: 0000000000000000(0000) GS:ffff8b59d4323000(0000) knlGS:0000000000000000
[16:45:09] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[16:45:09] CR2: 0000000000000020 CR3: 000000002dc2c000 CR4: 00000000000006f0
[16:45:09] note: kunit_try_catch[2462] exited with irqs disabled
[16:45:09] # pm_runtime_error_test: try faulted: last line seen lib/kunit/resource.c:99
[16:45:09] # pm_runtime_error_test: internal error occurred preventing test case from running: -4
[16:45:09] qemu-system-x86_64: terminating on signal 15 from pid 2718253 (python3)
[16:45:09] [CRASHED]
[16:45:09] [ERROR] Test: pm_runtime_test_cases: missing expected subtest!
[16:45:09] [CRASHED]
[16:45:09] [ERROR] Test: pm_runtime_test_cases: missing subtest result line!
[16:45:09] # module: runtime_test
[16:45:09] ============= [CRASHED] pm_runtime_test_cases ==============
[16:45:09] [ERROR] Test: main: missing expected subtest!
[16:45:09] [CRASHED]
[16:45:09] [ERROR] Test: main: missing expected subtest!
[16:45:09] [CRASHED]
[16:45:09] [ERROR] Test: main: missing expected subtest!
[16:45:09] [CRASHED]
[16:45:09] [ERROR] Test: main: missing expected subtest!
[16:45:09] [CRASHED]
[16:45:09] [ERROR] Test: main: missing expected subtest!
[16:45:09] [CRASHED]
[16:45:09] ============================================================
[16:45:09] Testing complete. Ran 1221 tests: passed: 1136, failed: 1, crashed: 7, skipped: 77, errors: 8
[16:45:09] Failures: kunit_platform_driver.kunit_platform_device_prepare_wait_for_probe_completes_when_already_probed, pm_runtime_test_cases., pm_runtime_test_cases., , , , ,
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [CRASH] kunit failures in platform-device-devm
2026-03-01 14:06 [CRASH] kunit failures in platform-device-devm Alice Ryhl
2026-03-01 20:17 ` Greg Kroah-Hartman
@ 2026-03-02 12:31 ` Sasha Levin
2026-03-02 15:32 ` Alice Ryhl
2026-03-02 15:52 ` Alice Ryhl
3 siblings, 0 replies; 10+ messages in thread
From: Sasha Levin @ 2026-03-02 12:31 UTC (permalink / raw)
To: Alice Ryhl, Greg Kroah-Hartman, Rafael J. Wysocki,
Danilo Krummrich, driver-core, linux-kernel
Cc: Sasha Levin, Maxime Ripard, David Gow, Stephen Boyd,
Brendan Higgins, Rae Moar, linux-kselftest, kunit-dev
This response was AI-generated by bug-bot. The analysis may contain errors - please verify independently.
Hi Alice,
Thanks for the detailed report. Here is my analysis.
___
1. Bug Summary
The platform-device-devm kunit test suite crashes with a general
protection fault in queued_spin_lock_slowpath() during device
registration, followed by cascading failures including sysfs duplicate
filename errors. The root issue is test isolation: earlier kunit tests
(including the intentional NULL dereference in kunit_test_null_dereference)
corrupt kernel state, and the platform-device-devm tests use raw
platform device APIs without kunit-managed cleanup, so they cannot
recover from or survive this corrupted state. The severity is a test
infrastructure issue, not a driver core bug.
2. Stack Trace Analysis
First crash (Oops #3 — two earlier oopses already occurred):
Oops: general protection fault, probably for non-canonical address 0xb4c3c33fcc9f57f6: 0000 [#3] SMP PTI
CPU: 0 UID: 0 PID: 2500 Comm: kunit_try_catch Tainted: G D W N 7.0.0-rc1-00138-g0c21570fbd3d-dirty #3 PREEMPT(lazy)
Tainted: [D]=DIE, [W]=WARN, [N]=TEST
RIP: 0010:queued_spin_lock_slowpath+0x120/0x1c0
RAX: b4c3c340405a5a26 RBX: ffffb222800e3ce8 RCX: 0000000000050000
RDX: ffffa0a4fec1ddd0 RSI: 0000000000000010 RDI: ffffa0a4c2b43340
Call Trace:
<TASK>
klist_iter_exit+0x2c/0x70
? __pfx___device_attach_driver+0x10/0x10
bus_for_each_drv+0x12a/0x160
__device_attach+0xbf/0x160
device_initial_probe+0x2f/0x50
bus_probe_device+0x8f/0x110
device_add+0x23f/0x3d0
platform_device_add+0x137/0x1d0
platform_device_devm_register_unregister_test+0x6c/0x2e0
kunit_try_run_case+0x8f/0x190
kunit_generic_run_threadfn_adapter+0x1d/0x40
kthread+0x142/0x160
ret_from_fork+0xc7/0x1f0
ret_from_fork_asm+0x1a/0x30
</TASK>
The crash point is in queued_spin_lock_slowpath() at
kernel/locking/qspinlock.c, called from klist_iter_exit() at
lib/klist.c:311. RAX holds non-canonical address 0xb4c3c340405a5a26,
indicating corrupted klist data. The calling chain is process context:
platform_device_devm_register_unregister_test() calls
platform_device_add() -> device_add() -> bus_probe_device() ->
__device_attach() -> bus_for_each_drv() (drivers/base/bus.c:420)
which iterates the bus's klist_drivers. During klist_iter_exit(),
it tries to acquire the klist spinlock and hits corrupted memory.
Second failure (duplicate sysfs entry):
sysfs: cannot create duplicate filename '/devices/platform/test'
Call Trace:
<TASK>
dump_stack_lvl+0x2d/0x70
sysfs_create_dir_ns+0xe8/0x130
kobject_add_internal+0x1dd/0x360
kobject_add+0x88/0xf0
device_add+0x171/0x3d0
platform_device_add+0x137/0x1d0
platform_device_devm_register_get_unregister_with_devm_test+0x6c/0x2f0
kunit_try_run_case+0x8f/0x190
kunit_generic_run_threadfn_adapter+0x1d/0x40
kthread+0x142/0x160
ret_from_fork+0xc7/0x1f0
ret_from_fork_asm+0x1a/0x30
</TASK>
The assertion at drivers/base/test/platform-device-test.c:97 fails
with ret == -17 (EEXIST) because the first test crashed without
unregistering its device, leaving "/devices/platform/test" in sysfs.
3. Root Cause Analysis
This is a test isolation problem, not a driver core bug. Two issues
combine to cause the failures:
(a) Corrupted kernel state from earlier oopses. The Oops header shows
"[#3]" meaning this is the third kernel oops during the boot. The
taint flags [D]=DIE and [W]=WARN confirm prior fatal faults. The
kunit_test_null_dereference() function in lib/kunit/kunit-test.c:117
intentionally dereferences NULL to test kunit's fault handling. After
multiple oopses, kernel data structures (including the platform bus
klist) can be corrupted, which explains the non-canonical address
(0xb4c3c33fcc9f57f6) seen during spinlock acquisition.
(b) Missing test-managed cleanup. The four tests in
platform_device_devm_test_suite all use the raw kernel APIs
platform_device_alloc() and platform_device_add() directly, and all
use the same hardcoded name "test" with PLATFORM_DEVID_NONE
(drivers/base/test/platform-device-test.c:62-77). If a test crashes
before reaching platform_device_unregister(), the device remains
registered and subsequent tests cannot register a device with the
same name.
By contrast, the platform_device_find_by_null_test() in the same
file already uses the kunit-managed helpers kunit_platform_device_alloc()
and kunit_platform_device_add() from lib/kunit/platform.c (added in
commit 5ac79730324c "platform: Add test managed platform_device/driver
APIs"), which automatically unregister the device when the test exits,
even on crash.
4. Affected Versions
The platform-device-devm tests were introduced in commit b4cc44301b9d
("drivers: base: Add basic devm tests for platform devices") by
Maxime Ripard, which predates the kunit-managed platform device helpers
from commit 5ac79730324c. All kernel versions containing these tests
are affected by this test isolation issue. This is not a regression in
the driver core itself.
5. Relevant Commits and Fixes
- b4cc44301b9d ("drivers: base: Add basic devm tests for platform devices")
Introduced the test suite with raw platform device APIs.
- 699fb50d99039 ("drivers: base: Free devm resources when unregistering a device")
Fixed devm resource release for unprobed devices; updated test expectations.
- 5ac79730324c ("platform: Add test managed platform_device/driver APIs")
Added kunit_platform_device_alloc()/kunit_platform_device_add()
helpers that automatically clean up on test exit.
- 86a5f32ed8813 ("drivers: base: test: Add ...find_device_by...(... NULL) tests")
Added platform_device_find_by_null_test which already uses the
kunit-managed helpers correctly.
No fix for this specific test isolation issue exists in mainline yet.
6. Suggested Actions
The devm tests should be updated to use the kunit-managed platform
device helpers (kunit_platform_device_alloc/kunit_platform_device_add)
from include/kunit/platform_device.h, similar to how
platform_device_find_by_null_test() already does. This would ensure
proper cleanup even when tests crash.
One subtlety: the devm tests specifically test the behavior of
platform_device_unregister() releasing devm resources, so
kunit_platform_device_add() (which auto-unregisters) needs to be
used carefully — the kunit cleanup action should be removed or
disabled before the explicit unregister call to avoid double-free.
Alternatively, each test could use a unique device name via
PLATFORM_DEVID_AUTO to at least prevent the cascading sysfs duplicate
errors.
For the probed tests (probed_platform_device_devm_register_unregister_test
and probed_platform_device_devm_register_get_unregister_with_devm_test),
there is a similar need to register/unregister the fake_driver with
kunit-managed helpers like kunit_platform_driver_register().
In the short term, you can work around this by running the
platform-device-devm suite in isolation:
./tools/testing/kunit/kunit.py run --make_options LLVM=1 \
--arch x86_64 --kconfig_add CONFIG_RUST=y \
--kconfig_add CONFIG_PCI=y platform-device-devm
This avoids the corrupted state from earlier intentional-crash tests.
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [CRASH] kunit failures in platform-device-devm
2026-03-01 14:06 [CRASH] kunit failures in platform-device-devm Alice Ryhl
2026-03-01 20:17 ` Greg Kroah-Hartman
2026-03-02 12:31 ` Sasha Levin
@ 2026-03-02 15:32 ` Alice Ryhl
2026-03-03 0:45 ` David Gow
2026-03-03 0:50 ` Frederic Weisbecker
2026-03-02 15:52 ` Alice Ryhl
3 siblings, 2 replies; 10+ messages in thread
From: Alice Ryhl @ 2026-03-02 15:32 UTC (permalink / raw)
To: Greg Kroah-Hartman, Frederic Weisbecker, Waiman Long,
Marco Crivellari, Michal Hocko, Peter Zijlstra, Tejun Heo,
Thomas Gleixner, Vlastimil Babka, Rafael J. Wysocki,
Danilo Krummrich, driver-core, linux-kernel
On Sun, Mar 01, 2026 at 02:06:49PM +0000, Alice Ryhl wrote:
> Hi DRIVER CORE, KOBJECTS, DEBUGFS AND SYSFS,
>
> I've experienced a fair number of different crashes when running kunit
> locally. I just ran this command on v7.0-rc1 or upstream/master:
>
> ./tools/testing/kunit/kunit.py run --make_options LLVM=1 --arch x86_64 --kconfig_add CONFIG_RUST=y --kconfig_add CONFIG_PCI=y
Bisection has been carried out!
The culprit is commit 5564c12385b7 ("kthread: Include unbound kthreads
in the managed affinity list"). Cc'ing everyone from this commit.
On this commit, kunit (executed using above command) crashes for me 70%
of the time (14 out of 20 runs) with kernel crashes (Oops) and
refcount_t use-after-free warnings in pm_runtime_test_cases and
platform-device-devm. On the parent commit, I was able to run kunit 24
times in a row with zero kunit failures.
The same crashes occur on tag v7.0-rc2, so this issue is not fixed.
Alice
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [CRASH] kunit failures in platform-device-devm
2026-03-02 15:32 ` Alice Ryhl
@ 2026-03-03 0:45 ` David Gow
2026-03-03 10:00 ` Alice Ryhl
2026-03-03 10:32 ` Frederic Weisbecker
2026-03-03 0:50 ` Frederic Weisbecker
1 sibling, 2 replies; 10+ messages in thread
From: David Gow @ 2026-03-03 0:45 UTC (permalink / raw)
To: Alice Ryhl, Greg Kroah-Hartman, Frederic Weisbecker, Waiman Long,
Marco Crivellari, Michal Hocko, Peter Zijlstra, Tejun Heo,
Thomas Gleixner, Vlastimil Babka, Rafael J. Wysocki,
Danilo Krummrich, driver-core, linux-kernel
Le 02/03/2026 à 11:32 PM, Alice Ryhl a écrit :
> On Sun, Mar 01, 2026 at 02:06:49PM +0000, Alice Ryhl wrote:
>> Hi DRIVER CORE, KOBJECTS, DEBUGFS AND SYSFS,
>>
>> I've experienced a fair number of different crashes when running kunit
>> locally. I just ran this command on v7.0-rc1 or upstream/master:
>>
>> ./tools/testing/kunit/kunit.py run --make_options LLVM=1 --arch x86_64 --kconfig_add CONFIG_RUST=y --kconfig_add CONFIG_PCI=y
>
> Bisection has been carried out!
>
> The culprit is commit 5564c12385b7 ("kthread: Include unbound kthreads
> in the managed affinity list"). Cc'ing everyone from this commit.
>
> On this commit, kunit (executed using above command) crashes for me 70%
> of the time (14 out of 20 runs) with kernel crashes (Oops) and
> refcount_t use-after-free warnings in pm_runtime_test_cases and
> platform-device-devm. On the parent commit, I was able to run kunit 24
> times in a row with zero kunit failures.
>
> The same crashes occur on tag v7.0-rc2, so this issue is not fixed.
>
Hmm... I've not been able to reproduce any crashes with stacktraces
which look similar to yours, but given the bisection, could this be the
kthread exit use-after-free?
Could you try the patch here, and see if that fixes it:
https://lore.kernel.org/all/20260226-ungeziefer-erzfeind-13425179c7b2@brauner/
Cheers,
-- David
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [CRASH] kunit failures in platform-device-devm
2026-03-03 0:45 ` David Gow
@ 2026-03-03 10:00 ` Alice Ryhl
2026-03-03 10:32 ` Frederic Weisbecker
1 sibling, 0 replies; 10+ messages in thread
From: Alice Ryhl @ 2026-03-03 10:00 UTC (permalink / raw)
To: David Gow
Cc: Greg Kroah-Hartman, Frederic Weisbecker, Waiman Long,
Marco Crivellari, Michal Hocko, Peter Zijlstra, Tejun Heo,
Thomas Gleixner, Vlastimil Babka, Rafael J. Wysocki,
Danilo Krummrich, driver-core, linux-kernel
On Tue, Mar 03, 2026 at 08:45:42AM +0800, David Gow wrote:
> Le 02/03/2026 à 11:32 PM, Alice Ryhl a écrit :
> > On Sun, Mar 01, 2026 at 02:06:49PM +0000, Alice Ryhl wrote:
> > > Hi DRIVER CORE, KOBJECTS, DEBUGFS AND SYSFS,
> > >
> > > I've experienced a fair number of different crashes when running kunit
> > > locally. I just ran this command on v7.0-rc1 or upstream/master:
> > >
> > > ./tools/testing/kunit/kunit.py run --make_options LLVM=1 --arch x86_64 --kconfig_add CONFIG_RUST=y --kconfig_add CONFIG_PCI=y
> >
> > Bisection has been carried out!
> >
> > The culprit is commit 5564c12385b7 ("kthread: Include unbound kthreads
> > in the managed affinity list"). Cc'ing everyone from this commit.
> >
> > On this commit, kunit (executed using above command) crashes for me 70%
> > of the time (14 out of 20 runs) with kernel crashes (Oops) and
> > refcount_t use-after-free warnings in pm_runtime_test_cases and
> > platform-device-devm. On the parent commit, I was able to run kunit 24
> > times in a row with zero kunit failures.
> >
> > The same crashes occur on tag v7.0-rc2, so this issue is not fixed.
> >
>
> Hmm... I've not been able to reproduce any crashes with stacktraces which
> look similar to yours, but given the bisection, could this be the kthread
> exit use-after-free?
>
> Could you try the patch here, and see if that fixes it:
> https://lore.kernel.org/all/20260226-ungeziefer-erzfeind-13425179c7b2@brauner/
Yes, that seems to fix it. Applying that patch on v7.0-rc2 results in no
crashes for me. (16/16 success)
Alice
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [CRASH] kunit failures in platform-device-devm
2026-03-03 0:45 ` David Gow
2026-03-03 10:00 ` Alice Ryhl
@ 2026-03-03 10:32 ` Frederic Weisbecker
1 sibling, 0 replies; 10+ messages in thread
From: Frederic Weisbecker @ 2026-03-03 10:32 UTC (permalink / raw)
To: David Gow, Christian Brauner, Linus Torvalds
Cc: Alice Ryhl, Greg Kroah-Hartman, Waiman Long, Marco Crivellari,
Michal Hocko, Peter Zijlstra, Tejun Heo, Thomas Gleixner,
Vlastimil Babka, Rafael J. Wysocki, Danilo Krummrich, driver-core,
linux-kernel
Le Tue, Mar 03, 2026 at 08:45:42AM +0800, David Gow a écrit :
> Le 02/03/2026 à 11:32 PM, Alice Ryhl a écrit :
> > On Sun, Mar 01, 2026 at 02:06:49PM +0000, Alice Ryhl wrote:
> > > Hi DRIVER CORE, KOBJECTS, DEBUGFS AND SYSFS,
> > >
> > > I've experienced a fair number of different crashes when running kunit
> > > locally. I just ran this command on v7.0-rc1 or upstream/master:
> > >
> > > ./tools/testing/kunit/kunit.py run --make_options LLVM=1 --arch x86_64 --kconfig_add CONFIG_RUST=y --kconfig_add CONFIG_PCI=y
> >
> > Bisection has been carried out!
> >
> > The culprit is commit 5564c12385b7 ("kthread: Include unbound kthreads
> > in the managed affinity list"). Cc'ing everyone from this commit.
> >
> > On this commit, kunit (executed using above command) crashes for me 70%
> > of the time (14 out of 20 runs) with kernel crashes (Oops) and
> > refcount_t use-after-free warnings in pm_runtime_test_cases and
> > platform-device-devm. On the parent commit, I was able to run kunit 24
> > times in a row with zero kunit failures.
> >
> > The same crashes occur on tag v7.0-rc2, so this issue is not fixed.
> >
>
> Hmm... I've not been able to reproduce any crashes with stacktraces which
> look similar to yours, but given the bisection, could this be the kthread
> exit use-after-free?
>
> Could you try the patch here, and see if that fixes it:
> https://lore.kernel.org/all/20260226-ungeziefer-erzfeind-13425179c7b2@brauner/
Urgh, I missed that one. Thanks a lot! Can someone bounce it to me for review as
it's not on LKML? Namely it would be nice to remove kthread_exit() on the
callsites (there aren't that many) and call do_exit() directly?
Thanks.
--
Frederic Weisbecker
SUSE Labs
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [CRASH] kunit failures in platform-device-devm
2026-03-02 15:32 ` Alice Ryhl
2026-03-03 0:45 ` David Gow
@ 2026-03-03 0:50 ` Frederic Weisbecker
1 sibling, 0 replies; 10+ messages in thread
From: Frederic Weisbecker @ 2026-03-03 0:50 UTC (permalink / raw)
To: Alice Ryhl
Cc: Greg Kroah-Hartman, Waiman Long, Marco Crivellari, Michal Hocko,
Peter Zijlstra, Tejun Heo, Thomas Gleixner, Vlastimil Babka,
Rafael J. Wysocki, Danilo Krummrich, driver-core, linux-kernel
Le Mon, Mar 02, 2026 at 03:32:00PM +0000, Alice Ryhl a écrit :
> On Sun, Mar 01, 2026 at 02:06:49PM +0000, Alice Ryhl wrote:
> > Hi DRIVER CORE, KOBJECTS, DEBUGFS AND SYSFS,
> >
> > I've experienced a fair number of different crashes when running kunit
> > locally. I just ran this command on v7.0-rc1 or upstream/master:
> >
> > ./tools/testing/kunit/kunit.py run --make_options LLVM=1 --arch x86_64 --kconfig_add CONFIG_RUST=y --kconfig_add CONFIG_PCI=y
>
> Bisection has been carried out!
>
> The culprit is commit 5564c12385b7 ("kthread: Include unbound kthreads
> in the managed affinity list"). Cc'ing everyone from this commit.
>
> On this commit, kunit (executed using above command) crashes for me 70%
> of the time (14 out of 20 runs) with kernel crashes (Oops) and
> refcount_t use-after-free warnings in pm_runtime_test_cases and
> platform-device-devm. On the parent commit, I was able to run kunit 24
> times in a row with zero kunit failures.
>
> The same crashes occur on tag v7.0-rc2, so this issue is not fixed.
I can reproduce (though rather 10% of the time). Investigating...
--
Frederic Weisbecker
SUSE Labs
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [CRASH] kunit failures in platform-device-devm
2026-03-01 14:06 [CRASH] kunit failures in platform-device-devm Alice Ryhl
` (2 preceding siblings ...)
2026-03-02 15:32 ` Alice Ryhl
@ 2026-03-02 15:52 ` Alice Ryhl
3 siblings, 0 replies; 10+ messages in thread
From: Alice Ryhl @ 2026-03-02 15:52 UTC (permalink / raw)
To: Greg Kroah-Hartman, Rafael J. Wysocki, Danilo Krummrich,
driver-core, linux-kernel
On Sun, Mar 01, 2026 at 02:06:49PM +0000, Alice Ryhl wrote:
> Hi DRIVER CORE, KOBJECTS, DEBUGFS AND SYSFS,
>
> I've experienced a fair number of different crashes when running kunit
> locally. I just ran this command on v7.0-rc1 or upstream/master:
>
> ./tools/testing/kunit/kunit.py run --make_options LLVM=1 --arch x86_64 --kconfig_add CONFIG_RUST=y --kconfig_add CONFIG_PCI=y
>
One more crash signature:
<many tests succeed>
[15:45:13] =================== miscdev_test_twice ====================
[15:45:13] [PASSED] lower static range, top
[15:45:13] [PASSED] upper static range, bottom
[15:45:13] [PASSED] lower static range, bottom
[15:45:13] [PASSED] upper static range, top
[15:45:13] =============== [PASSED] miscdev_test_twice ================
[15:45:13] ============== miscdev_test_duplicate_minor ===============
[15:45:13] [PASSED] lower static range, top
[15:45:13] [PASSED] upper static range, bottom
[15:45:13] [PASSED] lower static range, bottom
[15:45:13] [PASSED] upper static range, top
[15:45:13] ========== [PASSED] miscdev_test_duplicate_minor ===========
[15:45:13] [PASSED] miscdev_test_duplicate_name
[15:45:13] [PASSED] miscdev_test_duplicate_name_leak
[15:45:13] ============== miscdev_test_duplicate_error ===============
[15:45:13] [PASSED] lower static range, top
[15:45:14] [PASSED] upper static range, bottom
[15:45:14] [PASSED] lower static range, bottom
[15:45:14] [PASSED] upper static range, top
[15:45:14] ========== [PASSED] miscdev_test_duplicate_error ===========
[15:45:14] [PASSED] miscdev_test_dynamic_reentry
[15:45:14] ===================== [PASSED] miscdev =====================
[15:45:14] =============== qos-kunit-test (3 subtests) ================
[15:45:14] [PASSED] freq_qos_test_min
[15:45:14] [PASSED] freq_qos_test_maxdef
[15:45:14] [PASSED] freq_qos_test_readd
[15:45:14] ================= [PASSED] qos-kunit-test ==================
[15:45:14] ============ pm_runtime_test_cases (6 subtests) ============
[15:45:14] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
[15:45:14] BUG: unable to handle page fault for address: ffff97f4c19d0598
[15:45:14] #PF: supervisor instruction fetch in kernel mode
[15:45:14] #PF: error_code(0x0011) - permissions violation
[15:45:14] PGD 2f601067 P4D 2f601067 PUD 2f602067 PMD 80000000018000e3
[15:45:14] Oops: Oops: 0011 [#2] SMP PTI
[15:45:14] CPU: 0 UID: 0 PID: 2171 Comm: kunit_try_catch Tainted: G D W N 6.19.0-rc2-00025-g5564c12385b7 #59 PREEMPT(lazy)
[15:45:14] Tainted: [D]=DIE, [W]=WARN, [N]=TEST
[15:45:14] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.1 11/11/2019
[15:45:14] RIP: 0010:0xffff97f4c19d0598
[15:45:14] Code: 00 00 00 00 00 00 00 00 00 00 78 05 9d c1 f4 97 ff ff 78 05 9d c1 f4 97 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <98> 05 9d c1 f4 97 ff ff 98 05 9d c1 f4 97 ff ff c0 a4 ae c2 f4 97
[15:45:14] RSP: 0000:ffffb241c00fbca0 EFLAGS: 00010282
[15:45:14] RAX: 0000000000000000 RBX: ffff97f4c18ad4e4 RCX: 0000000000000001
[15:45:14] RDX: ffffffffa1e349a0 RSI: ffff97f4c18ad400 RDI: ffff97f4c18ad400
[15:45:14] RBP: 0000000000000000 R08: ffff97f4c14dd918 R09: 000000000000002a
[15:45:14] R10: 000000000000002a R11: ffff97f4c19d0598 R12: ffff97f4c18ad590
[15:45:14] R13: ffffb241c00fbd28 R14: ffff97f4c19d0598 R15: ffff97f4c18ad400
[15:45:14] FS: 0000000000000000(0000) GS:ffff97f55c933000(0000) knlGS:0000000000000000
[15:45:14] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[15:45:14] CR2: ffff97f4c19d0598 CR3: 000000002f02a000 CR4: 00000000000006f0
[15:45:14] Call Trace:
[15:45:14] <TASK>
[15:45:14] ? __rpm_callback+0x87/0x300
[15:45:14] ? rpm_resume+0x4e9/0x6e0
[15:45:14] ? kernfs_drain+0x5e/0x140
[15:45:14] ? kernfs_drain+0x5e/0x140
[15:45:14] ? kernfs_unlink_sibling+0x8e/0xb0
[15:45:14] ? __pm_runtime_resume+0x57/0x80
[15:45:14] ? device_release_driver_internal+0x70/0x2b0
[15:45:14] ? bus_remove_device+0x14c/0x170
[15:45:14] ? device_del+0x1da/0x3b0
[15:45:14] ? __schedule+0x66b/0x750
[15:45:14] ? device_unregister+0xd/0x30
[15:45:14] ? kunit_remove_resource+0x6a/0xb0
[15:45:14] ? kunit_try_run_case_cleanup+0x7a/0xb0
[15:45:14] ? kunit_generic_run_threadfn_adapter+0x1d/0x40
[15:45:14] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[15:45:14] ? kthread+0x1d1/0x210
[15:45:14] ? __pfx_kthread+0x10/0x10
[15:45:14] ? ret_from_fork+0xce/0x1a0
[15:45:14] ? __pfx_kthread+0x10/0x10
[15:45:14] ? ret_from_fork_asm+0x1a/0x30
[15:45:14] </TASK>
[15:45:14] CR2: ffff97f4c19d0598
[15:45:14] ---[ end trace 0000000000000000 ]---
[15:45:14] RIP: 0010:kunit_test_null_dereference+0x15/0x80
[15:45:14] Code: 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 83 ec 10 65 48 8b 05 90 61 d2 00 48 89 44 24 08 <c7> 04 25 00 00 00 00 00 00 00 00 48 c7 87 a0 01 00 00 75 22 c4 a1
[15:45:14] RSP: 0000:ffffb241c010bed0 EFLAGS: 00010282
[15:45:14] RAX: 51937c0fa0337700 RBX: ffff97f4c1af77c0 RCX: 0000000000000001
[15:45:14] RDX: ffff97f4fec25840 RSI: 0000000000000286 RDI: ffffb241c0013c28
[15:45:14] RBP: ffff97f4c19d0b40 R08: ffff97f4c1ae9a00 R09: 0000000000000800
[15:45:14] R10: 0000000000000000 R11: ffffffffa15bae80 R12: ffff97f4c1ae9980
[15:45:14] R13: ffffffffa1c7bf38 R14: ffff97f4c1af77c0 R15: ffff97f4c19d0b40
[15:45:14] FS: 0000000000000000(0000) GS:ffff97f55c933000(0000) knlGS:0000000000000000
[15:45:14] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[15:45:14] CR2: ffff97f4c19d0598 CR3: 000000002f02a000 CR4: 00000000000006f0
[15:45:14] note: kunit_try_catch[2171] exited with irqs disabled
[15:45:14] # pm_runtime_depth_test: try faulted: last line seen drivers/base/power/runtime-test.c:27
[15:45:14] # pm_runtime_depth_test: internal error occurred during test case cleanup: -4
[15:45:14] [FAILED] pm_runtime_depth_test
[15:45:14] Error: Driver 'pm_runtime_test_device' is already registered, aborting...
[15:45:14] # pm_runtime_already_suspended_test: ASSERTION FAILED at drivers/base/power/runtime-test.c:35
[15:45:14] Expected dev is not error, but is: -16
[15:45:14] [FAILED] pm_runtime_already_suspended_test
[15:45:14] Error: Driver 'pm_runtime_test_device' is already registered, aborting...
[15:45:14] # pm_runtime_idle_test: ASSERTION FAILED at drivers/base/power/runtime-test.c:69
[15:45:14] Expected dev is not error, but is: -16
[15:45:14] [FAILED] pm_runtime_idle_test
[15:45:14] Error: Driver 'pm_runtime_test_device' is already registered, aborting...
[15:45:14] # pm_runtime_disabled_test: ASSERTION FAILED at drivers/base/power/runtime-test.c:90
[15:45:14] Expected dev is not error, but is: -16
[15:45:14] [FAILED] pm_runtime_disabled_test
[15:45:14] Error: Driver 'pm_runtime_test_device' is already registered, aborting...
[15:45:14] # pm_runtime_error_test: ASSERTION FAILED at drivers/base/power/runtime-test.c:130
[15:45:14] Expected dev is not error, but is: -16
[15:45:14] [FAILED] pm_runtime_error_test
[15:45:14] Error: Driver 'pm_runtime_test_device' is already registered, aborting...
[15:45:14] # pm_runtime_probe_active_test: ASSERTION FAILED at drivers/base/power/runtime-test.c:213
[15:45:14] Expected dev is not error, but is: -16
[15:45:14] [FAILED] pm_runtime_probe_active_test
[15:45:14] # module: runtime_test
[15:45:14] # pm_runtime_test_cases: pass:0 fail:6 skip:0 total:6
[15:45:14] # Totals: pass:0 fail:6 skip:0 total:6
[15:45:14] ============== [FAILED] pm_runtime_test_cases ==============
[15:45:14] ============== root-device-devm (2 subtests) ===============
[15:45:14] [PASSED] root_device_devm_register_unregister_test
[15:45:14] [PASSED] root_device_devm_register_get_unregister_with_devm_test
[15:45:14] ================ [PASSED] root-device-devm =================
[15:45:14] ============ platform-device-devm (4 subtests) =============
[15:45:14] BUG: unable to handle page fault for address: fffffffef8d4b4a6
[15:45:14] #PF: supervisor write access in kernel mode
[15:45:14] #PF: error_code(0x0002) - not-present page
[15:45:14] PGD 2f02d067 P4D 2f02d067 PUD 0
[15:45:14] Oops: Oops: 0002 [#3] SMP PTI
[15:45:14] CPU: 0 UID: 0 PID: 2186 Comm: kunit_try_catch Tainted: G D W N 6.19.0-rc2-00025-g5564c12385b7 #59 PREEMPT(lazy)
[15:45:14] Tainted: [D]=DIE, [W]=WARN, [N]=TEST
[15:45:14] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.1 11/11/2019
[15:45:14] RIP: 0010:queued_spin_lock_slowpath+0x126/0x1e0
[15:45:14] Code: d8 c1 e8 10 66 87 47 02 66 85 c0 74 40 0f b7 c0 89 c2 83 e2 03 c1 e2 04 83 e0 fc 48 c7 c6 f8 ff ff ff 48 8b 84 46 80 b9 c7 a1 <48> 89 8c 02 00 34 2f a2 83 79 08 00 75 08 f3 90 83 79 08 00 74 f8
[15:45:14] RSP: 0000:ffffb241c00fbc88 EFLAGS: 00010206
[15:45:14] RAX: ffffffff56a58086 RBX: 0000000000040000 RCX: ffff97f4fec26400
[15:45:14] RDX: 0000000000000020 RSI: fffffffffffffff8 RDI: ffff97f4c2aea700
[15:45:14] RBP: 0000000000040000 R08: 0000000000000033 R09: 00000000fffffff9
[15:45:14] R10: 0000000000000000 R11: ffffffffa17b1610 R12: ffff97f4c2aea700
[15:45:14] R13: ffffb241c00fbce0 R14: ffff97f4c19d0ba8 R15: ffff97f55c933000
[15:45:14] FS: 0000000000000000(0000) GS:ffff97f55c933000(0000) knlGS:0000000000000000
[15:45:14] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[15:45:14] CR2: fffffffef8d4b4a6 CR3: 000000002f02a000 CR4: 00000000000006f0
[15:45:14] Call Trace:
[15:45:14] <TASK>
[15:45:14] klist_iter_exit+0x2c/0x70
[15:45:14] ? __pfx___device_attach_driver+0x10/0x10
[15:45:14] bus_for_each_drv+0x12a/0x160
[15:45:14] __device_attach+0xbf/0x160
[15:45:14] device_initial_probe+0x2f/0x50
[15:45:14] bus_probe_device+0x8f/0x110
[15:45:14] device_add+0x23f/0x3d0
[15:45:14] platform_device_add+0x137/0x1d0
[15:45:14] platform_device_devm_register_unregister_test+0x6c/0x2e0
[15:45:14] ? kunit_add_action_or_reset+0x12/0x30
[15:45:14] ? kunit_kmalloc_array+0x34/0x60
[15:45:14] kunit_try_run_case+0x8f/0x190
[15:45:14] ? set_cpus_allowed_ptr+0x8c/0xb0
[15:45:14] kunit_generic_run_threadfn_adapter+0x1d/0x40
[15:45:14] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[15:45:14] kthread+0x1d1/0x210
[15:45:14] ? __pfx_kthread+0x10/0x10
[15:45:14] ret_from_fork+0xce/0x1a0
[15:45:14] ? __pfx_kthread+0x10/0x10
[15:45:14] ret_from_fork_asm+0x1a/0x30
[15:45:14] </TASK>
[15:45:14] CR2: fffffffef8d4b4a6
[15:45:14] ---[ end trace 0000000000000000 ]---
[15:45:14] RIP: 0010:kunit_test_null_dereference+0x15/0x80
[15:45:14] Code: 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 83 ec 10 65 48 8b 05 90 61 d2 00 48 89 44 24 08 <c7> 04 25 00 00 00 00 00 00 00 00 48 c7 87 a0 01 00 00 75 22 c4 a1
[15:45:14] RSP: 0000:ffffb241c010bed0 EFLAGS: 00010282
[15:45:14] RAX: 51937c0fa0337700 RBX: ffff97f4c1af77c0 RCX: 0000000000000001
[15:45:14] RDX: ffff97f4fec25840 RSI: 0000000000000286 RDI: ffffb241c0013c28
[15:45:14] RBP: ffff97f4c19d0b40 R08: ffff97f4c1ae9a00 R09: 0000000000000800
[15:45:14] R10: 0000000000000000 R11: ffffffffa15bae80 R12: ffff97f4c1ae9980
[15:45:14] R13: ffffffffa1c7bf38 R14: ffff97f4c1af77c0 R15: ffff97f4c19d0b40
[15:45:14] FS: 0000000000000000(0000) GS:ffff97f55c933000(0000) knlGS:0000000000000000
[15:45:14] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[15:45:14] CR2: fffffffef8d4b4a6 CR3: 000000002f02a000 CR4: 00000000000006f0
[15:45:14] note: kunit_try_catch[2186] exited with irqs disabled
[15:45:14] note: kunit_try_catch[2186] exited with preempt_count 1
[15:45:14] # platform_device_devm_register_unregister_test: try faulted: last line seen drivers/base/test/platform-device-test.c:65
[15:45:14] # platform_device_devm_register_unregister_test: internal error occurred preventing test case from running: -4
[15:45:14] [FAILED] platform_device_devm_register_unregister_test
<one minute passes>
Command '['qemu-system-x86_64', '-nodefaults', '-m', '1024', '-kernel', '.kunit/arch/x86/boot/bzImage', '-append', 'kunit.enable=1 console=ttyS0 kunit_shutdown=reboot', '-no-reboot', '-nographic', '-accel', 'kvm', '-accel', 'hvf', '-accel', 'tcg', '-serial', 'stdio', '-bios', 'qboot.rom']' timed out after 120 seconds
[15:46:14] [ERROR] Test: platform-device-devm: missing expected subtest!
[15:46:14] sysfs: cannot create duplicate filename '/devices/platform/test'
[15:46:14] CPU: 0 UID: 0 PID: 2188 Comm: kunit_try_catch Tainted: G D W N 6.19.0-rc2-00025-g5564c12385b7 #59 PREEMPT(lazy)
[15:46:14] Tainted: [D]=DIE, [W]=WARN, [N]=TEST
[15:46:14] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.1 11/11/2019
[15:46:14] Call Trace:
[15:46:14] <TASK>
[15:46:14] dump_stack_lvl+0x2d/0x70
[15:46:14] sysfs_create_dir_ns+0xe8/0x130
[15:46:14] kobject_add_internal+0x1dd/0x360
[15:46:14] kobject_add+0x88/0xf0
[15:46:14] device_add+0x171/0x3d0
[15:46:14] platform_device_add+0x137/0x1d0
[15:46:14] platform_device_devm_register_get_unregister_with_devm_test+0x6c/0x2f0
[15:46:14] ? kunit_add_action_or_reset+0x12/0x30
[15:46:14] ? kunit_kmalloc_array+0x34/0x60
[15:46:14] kunit_try_run_case+0x8f/0x190
[15:46:14] ? set_cpus_allowed_ptr+0x8c/0xb0
[15:46:14] kunit_generic_run_threadfn_adapter+0x1d/0x40
[15:46:14] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[15:46:14] kthread+0x1d1/0x210
[15:46:14] ? __pfx_kthread+0x10/0x10
[15:46:14] ret_from_fork+0xce/0x1a0
[15:46:14] ? __pfx_kthread+0x10/0x10
[15:46:14] ret_from_fork_asm+0x1a/0x30
[15:46:14] </TASK>
[15:46:14] kobject: kobject_add_internal failed for test with -EEXIST, don't try to register things with the same name in the same directory.
[15:46:14] # platform_device_devm_register_get_unregister_with_devm_test: ASSERTION FAILED at drivers/base/test/platform-device-test.c:97
[15:46:14] Expected ret == 0, but
[15:46:14] ret == -17 (0xffffffffffffffef)
[15:46:14] qemu-system-x86_64: terminating on signal 15 from pid 673195 (python3)
[15:46:14] [CRASHED]
[15:46:14] [ERROR] Test: platform-device-devm: missing expected subtest!
[15:46:14] [CRASHED]
[15:46:14] [ERROR] Test: platform-device-devm: missing expected subtest!
[15:46:14] [CRASHED]
[15:46:14] [ERROR] Test: platform-device-devm: missing subtest result line!
[15:46:14] # module: platform_device_test
[15:46:14] ============== [CRASHED] platform-device-devm ==============
[15:46:14] [ERROR] Test: main: missing expected subtest!
[15:46:14] [CRASHED]
[15:46:14] [ERROR] Test: main: missing expected subtest!
[15:46:14] [CRASHED]
[15:46:14] [ERROR] Test: main: missing expected subtest!
[15:46:14] [CRASHED]
[15:46:14] ============================================================
[15:46:14] Testing complete. Ran 1082 tests: passed: 995, failed: 7, crashed: 6, skipped: 74, errors: 7
[15:46:14] Failures: pm_runtime_test_cases, platform-device-devm, , ,
The kernel seems to have crashed; you can decode the stack traces with:
$ scripts/decode_stacktrace.sh .kunit/vmlinux .kunit < .kunit/test.log | tee .kunit/decoded.log | ./tools/testing/kunit/kunit.py parse
[15:46:14] Elapsed time: 197.554s total, 0.002s configuring, 77.498s building, 120.052s running
Alice
^ permalink raw reply [flat|nested] 10+ messages in thread