[linus:master] [sched/smp] cac5cefbad: BUG:kernel_NULL_pointer_dereference,address

[linus:master] [sched/smp] cac5cefbad: BUG:kernel_NULL_pointer_dereference,address

[kernel test robot]

hi, Ingo Molnar and all,

this report is just FYI what we observed in our tests.

the randconfig (https://download.01.org/0day-ci/archive/20250731/202507311445.69f901a3-lkp@intel.com/config-6.16.0-rc1-00022-gcac5cefbade9)
has no CONFIG_SMP
# CONFIG_SMP is not set

so cac5cefbad and parent go different pathes in boot tests.

we don't have enough knowledge if the boot failure caused by some changes
in cac5cefbad itself or just exposed by it. thanks


Hello,

kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:

commit: cac5cefbade90ff0bb0b393d301fa3b5234cf056 ("sched/smp: Make SMP unconditional")
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master

in testcase: boot

config: x86_64-randconfig-2005-20250721
compiler: gcc-12
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

(please refer to attached dmesg/kmsg for entire log/backtrace)


+---------------------------------------------+------------+------------+
|                                             | 5202c25dd1 | cac5cefbad |
+---------------------------------------------+------------+------------+
| boot_successes                              | 6          | 0          |
| boot_failures                               | 0          | 6          |
| BUG:kernel_NULL_pointer_dereference,address | 0          | 6          |
| Oops                                        | 0          | 6          |
| Kernel_panic-not_syncing:Fatal_exception    | 0          | 6          |
+---------------------------------------------+------------+------------+


If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202507311445.69f901a3-lkp@intel.com


[    3.998720][    T1] BUG: kernel NULL pointer dereference, address: 0000000000000000
[    3.998877][    T1] #PF: supervisor instruction fetch in kernel mode
[    3.998877][    T1] #PF: error_code(0x0010) - not-present page
[    3.998877][    T1] PGD 0 P4D 0
[    3.998877][    T1] Oops: Oops: 0010 [#1] KASAN
[    3.998877][    T1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G                T   6.16.0-rc1-00022-gcac5cefbade9 #1 PREEMPT(full)  c1cc10a5b834db7fda46e0874391a29691b85f16
[    3.998877][    T1] Tainted: [T]=RANDSTRUCT
[    3.998877][    T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[    3.998877][    T1] RIP: 0010:0x0
[ 3.998877][ T1] Code: Unable to access opcode bytes at 0xffffffffffffffd6.

Code starting with the faulting instruction
===========================================
[    3.998877][    T1] RSP: 0000:ffff888103647a80 EFLAGS: 00010046
[    3.998877][    T1] RAX: dffffc0000000000 RBX: ffff888104243800 RCX: 0000000000000000
[    3.998877][    T1] RDX: 1ffffffff0909fd1 RSI: ffff888103647ae0 RDI: ffff888104243800
[    3.998877][    T1] RBP: ffff888103647ab0 R08: 0000000000000000 R09: 0000000000000000
[    3.998877][    T1] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888103647ae0
[    3.998877][    T1] R13: ffff888102a78000 R14: 0000000000000000 R15: ffffffff8484fe20
[    3.998877][    T1] FS:  0000000000000000(0000) GS:0000000000000000(0000) knlGS:0000000000000000
[    3.998877][    T1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    3.998877][    T1] CR2: ffffffffffffffd6 CR3: 0000000004ac0000 CR4: 00000000000406b0
[    3.998877][    T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    3.998877][    T1] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
[    3.998877][    T1] Call Trace:
[    3.998877][    T1]  <TASK>
[ 3.998877][ T1] __do_set_cpus_allowed (kernel/sched/core.c:2757) 
[ 3.998877][ T1] do_set_cpus_allowed (kernel/sched/core.c:2786) 
[ 3.998877][ T1] ? set_cpus_allowed_common (kernel/sched/core.c:2768) 
[ 3.998877][ T1] ? do_raw_spin_lock (kernel/locking/spinlock_debug.c:88 kernel/locking/spinlock_debug.c:115) 
[ 3.998877][ T1] ? _raw_spin_lock_irqsave (kernel/locking/spinlock.c:163) 
[ 3.998877][ T1] ? kthread_affine_preferred (kernel/kthread.c:888 (discriminator 3)) 
[ 3.998877][ T1] kthread_affine_preferred (kernel/kthread.c:889 (discriminator 3)) 
[ 3.998877][ T1] ? kthreadd (kernel/kthread.c:858) 
[ 3.998877][ T1] ? __sanitizer_cov_trace_pc (kernel/kcov.c:217) 
[ 3.998877][ T1] ? ftrace_likely_update (arch/x86/include/asm/smap.h:53 kernel/trace/trace_branch.c:223) 
[ 3.998877][ T1] rcu_thread_affine_rnp (kernel/rcu/tree.c:4116) 
[ 3.998877][ T1] ? rcu_boost (kernel/rcu/tree.c:4116) 
[ 3.998877][ T1] rcu_spawn_one_boost_kthread (kernel/rcu/tree_plugin.h:1237 (discriminator 31)) 
[ 3.998877][ T1] ? rcu_thread_affine_rnp (kernel/rcu/tree_plugin.h:1216) 
[ 3.998877][ T1] rcu_spawn_rnp_kthreads (kernel/rcu/tree.c:4137 kernel/rcu/tree.c:4179) 
[ 3.998877][ T1] ? rcu_spawn_one_boost_kthread (kernel/rcu/tree.c:4175) 
[ 3.998877][ T1] ? __sanitizer_cov_trace_pc (kernel/kcov.c:217) 
[ 3.998877][ T1] ? ftrace_likely_update (arch/x86/include/asm/smap.h:53 kernel/trace/trace_branch.c:223) 
[ 3.998877][ T1] rcu_spawn_gp_kthread (kernel/rcu/tree.c:4549 (discriminator 31)) 
[ 3.998877][ T1] ? rcu_spawn_core_kthreads+0x180/0x180 
[ 3.998877][ T1] do_one_initcall (init/main.c:1274) 
[ 3.998877][ T1] ? trace_initcall_level (init/main.c:1264) 
[ 3.998877][ T1] kernel_init_freeable (init/main.c:1378 init/main.c:1572) 
[ 3.998877][ T1] ? rest_init (init/main.c:1465) 
[ 3.998877][ T1] kernel_init (init/main.c:1475) 
[ 3.998877][ T1] ? rest_init (init/main.c:1465) 
[ 3.998877][ T1] ret_from_fork (arch/x86/kernel/process.c:154) 
[ 3.998877][ T1] ? rest_init (init/main.c:1465) 
[ 3.998877][ T1] ret_from_fork_asm (arch/x86/entry/entry_64.S:255) 
[    3.998877][    T1]  </TASK>
[    3.998877][    T1] Modules linked in:
[    3.998877][    T1] CR2: 0000000000000000
[    3.998877][    T1] ---[ end trace 0000000000000000 ]---
[    3.998877][    T1] RIP: 0010:0x0
[ 3.998877][ T1] Code: Unable to access opcode bytes at 0xffffffffffffffd6.

Code starting with the faulting instruction
===========================================


The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250731/202507311445.69f901a3-lkp@intel.com



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki