On Mon, 2024-09-23 at 11:43 -0700, Eduard Zingerman wrote: > On Mon, 2024-09-23 at 11:34 -0700, Manu Bretelle wrote: > > [...] > > > The qemu command invoked by vmtest is: > > > > qemu-system-x86_64 "-nodefaults" "-display" "none" "-serial" "mon:stdio" \ > > "-enable-kvm" "-cpu" "host" "-qmp" "unix:/tmp/qmp-971717.sock,server=on,wait=off" \ > > "-chardev" "socket,path=/tmp/qga-888301.sock,server=on,wait=off,id=qga0" \ > > "-device" "virtio-serial" \ > > "-device" "virtserialport,chardev=qga0,name=org.qemu.guest_agent.0" \ > > "--device" "virtio-serial" \ > > "-chardev" "socket,path=/tmp/cmdout-508724.sock,server=on,wait=off,id=cmdout" \ > > "--device" "virtserialport,chardev=cmdout,name=org.qemu.virtio_serial.0" \ > > "-virtfs" "local,id=root,path=/,mount_tag=/dev/root,security_model=none,multidevs=remap" \ > > "-kernel" "/data/users/chantra/linux/arch/x86/boot/bzImage" \ > > "-no-reboot" "-append" "rootfstype=9p rootflags=trans=virtio,cache=mmap,msize=1048576 rw earlyprintk=serial,0,115200 printk.devkmsg=on console=0,115200 loglevel=7 raid=noautodetect init=/tmp/vmtest-init4PdCA.sh panic=-1" \ > > "-virtfs" "local,id=shared,path=/data/users/chantra/linux,mount_tag=vmtest-shared,security_model=none,multidevs=remap" \ > > "-smp" "2" "-m" "4G" > > fwiw: removing "cache=mmap" from "rootflags" allows VM to boot and run tests. > A few more details: - error could be reproduced with KASAN enabled, log after scripts/decode_stacktrace.sh post-processing is in [1]; (KASAN reports use-after-free followed by null-ptr-deref); - null-ptr-deref is triggered by access to page->pcp_list.next when list_del() is called from page_alloc.c:__rmqueue_pcplist(), e.g. the following warning is triggered if added: --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -2990,6 +2990,7 @@ struct page *__rmqueue_pcplist(struct zone *zone, unsigned int order, } page = list_first_entry(list, struct page, pcp_list); + WARN_ONCE(!page->pcp_list.next, "!!!!! page->pcp_list.next is NULL\n"); list_del(&page->pcp_list); pcp->count -= 1 << order; } while (check_new_pages(page, order)); - config used for testing is [2]; - kernel used for testing is [3]; [1] https://gist.github.com/eddyz87/e638d67454558508451331754f946f41 [2] https://gist.github.com/eddyz87/f2c9c267db20ee53a6eb350aba0d2182 [3] de5cb0dcb74c ("Merge branch 'address-masking'") https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git