Hello,
kernel test robot noticed "kernel_BUG_at_mm/usercopy.c" on:
commit: 1b43c4629756a2c4bbbe4170eea1cc869fd8cb91 ("fs: Annotate struct file_handle with __counted_by() and use struct_size()")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
[test failed on linux-next/master 727900b675b749c40ba1f6669c7ae5eb7eb8e837]
in testcase: trinity
version:
with following parameters:
runtime: 300s
group: group-04
nr_groups: 5
compiler: gcc-12
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
+--------------------------------------------------------+------------+------------+
| | 16634c0975 | 1b43c46297 |
+--------------------------------------------------------+------------+------------+
| kernel_BUG_at_mm/usercopy.c | 0 | 11 |
| invalid_opcode:#[##] | 0 | 11 |
| EIP:usercopy_abort | 0 | 11 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 11 |
+--------------------------------------------------------+------------+------------+
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Closes: https://lore.kernel.org/oe-lkp/202404031550.f3de0571-lkp@xxxxxxxxx
[ 69.665215][ T3725] ------------[ cut here ]------------
[ 69.665740][ T3725] kernel BUG at mm/usercopy.c:102!
[ 69.666181][ T3725] invalid opcode: 0000 [#1] PREEMPT SMP
[ 69.666687][ T3725] CPU: 1 PID: 3725 Comm: trinity-c2 Tainted: G S W N 6.9.0-rc1-00016-g1b43c4629756 #1
[ 69.667623][ T3725] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 69.668555][ T3725] EIP: usercopy_abort (mm/usercopy.c:102 (discriminator 24))
[ 69.669040][ T3725] Code: d6 db c2 b9 f0 17 dd c2 eb 0a bf 57 5f e4 c2 b9 11 7f eb c2 ff 75 0c ff 75 08 56 52 53 50 57 51 68 f9 17 dd c2 e8 d3 a5 e9 ff <0f> 0b b8 ec 7a 4c c3 83 c4 24 e8 e4 72 3f 00 55 89 e5 57 56 89 d7
All code
========
0: d6 (bad)
1: db c2 fcmovnb %st(2),%st
3: b9 f0 17 dd c2 mov $0xc2dd17f0,%ecx
8: eb 0a jmp 0x14
a: bf 57 5f e4 c2 mov $0xc2e45f57,%edi
f: b9 11 7f eb c2 mov $0xc2eb7f11,%ecx
14: ff 75 0c push 0xc(%rbp)
17: ff 75 08 push 0x8(%rbp)
1a: 56 push %rsi
1b: 52 push %rdx
1c: 53 push %rbx
1d: 50 push %rax
1e: 57 push %rdi
1f: 51 push %rcx
20: 68 f9 17 dd c2 push $0xffffffffc2dd17f9
25: e8 d3 a5 e9 ff call 0xffffffffffe9a5fd
2a:* 0f 0b ud2 <-- trapping instruction
2c: b8 ec 7a 4c c3 mov $0xc34c7aec,%eax
31: 83 c4 24 add $0x24,%esp
34: e8 e4 72 3f 00 call 0x3f731d
39: 55 push %rbp
3a: 89 e5 mov %esp,%ebp
3c: 57 push %rdi
3d: 56 push %rsi
3e: 89 d7 mov %edx,%edi
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: b8 ec 7a 4c c3 mov $0xc34c7aec,%eax
7: 83 c4 24 add $0x24,%esp
a: e8 e4 72 3f 00 call 0x3f72f3
f: 55 push %rbp
10: 89 e5 mov %esp,%ebp
12: 57 push %rdi
13: 56 push %rsi
14: 89 d7 mov %edx,%edi
[ 69.670705][ T3725] EAX: 00000062 EBX: c2dd17e3 ECX: 00000001 EDX: 80000001
[ 69.671364][ T3725] ESI: c2dd17e4 EDI: c2e45f57 EBP: c8611efc ESP: c8611ecc
[ 69.671998][ T3725] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 EFLAGS: 00010286
[ 69.672652][ T3725] CR0: 80050033 CR2: 08acb828 CR3: 157c1000 CR4: 00040690
[ 69.673240][ T3725] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 69.673814][ T3725] DR6: fffe0ff0 DR7: 00000400
[ 69.674206][ T3725] Call Trace:
[ 69.674480][ T3725] ? show_regs (arch/x86/kernel/dumpstack.c:478)
[ 69.674859][ T3725] ? __die_body (arch/x86/kernel/dumpstack.c:421)
[ 69.675236][ T3725] ? __die (arch/x86/kernel/dumpstack.c:435)
[ 69.675579][ T3725] ? die (arch/x86/kernel/dumpstack.c:449)
[ 69.675904][ T3725] ? do_trap (arch/x86/kernel/traps.c:114 arch/x86/kernel/traps.c:155)
[ 69.676276][ T3725] ? do_error_trap (arch/x86/kernel/traps.c:176)
[ 69.676677][ T3725] ? usercopy_abort (mm/usercopy.c:102 (discriminator 24))
[ 69.677071][ T3725] ? exc_overflow (arch/x86/kernel/traps.c:252)
[ 69.677440][ T3725] ? handle_invalid_op (arch/x86/kernel/traps.c:214)
[ 69.677878][ T3725] ? usercopy_abort (mm/usercopy.c:102 (discriminator 24))
[ 69.678279][ T3725] ? exc_invalid_op (arch/x86/kernel/traps.c:267)
[ 69.678677][ T3725] ? handle_exception (arch/x86/entry/entry_32.S:1054)
[ 69.679118][ T3725] ? exc_overflow (arch/x86/kernel/traps.c:252)
[ 69.679494][ T3725] ? usercopy_abort (mm/usercopy.c:102 (discriminator 24))
[ 69.679882][ T3725] ? exc_overflow (arch/x86/kernel/traps.c:252)
[ 69.680272][ T3725] ? usercopy_abort (mm/usercopy.c:102 (discriminator 24))
[ 69.680681][ T3725] __check_heap_object (mm/slub.c:5365)
[ 69.681121][ T3725] check_heap_object (mm/usercopy.c:196)
[ 69.681541][ T3725] __check_object_size (mm/usercopy.c:123 mm/usercopy.c:254)
[ 69.681969][ T3725] handle_to_path (include/linux/uaccess.h:183 fs/fhandle.c:203)
[ 69.682372][ T3725] __ia32_sys_open_by_handle_at (fs/fhandle.c:226 fs/fhandle.c:267 fs/fhandle.c:258 fs/fhandle.c:258)
[ 69.682862][ T3725] do_int80_syscall_32 (arch/x86/entry/common.c:165 arch/x86/entry/common.c:274)
[ 69.683288][ T3725] entry_INT80_32 (arch/x86/entry/entry_32.S:944)
[ 69.683697][ T3725] EIP: 0x80a3392
[ 69.684006][ T3725] Code: 89 c8 c3 90 8d 74 26 00 85 c0 c7 01 01 00 00 00 75 d8 a1 c8 a9 ac 08 eb d1 66 90 66 90 66 90 66 90 66 90 66 90 66 90 90 cd 80 <c3> 8d b6 00 00 00 00 8d bc 27 00 00 00 00 8b 10 a3 f0 a9 ac 08 85
All code
========
0: 89 c8 mov %ecx,%eax
2: c3 ret
3: 90 nop
4: 8d 74 26 00 lea 0x0(%rsi,%riz,1),%esi
8: 85 c0 test %eax,%eax
a: c7 01 01 00 00 00 movl $0x1,(%rcx)
10: 75 d8 jne 0xffffffffffffffea
12: a1 c8 a9 ac 08 eb d1 movabs 0x9066d1eb08aca9c8,%eax
19: 66 90
1b: 66 90 xchg %ax,%ax
1d: 66 90 xchg %ax,%ax
1f: 66 90 xchg %ax,%ax
21: 66 90 xchg %ax,%ax
23: 66 90 xchg %ax,%ax
25: 66 90 xchg %ax,%ax
27: 90 nop
28: cd 80 int $0x80
2a:* c3 ret <-- trapping instruction
2b: 8d b6 00 00 00 00 lea 0x0(%rsi),%esi
31: 8d bc 27 00 00 00 00 lea 0x0(%rdi,%riz,1),%edi
38: 8b 10 mov (%rax),%edx
3a: a3 .byte 0xa3
3b: f0 lock
3c: a9 .byte 0xa9
3d: ac lods %ds:(%rsi),%al
3e: 08 .byte 0x8
3f: 85 .byte 0x85
Code starting with the faulting instruction
===========================================
0: c3 ret
1: 8d b6 00 00 00 00 lea 0x0(%rsi),%esi
7: 8d bc 27 00 00 00 00 lea 0x0(%rdi,%riz,1),%edi
e: 8b 10 mov (%rax),%edx
10: a3 .byte 0xa3
11: f0 lock
12: a9 .byte 0xa9
13: ac lods %ds:(%rsi),%al
14: 08 .byte 0x8
15: 85 .byte 0x85
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20240403/202404031550.f3de0571-lkp@xxxxxxxxx
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
