Hello, we reported similar issue for this patch in https://lore.kernel.org/all/202406161539.b5ff7b20-oliver.sang@xxxxxxxxx/ and we saw a lot of dicussion there. now the patch is merged into linux-next/master, we are not sure if there is a fix or debug patch is on-going, which will be our pleasure to test. anyway, just report again FYI that we still observe issues in our tests for linux-nexts/master kernel test robot noticed "Kernel_BUG_at" on: commit: 934c29999b57b835d65442da6f741d5e27f3b584 ("net: micro-optimize skb_datagram_iter") https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master [test failed on linux-next/master 2102cb0d050d34d50b9642a3a50861787527e922] in testcase: boot compiler: gcc-13 test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G (please refer to attached dmesg/kmsg for entire log/backtrace) +------------------------------------------------+------------+------------+ | | abef84957b | 934c29999b | +------------------------------------------------+------------+------------+ | Kernel_BUG_at | 0 | 6 | | Oops:invalid_opcode:#[##] | 0 | 6 | | EIP:usercopy_abort | 0 | 6 | | Kernel_panic-not_syncing:Fatal_exception | 0 | 6 | +------------------------------------------------+------------+------------+ If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@xxxxxxxxx> | Closes: https://lore.kernel.org/oe-lkp/202406211653.493fbfdf-lkp@xxxxxxxxx [ 8.659454][ T161] ------------[ cut here ]------------ [ 8.659874][ T161] Kernel BUG at usercopy_abort+0x58/0x67 [verbose debug info unavailable] [ 8.660744][ T161] Oops: invalid opcode: 0000 [#1] [ 8.661134][ T161] CPU: 0 PID: 161 Comm: systemctl Not tainted 6.10.0-rc3-00688-g934c29999b57 #1 63c7b7fbd2f7622d539d732370d21837ac16d760 [ 8.662098][ T161] EIP: usercopy_abort (mm/usercopy.c:102) [ 8.662483][ T161] Code: 25 40 43 b9 c8 38 41 43 eb 0a bf 9d 73 50 43 b9 e4 ce 3f 43 ff 75 0c ff 75 08 56 52 53 50 57 51 68 d1 38 41 43 e8 50 cc ee ff <0f> 0b b8 4c 09 c7 43 83 c4 24 e8 c2 69 42 00 55 89 e5 57 56 89 d7 All code ======== 0: 25 40 43 b9 c8 and $0xc8b94340,%eax 5: 38 41 43 cmp %al,0x43(%rcx) 8: eb 0a jmp 0x14 a: bf 9d 73 50 43 mov $0x4350739d,%edi f: b9 e4 ce 3f 43 mov $0x433fcee4,%ecx 14: ff 75 0c push 0xc(%rbp) 17: ff 75 08 push 0x8(%rbp) 1a: 56 push %rsi 1b: 52 push %rdx 1c: 53 push %rbx 1d: 50 push %rax 1e: 57 push %rdi 1f: 51 push %rcx 20: 68 d1 38 41 43 push $0x434138d1 25: e8 50 cc ee ff call 0xffffffffffeecc7a 2a:* 0f 0b ud2 <-- trapping instruction 2c: b8 4c 09 c7 43 mov $0x43c7094c,%eax 31: 83 c4 24 add $0x24,%esp 34: e8 c2 69 42 00 call 0x4269fb 39: 55 push %rbp 3a: 89 e5 mov %esp,%ebp 3c: 57 push %rdi 3d: 56 push %rsi 3e: 89 d7 mov %edx,%edi Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: b8 4c 09 c7 43 mov $0x43c7094c,%eax 7: 83 c4 24 add $0x24,%esp a: e8 c2 69 42 00 call 0x4269d1 f: 55 push %rbp 10: 89 e5 mov %esp,%ebp 12: 57 push %rdi 13: 56 push %rsi 14: 89 d7 mov %edx,%edi [ 8.664049][ T161] EAX: 00000052 EBX: 435c7250 ECX: 00000000 EDX: 43c4b518 [ 8.664589][ T161] ESI: 435c7250 EDI: 43402547 EBP: bf159c68 ESP: bf159c38 [ 8.665127][ T161] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010286 [ 8.665708][ T161] CR0: 80050033 CR2: 005c8afc CR3: 7f060000 CR4: 000406d0 [ 8.666244][ T161] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 [ 8.666774][ T161] DR6: fffe0ff0 DR7: 00000400 [ 8.667136][ T161] Call Trace: [ 8.667395][ T161] ? show_regs (arch/x86/kernel/dumpstack.c:478 (discriminator 1)) [ 8.667732][ T161] ? __die_body (arch/x86/kernel/dumpstack.c:421) [ 8.668060][ T161] ? __die (arch/x86/kernel/dumpstack.c:435) [ 8.668358][ T161] ? die (arch/x86/kernel/dumpstack.c:449) [ 8.668646][ T161] ? do_trap (arch/x86/kernel/traps.c:114 arch/x86/kernel/traps.c:155) [ 8.668968][ T161] ? do_error_trap (arch/x86/kernel/traps.c:176) [ 8.669323][ T161] ? usercopy_abort (mm/usercopy.c:102) [ 8.669690][ T161] ? exc_overflow (arch/x86/kernel/traps.c:252) [ 8.670057][ T161] ? handle_invalid_op (arch/x86/kernel/traps.c:214) [ 8.670434][ T161] ? usercopy_abort (mm/usercopy.c:102) [ 8.670803][ T161] ? exc_invalid_op (arch/x86/kernel/traps.c:267) [ 8.671174][ T161] ? handle_exception (arch/x86/entry/entry_32.S:1054) [ 8.671567][ T161] ? __ia32_sys_membarrier (kernel/sched/membarrier.c:497 kernel/sched/membarrier.c:659 kernel/sched/membarrier.c:625 kernel/sched/membarrier.c:625) [ 8.671980][ T161] ? exc_overflow (arch/x86/kernel/traps.c:252) [ 8.672322][ T161] ? usercopy_abort (mm/usercopy.c:102) [ 8.672684][ T161] ? exc_overflow (arch/x86/kernel/traps.c:252) [ 8.673039][ T161] ? usercopy_abort (mm/usercopy.c:102) [ 8.673406][ T161] check_heap_object (mm/usercopy.c:182) [ 8.673780][ T161] __check_object_size (mm/usercopy.c:123 mm/usercopy.c:254) [ 8.674169][ T161] simple_copy_to_iter (include/linux/uio.h:196 net/core/datagram.c:513) [ 8.674554][ T161] __skb_datagram_iter (net/core/datagram.c:424 (discriminator 1)) [ 8.674955][ T161] skb_copy_datagram_iter (net/core/datagram.c:529) [ 8.675359][ T161] ? skb_free_datagram (include/linux/thread_info.h:249 (discriminator 1) include/linux/uio.h:195 (discriminator 1) net/core/datagram.c:513 (discriminator 1)) [ 8.675724][ T161] ? unix_copy_addr (net/unix/af_unix.c:2866) [ 8.676083][ T161] unix_stream_read_actor (net/unix/af_unix.c:2871) [ 8.676481][ T161] unix_stream_read_generic (net/unix/af_unix.c:2803) [ 8.676914][ T161] unix_stream_recvmsg (net/unix/af_unix.c:2907) [ 8.677301][ T161] ? unix_copy_addr (net/unix/af_unix.c:2866) [ 8.677669][ T161] ? unix_stream_splice_read (net/unix/af_unix.c:2890) [ 8.678097][ T161] sock_recvmsg_nosec (net/socket.c:1046 (discriminator 1)) [ 8.678472][ T161] ____sys_recvmsg (net/socket.c:1068 (discriminator 2) net/socket.c:2804 (discriminator 2)) [ 8.678835][ T161] ___sys_recvmsg (net/socket.c:2846) [ 8.679188][ T161] __sys_recvmsg (net/socket.c:2878) [ 8.679534][ T161] __do_sys_socketcall (net/socket.c:3173) [ 8.679926][ T161] __ia32_sys_socketcall (net/socket.c:3077) [ 8.680304][ T161] ia32_sys_call (kbuild/obj/consumer/i386-randconfig-012-20230823-CONFIG_NVME_CORE/./arch/x86/include/generated/asm/syscalls_32.h:103) [ 8.680671][ T161] do_int80_syscall_32 (arch/x86/entry/common.c:165 (discriminator 1) arch/x86/entry/common.c:339 (discriminator 1)) [ 8.681053][ T161] entry_INT80_32 (arch/x86/entry/entry_32.S:944) [ 8.681401][ T161] EIP: 0x37f37092 [ 8.681686][ T161] Code: 00 00 00 e9 90 ff ff ff ff a3 24 00 00 00 68 30 00 00 00 e9 80 ff ff ff ff a3 f8 ff ff ff 66 90 00 00 00 00 00 00 00 00 cd 80 <c3> 8d b4 26 00 00 00 00 8d b6 00 00 00 00 8b 1c 24 c3 8d b4 26 00 All code ======== 0: 00 00 add %al,(%rax) 2: 00 e9 add %ch,%cl 4: 90 nop 5: ff (bad) 6: ff (bad) 7: ff (bad) 8: ff a3 24 00 00 00 jmp *0x24(%rbx) e: 68 30 00 00 00 push $0x30 13: e9 80 ff ff ff jmp 0xffffffffffffff98 18: ff a3 f8 ff ff ff jmp *-0x8(%rbx) 1e: 66 90 xchg %ax,%ax ... 28: cd 80 int $0x80 2a:* c3 ret <-- trapping instruction 2b: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi 32: 8d b6 00 00 00 00 lea 0x0(%rsi),%esi 38: 8b 1c 24 mov (%rsp),%ebx 3b: c3 ret 3c: 8d .byte 0x8d 3d: b4 26 mov $0x26,%ah ... Code starting with the faulting instruction =========================================== 0: c3 ret 1: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi 8: 8d b6 00 00 00 00 lea 0x0(%rsi),%esi e: 8b 1c 24 mov (%rsp),%ebx 11: c3 ret 12: 8d .byte 0x8d 13: b4 26 mov $0x26,%ah The kernel config and materials to reproduce are available at: https://download.01.org/0day-ci/archive/20240621/202406211653.493fbfdf-lkp@xxxxxxxxx -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki
