Hello,
kernel test robot noticed "WARNING:at_kernel/fork.c:#vm_area_init_from" on:
commit: ff6f2b81eaa8a9fe5d158c6e7b1e58d3929c32c1 ("mm/vmalloc: move free_vm_area(area) from the __vmalloc_area_node function to the __vmalloc_node_range_noprof function")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
[test failed on linux-next/master 0a2f889128969dab41861b6e40111aa03dc57014]
in testcase: trinity
version:
with following parameters:
runtime: 300s
group: group-02
nr_groups: 5
config: x86_64-randconfig-101-20250306
compiler: gcc-12
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
(please refer to attached dmesg/kmsg for entire log/backtrace)
+-------------------------------------------------------------+------------+------------+
| | fb8faf4337 | ff6f2b81ea |
+-------------------------------------------------------------+------------+------------+
| boot_successes | 9 | 0 |
| boot_failures | 0 | 6 |
| WARNING:at_kernel/fork.c:#vm_area_init_from | 0 | 6 |
| RIP:vm_area_init_from | 0 | 6 |
| BUG:KASAN:slab-use-after-free_in__vmalloc_node_range_noprof | 0 | 5 |
| WARNING:at_mm/vmalloc.c:#remove_vm_area | 0 | 5 |
| RIP:remove_vm_area | 0 | 5 |
| kernel_BUG_at_mm/vmalloc.c | 0 | 5 |
| Oops:invalid_opcode:#[##]PREEMPT_KASAN | 0 | 5 |
| RIP:__vmalloc_node_range_noprof | 0 | 5 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 5 |
+-------------------------------------------------------------+------------+------------+
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@xxxxxxxxx>
| Closes: https://lore.kernel.org/oe-lkp/202503101629.7289b1-lkp@xxxxxxxxx
[ 8.741254][ T47] ------------[ cut here ]------------
[ 8.742176][ T47] memcpy: detected field-spanning write (size 8) of single field "&dest->swap_readahead_info" at kernel/fork.c:477 (size 0)
[ 8.745188][ T47] WARNING: CPU: 0 PID: 47 at kernel/fork.c:477 vm_area_init_from (kernel/fork.c:477 (discriminator 3))
[ 8.746489][ T47] Modules linked in:
[ 8.747050][ T47] CPU: 0 UID: 0 PID: 47 Comm: modprobe Tainted: G T 6.14.0-rc3-00393-gff6f2b81eaa8 #1
[ 8.748545][ T47] Tainted: [T]=RANDSTRUCT
[ 8.749159][ T47] RIP: 0010:vm_area_init_from (kernel/fork.c:477 (discriminator 3))
[ 8.750008][ T47] Code: 5b 41 5c 41 5d 41 5e 5d c3 31 c9 48 c7 c2 40 01 84 84 be 08 00 00 00 48 c7 c7 a0 01 84 84 c6 05 97 a0 fd 04 01 e8 7c e9 00 00 <0f> 0b eb c2 e8 53 c2 53 00 eb 96 e8 ac c1 53 00 e9 6c ff ff ff e8
All code
========
0: 5b pop %rbx
1: 41 5c pop %r12
3: 41 5d pop %r13
5: 41 5e pop %r14
7: 5d pop %rbp
8: c3 ret
9: 31 c9 xor %ecx,%ecx
b: 48 c7 c2 40 01 84 84 mov $0xffffffff84840140,%rdx
12: be 08 00 00 00 mov $0x8,%esi
17: 48 c7 c7 a0 01 84 84 mov $0xffffffff848401a0,%rdi
1e: c6 05 97 a0 fd 04 01 movb $0x1,0x4fda097(%rip) # 0x4fda0bc
25: e8 7c e9 00 00 call 0xe9a6
2a:* 0f 0b ud2 <-- trapping instruction
2c: eb c2 jmp 0xfffffffffffffff0
2e: e8 53 c2 53 00 call 0x53c286
33: eb 96 jmp 0xffffffffffffffcb
35: e8 ac c1 53 00 call 0x53c1e6
3a: e9 6c ff ff ff jmp 0xffffffffffffffab
3f: e8 .byte 0xe8
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: eb c2 jmp 0xffffffffffffffc6
4: e8 53 c2 53 00 call 0x53c25c
9: eb 96 jmp 0xffffffffffffffa1
b: e8 ac c1 53 00 call 0x53c1bc
10: e9 6c ff ff ff jmp 0xffffffffffffff81
15: e8 .byte 0xe8
[ 8.752623][ T47] RSP: 0000:ffffc9000033f5e0 EFLAGS: 00010286
[ 8.757589][ T47] RAX: 0000000000000000 RBX: ffff88812aef5e00 RCX: 1ffffffff0a96ea4
[ 8.758688][ T47] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001
[ 8.759767][ T47] RBP: ffffc9000033f600 R08: 0000000000000000 R09: fffffbfff0a96ea4
[ 8.760832][ T47] R10: 0000000000000003 R11: 0000000000000001 R12: 0000000000000000
[ 8.761924][ T47] R13: ffff88812aef5e60 R14: ffff88812aef5360 R15: ffffffff848ba400
[ 8.762997][ T47] FS: 0000000000000000(0000) GS:ffffffff85478000(0000) knlGS:0000000000000000
[ 8.764185][ T47] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.765087][ T47] CR2: ffff88843ffff000 CR3: 000000012aef4000 CR4: 00000000000406b0
[ 8.766162][ T47] Call Trace:
[ 8.766606][ T47] <TASK>
[ 8.767019][ T47] ? show_regs (arch/x86/kernel/dumpstack.c:479)
[ 8.767608][ T47] ? __warn (kernel/panic.c:748)
[ 8.768241][ T47] ? vm_area_init_from (kernel/fork.c:477 (discriminator 3))
[ 8.769012][ T47] ? vm_area_init_from (kernel/fork.c:477 (discriminator 3))
[ 8.769752][ T47] ? report_bug (lib/bug.c:180 lib/bug.c:219)
[ 8.770418][ T47] ? handle_bug (arch/x86/kernel/traps.c:285)
[ 8.771056][ T47] ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1))
[ 8.771726][ T47] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621)
[ 8.772478][ T47] ? vm_area_init_from (kernel/fork.c:477 (discriminator 3))
[ 8.773223][ T47] vm_area_dup (include/linux/list.h:37 kernel/fork.c:499)
[ 8.773752][ T47] __split_vma (mm/vma.c:477)
[ 8.774165][ T47] ? commit_merge (mm/vma.c:463)
[ 8.774582][ T47] ? __kasan_check_read (mm/kasan/shadow.c:32)
[ 8.775053][ T47] ? validate_chain (arch/x86/include/asm/bitops.h:227 arch/x86/include/asm/bitops.h:239 include/asm-generic/bitops/instrumented-non-atomic.h:142 kernel/locking/lockdep.c:230 kernel/locking/lockdep.c:3818 kernel/locking/lockdep.c:3874)
[ 8.775484][ T47] vms_gather_munmap_vmas (mm/vma.c:1283)
[ 8.775959][ T47] ? check_prev_add (kernel/locking/lockdep.c:3862)
[ 8.776378][ T47] ? mark_lock (arch/x86/include/asm/bitops.h:227 (discriminator 3) arch/x86/include/asm/bitops.h:239 (discriminator 3) include/asm-generic/bitops/instrumented-non-atomic.h:142 (discriminator 3) kernel/locking/lockdep.c:230 (discriminator 3) kernel/locking/lockdep.c:4729 (discriminator 3))
[ 8.776749][ T47] do_vmi_align_munmap (mm/vma.c:1450)
[ 8.777198][ T47] ? vma_shrink (mm/vma.c:1441)
[ 8.777627][ T47] ? lock_acquire (kernel/locking/lockdep.c:469 kernel/locking/lockdep.c:5853)
[ 8.778059][ T47] ? mas_walk (lib/maple_tree.c:3636 lib/maple_tree.c:4942)
[ 8.778451][ T47] do_vmi_munmap (mm/vma.c:1507)
[ 8.778877][ T47] __vm_munmap (mm/vma.c:2969)
[ 8.779252][ T47] ? expand_downwards (mm/vma.c:2960)
[ 8.779671][ T47] ? vm_mmap_pgoff (mm/util.c:579)
[ 8.780092][ T47] ? get_random_u64 (drivers/char/random.c:554 (discriminator 13))
[ 8.780507][ T47] vm_munmap (mm/mmap.c:1078)
[ 8.780842][ T47] elf_load (include/linux/pid.h:231 fs/binfmt_elf.c:395 fs/binfmt_elf.c:414)
[ 8.781205][ T47] load_elf_binary (include/linux/instrumented.h:68 include/asm-generic/bitops/instrumented-non-atomic.h:141 include/linux/thread_info.h:126 arch/x86/include/asm/elf.h:310 fs/binfmt_elf.c:1125)
[ 8.781652][ T47] ? load_elf_interp+0xa70/0xa70
[ 8.782161][ T47] ? exec_binprm (fs/exec.c:1775 fs/exec.c:1807)
[ 8.782556][ T47] exec_binprm (fs/exec.c:1777 fs/exec.c:1807)
[ 8.783104][ T47] ? check_unsafe_exec (fs/exec.c:1791)
[ 8.783535][ T47] ? _raw_spin_unlock (arch/x86/include/asm/preempt.h:94 include/linux/spinlock_api_smp.h:143 kernel/locking/spinlock.c:186)
[ 8.783980][ T47] ? check_unsafe_exec (fs/exec.c:1637)
[ 8.784412][ T47] bprm_execve (fs/exec.c:1859)
[ 8.784782][ T47] kernel_execve (fs/exec.c:2026)
[ 8.785177][ T47] call_usermodehelper_exec_async (kernel/umh.c:113)
[ 8.785697][ T47] ? umh_complete (kernel/umh.c:64)
[ 8.786102][ T47] ret_from_fork (arch/x86/kernel/process.c:154)
[ 8.786473][ T47] ? umh_complete (kernel/umh.c:64)
[ 8.786867][ T47] ret_from_fork_asm (arch/x86/entry/entry_64.S:254)
[ 8.787278][ T47] </TASK>
[ 8.787532][ T47] irq event stamp: 955
[ 8.787877][ T47] hardirqs last enabled at (965): __up_console_sem (arch/x86/include/asm/irqflags.h:26 (discriminator 1) arch/x86/include/asm/irqflags.h:87 (discriminator 1) arch/x86/include/asm/irqflags.h:147 (discriminator 1) kernel/printk/printk.c:344 (discriminator 1))
[ 8.788658][ T47] hardirqs last disabled at (972): __up_console_sem (kernel/printk/printk.c:342 (discriminator 1))
[ 8.789442][ T47] softirqs last enabled at (470): handle_softirqs (arch/x86/include/asm/preempt.h:26 kernel/softirq.c:408 kernel/softirq.c:589)
[ 8.790243][ T47] softirqs last disabled at (461): irq_exit_rcu (kernel/softirq.c:596 kernel/softirq.c:435 kernel/softirq.c:662 kernel/softirq.c:678)
[ 8.790996][ T47] ---[ end trace 0000000000000000 ]---
[ 8.796795][ T47] modprobe (47) used greatest stack depth: 25392 bytes left
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250310/202503101629.7289b1-lkp@xxxxxxxxx
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
