linux-kernel - [blk-mq] BUG: unable to handle kernel NULL pointer dereference at 00000000000009d8

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date:	Fri, 13 Mar 2015 10:33:52 +0800
From:	Fengguang Wu <fengguang.wu@...el.com>
To:	Mike Snitzer <snitzer@...hat.com>
Cc:	fengguang.wu@...el.com, LKP <lkp@...org>,
	linux-kernel@...r.kernel.org
Subject: [blk-mq] BUG: unable to handle kernel NULL pointer dereference at
 00000000000009d8

Greetings,

0day kernel testing robot got the below dmesg and the first bad commit is

git://git.kernel.org/pub/scm/linux/kernel/git/snitzer/linux.git wip

commit c9e8c91f8a279b87eb0d94b037504ea9fc1bef7c
Author:     Mike Snitzer <snitzer@...hat.com>
AuthorDate: Tue Mar 10 15:54:41 2015 -0400
Commit:     Mike Snitzer <snitzer@...hat.com>
CommitDate: Thu Mar 12 09:55:38 2015 -0400

    blk-mq: fix use of incorrect goto label in blk_mq_init_queue error path
    
    If percpu_ref_init() fails the 'err_hctxs' label should be used instead
    of 'err_map'.
    
    Rather than reuse 'err_hw', which was introduced if the later
    blk_mq_init_hw_queues() call fails, move percpu_ref_init() before
    blk_alloc_queue_node().
    
    Signed-off-by: Mike Snitzer <snitzer@...hat.com>
    Reviewed-by: Ming Lei <ming.lei@...onical.com>

+------------------------------------------+------------+------------+------------+
|                                          | 5013e29ef8 | c9e8c91f8a | c9e8c91f8a |
+------------------------------------------+------------+------------+------------+
| boot_successes                           | 60         | 0          | 0          |
| boot_failures                            | 0          | 30         | 30         |
| BUG:unable_to_handle_kernel              | 0          | 30         | 30         |
| Oops                                     | 0          | 30         | 30         |
| RIP:percpu_ref_init                      | 0          | 30         | 30         |
| Kernel_panic-not_syncing:Fatal_exception | 0          | 30         | 30         |
| backtrace:percpu_ref_init                | 0          | 30         | 30         |
| backtrace:blk_mq_init_queue              | 0          | 30         | 30         |
| backtrace:loop_add                       | 0          | 30         | 30         |
| backtrace:loop_init                      | 0          | 30         | 30         |
| backtrace:kernel_init_freeable           | 0          | 30         | 30         |
+------------------------------------------+------------+------------+------------+

[    0.816325] Hangcheck: starting hangcheck timer 0.9.1 (tick is 180 seconds, margin is 60 seconds).
[    0.817519] [drm] Initialized drm 1.1.0 20060810
[    0.833300] brd: module loaded
[    0.834038] BUG: unable to handle kernel NULL pointer dereference at 00000000000009d8
[    0.834768] IP: [<ffffffff81299fc4>] percpu_ref_init+0x28/0x82
[    0.835010] PGD 0 
[    0.835010] Oops: 0002 [#1] 
[    0.835010] CPU: 0 PID: 1 Comm: swapper Not tainted 4.0.0-rc1-00023-gc9e8c91 #6
[    0.835010] task: ffff8800134b0000 ti: ffff88001349c000 task.ti: ffff88001349c000
[    0.835010] RIP: 0010:[<ffffffff81299fc4>]  [<ffffffff81299fc4>] percpu_ref_init+0x28/0x82
[    0.835010] RSP: 0000:ffff88001349fd78  EFLAGS: 00010296
[    0.835010] RAX: ffff880013bd1770 RBX: 00000000000009d0 RCX: ffff880013bd1770
[    0.835010] RDX: ffff880013bd1770 RSI: 00000000000000b6 RDI: ffff880013bd1778
[    0.835010] RBP: ffff88001349fd98 R08: 0000000000000004 R09: 0000000000000000
[    0.835010] R10: 0000000000000328 R11: 0000000000002751 R12: 0000000000000001
[    0.835010] R13: ffffffff81279de5 R14: ffff880010026d20 R15: 0000000000000000
[    0.835010] FS:  0000000000000000(0000) GS:ffffffff818f9000(0000) knlGS:0000000000000000
[    0.835010] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    0.835010] CR2: 00000000000009d8 CR3: 00000000018ea000 CR4: 00000000000406b0
[    0.835010] Stack:
[    0.835010]  ffff88001003fa18 ffff8800137c07b8 0000000000000001 ffff880010026d20
[    0.835010]  ffff88001349fe08 ffffffff8127bfda 0000000000000000 ffff8800137c07b8
[    0.835010]  0000000000000001 ffff880013bd1900 ffff88001349fe08 ffff880010026150
[    0.835010] Call Trace:
[    0.835010]  [<ffffffff8127bfda>] blk_mq_init_queue+0xfb/0x7e9
[    0.835010]  [<ffffffff813805a6>] loop_add+0xfe/0x2a0
[    0.835010]  [<ffffffff81bbddf5>] loop_init+0x146/0x187
[    0.835010]  [<ffffffff81bbdcaf>] ? brd_init+0x160/0x160
[    0.835010]  [<ffffffff81b96feb>] do_one_initcall+0xe6/0x171
[    0.835010]  [<ffffffff81b97229>] kernel_init_freeable+0x1b3/0x23b
[    0.835010]  [<ffffffff815b2c52>] ? rest_init+0xbd/0xbd
[    0.835010]  [<ffffffff815b2c5b>] kernel_init+0x9/0xd0
[    0.835010]  [<ffffffff815bbf3a>] ret_from_fork+0x7a/0xb0
[    0.835010]  [<ffffffff815b2c52>] ? rest_init+0xbd/0xbd
[    0.835010] Code: 5c 5d c3 55 48 89 e5 41 55 41 54 53 41 50 48 89 fb 49 89 f5 41 89 d4 be 08 00 00 00 89 ca bf 08 00 00 00 e8 31 c8 e4 ff 48 89 c1 <48> 89 43 08 b8 f4 ff ff ff 48 85 c9 74 44 8a 53 20 44 88 e0 83 
[    0.835010] RIP  [<ffffffff81299fc4>] percpu_ref_init+0x28/0x82
[    0.835010]  RSP <ffff88001349fd78>
[    0.835010] CR2: 00000000000009d8
[    0.835010] ---[ end trace a97c7e4171384f5d ]---
[    0.835010] Kernel panic - not syncing: Fatal exception

git bisect start c9e8c91f8a279b87eb0d94b037504ea9fc1bef7c c517d838eb7d07bbe9507871fab3931deccff539 --
git bisect good 0ac9de52a23dbf6e55a5de76c0a89d2ac9069820  # 01:03     20+      0  dm cache policy mq: try not to writeback data that changed in the last second
git bisect good 76a53cf22a0f125d8108c4fe1b38c1da1d3d0da5  # 01:15     20+      0  dm: only run the queue on completion if congested or no requests pending
git bisect good 8124ec8334d7ffa0ca496a52c7351b9ed610fa03  # 01:27     20+      0  dm: don't start current request if it would've merged with the previous
git bisect good df8ff9e40da3854fba5628108113b34221c72336  # 01:29     20+      0  dm sysfs: introduce ability to add writable attributes
git bisect good 5013e29ef8a49fd276150f566880766938dc0e20  # 01:29     20+      0  dm: impose configurable deadline for dm_request_fn's merge heuristic
# first bad commit: [c9e8c91f8a279b87eb0d94b037504ea9fc1bef7c] blk-mq: fix use of incorrect goto label in blk_mq_init_queue error path
git bisect good 5013e29ef8a49fd276150f566880766938dc0e20  # 01:31     60+      0  dm: impose configurable deadline for dm_request_fn's merge heuristic
# extra tests with DEBUG_INFO
git bisect  bad c9e8c91f8a279b87eb0d94b037504ea9fc1bef7c  # 01:41      0-     12  blk-mq: fix use of incorrect goto label in blk_mq_init_queue error path
# extra tests on HEAD of dm/for-next
git bisect  bad afb0601cefe474f8eeb9c66a2ecbabbc7a21e348  # 01:41      0-     28  dm: add 'use_blk_mq' module param and expose in per-device ro sysfs attr
# extra tests on tree/branch snitzer/wip
git bisect  bad afb0601cefe474f8eeb9c66a2ecbabbc7a21e348  # 01:44      0-     28  dm: add 'use_blk_mq' module param and expose in per-device ro sysfs attr
# extra tests on tree/branch linus/master
git bisect good 09d35919b06e8508b51ee8a643a67b56f7bea0dd  # 02:01     60+      0  Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
# extra tests on tree/branch next/master
git bisect good e1e5f722673c190df886f12ab000f27e07393d9f  # 02:08     60+      1  Add linux-next specific files for 20150312



Thanks,
Fengguang

View attachment "dmesg-vm-kbuild-yocto-x86_64-19:20150313005332:x86_64-randconfig-n0-03121630:4.0.0-rc1-00023-gc9e8c91:6" of type "text/plain" (30294 bytes)

View attachment "config-4.0.0-rc1-00023-gc9e8c91" of type "text/plain" (76810 bytes)