Message-ID: <20191029151413.GD27620@xsang-OptiPlex-9020>
Date:   Tue, 29 Oct 2019 23:14:13 +0800
From:   kernel test robot <lkp@...el.com>
To:     Michal Suchanek <msuchanek@...e.de>
Cc:     0day robot <lkp@...el.com>, LKML <linux-kernel@...r.kernel.org>,
        lkp@...ts.01.org
Subject: [scsi]  [confidence: ] 8ebc37a465:
 BUG:kernel_NULL_pointer_dereference,address

FYI, we noticed the following commit (built with gcc-7):

commit: 8ebc37a465cccfa1f297f976e1bd8b36ede36db3 ("scsi: sr: wait for the medium to become ready")
https://github.com/0day-ci/linux UPDATE-20191027-161609/Michal-Suchanek/Fix-cdrom-autoclose/20191025-101637

in testcase: blktests
with following parameters:

	disk: 1SSD
	test: block-group1



on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 8G

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


+-------------------------------------------------------+------------+------------+
|                                                       | 6bb0f3478c | 8ebc37a465 |
+-------------------------------------------------------+------------+------------+
| boot_successes                                        | 61         | 2          |
| boot_failures                                         | 2          | 167        |
| BUG:kernel_hang_in_boot_stage                         | 2          |            |
| BUG:kernel_NULL_pointer_dereference,address           | 0          | 163        |
| Oops:#[##]                                            | 0          | 167        |
| RIP:cdrom_release[cdrom]                              | 0          | 156        |
| Kernel_panic-not_syncing:Fatal_exception              | 0          | 165        |
| WARNING:at_fs/kernfs/dir.c:#kernfs_remove_by_name_ns  | 0          | 29         |
| RIP:kernfs_remove_by_name_ns                          | 0          | 29         |
| WARNING:at_kernel/module.c:#module_put                | 0          | 28         |
| RIP:module_put                                        | 0          | 28         |
| RIP:driver_deferred_probe_del                         | 0          | 1          |
| RIP:kobject_uevent_env                                | 0          | 7          |
| BUG:unable_to_handle_page_fault_for_address           | 0          | 10         |
| RIP:__pm_runtime_resume                               | 0          | 10         |
| WARNING:at_lib/list_debug.c:#__list_del_entry_valid   | 0          | 5          |
| RIP:__list_del_entry_valid                            | 0          | 8          |
| Kernel_panic-not_syncing:Fatal_exception_in_interrupt | 0          | 2          |
| WARNING:at_block/genhd.c:#__device_add_disk           | 0          | 2          |
| RIP:__device_add_disk                                 | 0          | 2          |
| RIP:__wake_up_common                                  | 0          | 1          |
| WARNING:at_lib/kobject.c:#kobject_put                 | 0          | 1          |
| RIP:kobject_put                                       | 0          | 1          |
| RIP:__pm_runtime_idle                                 | 0          | 1          |
| RIP:hrtimer_active                                    | 0          | 1          |
| WARNING:at_fs/sysfs/group.c:#internal_create_group    | 0          | 1          |
| RIP:internal_create_group                             | 0          | 1          |
| WARNING:at_fs/sysfs/file.c:#sysfs_create_file_ns      | 0          | 1          |
| RIP:sysfs_create_file_ns                              | 0          | 1          |
| WARNING:at_lib/list_debug.c:#__list_add_valid         | 0          | 1          |
| RIP:__list_add_valid                                  | 0          | 1          |
| RIP:bus_remove_device                                 | 0          | 2          |
| RIP:sysfs_remove_groups                               | 0          | 1          |
+-------------------------------------------------------+------------+------------+


If you fix the issue, kindly add following tag
Reported-by: kernel test robot <lkp@...el.com>


[   32.644075] BUG: kernel NULL pointer dereference, address: 0000000000000038
[   32.644391] sr 3:0:0:0: Attached scsi CD-ROM sr1
[   32.646682] #PF: supervisor read access in kernel mode
[   32.646684] #PF: error_code(0x0000) - not-present page
[   32.646686] PGD 0 P4D 0 
[   32.646689] Oops: 0000 [#1] SMP PTI
[   32.646692] CPU: 0 PID: 2513 Comm: systemd-udevd Not tainted 5.4.0-rc4-00112-g8ebc37a465ccc #1
[   32.646693] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[   32.646701] RIP: 0010:cdrom_release+0x19/0x2b0 [cdrom]
[   32.646703] Code: e8 dc ca ed d7 8b 44 24 04 eb 99 e8 b1 84 ae d7 90 66 66 66 66 90 41 57 41 56 41 55 41 54 41 89 f4 55 53 48 89 fb 48 83 ec 48 <48> 8b 2f 65 48 8b 04 25 28 00 00 00 48 89 44 24 40 31 c0 80 3d 4b
[   32.646710] RSP: 0018:ffffa2374086fd98 EFLAGS: 00010292
[   32.650967] sr 5:0:0:0: Attached scsi CD-ROM sr5
[   32.651035] RAX: 0000000000000000 RBX: 0000000000000038 RCX: 0000000000000000
[   32.651037] RDX: ffff8f5d421aa680 RSI: 00000000080a005d RDI: 0000000000000038
[   32.651038] RBP: 00000000080a005d R08: ffffa2374086fd18 R09: 0000000000000000
[   32.651039] R10: ffff8f5d41259bf0 R11: ffff8f5d41f3c510 R12: 00000000080a005d
[   32.651040] R13: ffff8f5d41d35000 R14: ffff8f5d29de4660 R15: ffff8f5c87811e18
[   32.651042] FS:  00007f12f4a038c0(0000) GS:ffff8f5dbfc00000(0000) knlGS:0000000000000000
[   32.651043] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   32.651044] CR2: 0000000000000038 CR3: 00000001c2078000 CR4: 00000000000406f0
[   32.651050] Call Trace:
[   32.653773] sr 5:0:0:0: Attached scsi generic sg13 type 5
[   32.655002]  sr_block_release+0x27/0x40 [sr_mod]
[   32.655007]  __blkdev_put+0x192/0x1e0
[   32.655642]  ? disk_flush_events+0x24/0x70
[   32.660439] sr 3:0:0:0: Attached scsi generic sg14 type 5
[   32.662884]  blkdev_close+0x21/0x30
[   32.662890]  __fput+0xd1/0x270
[   32.662897]  task_work_run+0xa3/0xe0
[   32.662901]  exit_to_usermode_loop+0xeb/0xf0
[   32.662905]  do_syscall_64+0x1a7/0x1d0
[   32.723508]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   32.725896] RIP: 0033:0x7f12f525e5b1
[   32.728068] Code: 2d aa 00 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00 8b 05 9a ee 00 00 85 c0 75 16 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 3f c3 66 0f 1f 44 00 00 53 89 fb 48 83 ec 10
[   32.735495] RSP: 002b:00007ffe61b39d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[   32.738863] RAX: 0000000000000000 RBX: 0000000000000007 RCX: 00007f12f525e5b1
[   32.742128] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000007
[   32.745199] RBP: 00007f12f4a036f0 R08: 000055dbad367140 R09: 00007ffe61b393f0
[   32.748264] R10: 00007f12f5b27dc0 R11: 0000000000000246 R12: 0000000000000002
[   32.751070] R13: 000000000aba9500 R14: 0000000000000003 R15: 000000000000000e
[   32.754019] Modules linked in: scsi_debug loop intel_rapl_msr sr_mod intel_rapl_common crct10dif_pclmul cdrom crc32_pclmul crc32c_intel ghash_clmulni_intel sd_mod sg ppdev bochs_drm drm_vram_helper ttm ata_generic pata_acpi drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm snd_pcm snd_timer aesni_intel snd crypto_simd cryptd glue_helper soundcore joydev pcspkr serio_raw virtio_scsi ata_piix libata i2c_piix4 floppy parport_pc parport ip_tables [last unloaded: scsi_debug]
[   32.769137] CR2: 0000000000000038
[   32.834708] ---[ end trace bf0f47770d8579d2 ]---


To reproduce:

        # build kernel
	cd linux
	cp config-5.4.0-rc4-00112-g8ebc37a465ccc .config
	make HOSTCC=gcc-7 CC=gcc-7 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage

        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email



Thanks,
lkp


View attachment "config-5.4.0-rc4-00112-g8ebc37a465ccc" of type "text/plain" (200562 bytes)

View attachment "job-script" of type "text/plain" (5333 bytes)

Download attachment "dmesg.xz" of type "application/x-xz" (38628 bytes)

Powered by blists - more mailing lists