[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <202507231021.dcf24373-lkp@intel.com>
Date: Wed, 23 Jul 2025 16:46:15 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Peter Zijlstra <peterz@...radead.org>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>, <linux-kernel@...r.kernel.org>,
<x86@...nel.org>, Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
<linux-mm@...ck.org>, <ltp@...ts.linux.it>, <oliver.sang@...el.com>
Subject: [tip:locking/futex] [futex] 56180dd20c:
BUG:sleeping_function_called_from_invalid_context_at_kernel/nsproxy.c
Hello,
kernel test robot noticed "BUG:sleeping_function_called_from_invalid_context_at_kernel/nsproxy.c" on:
commit: 56180dd20c19e5b0fa34822997a9ac66b517e7b3 ("futex: Use RCU-based per-CPU reference counting instead of rcuref_t")
https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git locking/futex
[test failed on linux-next/master 97987520025658f30bb787a99ffbd9bbff9ffc9d]
in testcase: ltp
version: ltp-x86_64-81ba405df-1_20250719
with following parameters:
test: mm-oom
config: x86_64-rhel-9.4-ltp
compiler: gcc-12
test machine: 104 threads 2 sockets (Skylake) with 192G memory
(please refer to attached dmesg/kmsg for entire log/backtrace)
the issue (1)(2) happen randomly upon 56180dd20c.
a255b78d14324f8a 56180dd20c19e5b0fa34822997a
---------------- ---------------------------
fail:runs %reproduction fail:runs
| | |
:50 48% 24:50 dmesg.BUG:scheduling_while_atomic <---- (2)
:50 48% 24:50 dmesg.BUG:sleeping_function_called_from_invalid_context_at_kernel/nsproxy.c <---- (1)
50:50 0% 50:50 dmesg.Mem-Info
50:50 0% 50:50 dmesg.invoked_oom-killer:gfp_mask=0x
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@...el.com>
| Closes: https://lore.kernel.org/oe-lkp/202507231021.dcf24373-lkp@intel.com
[ 286.673775][ C97] BUG: sleeping function called from invalid context at kernel/nsproxy.c:233 <---- (1)
[ 286.673784][ C97] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6748, name: oom03
[ 286.673787][ C97] preempt_count: 7ffffffe, expected: 0
[ 286.673790][ C97] RCU nest depth: 0, expected: 0
[ 286.673794][ C97] CPU: 97 UID: 0 PID: 6748 Comm: oom03 Not tainted 6.16.0-rc5-00002-g56180dd20c19 #1 PREEMPT(voluntary)
[ 286.673801][ C97] Call Trace:
[ 286.673803][ C97] <TASK>
[ 286.673805][ C97] dump_stack_lvl (lib/dump_stack.c:123 (discriminator 1))
[ 286.673817][ C97] __might_resched (kernel/sched/core.c:8806)
[ 286.673824][ C97] ? free_pid (kernel/pid.c:147)
[ 286.673830][ C97] switch_task_namespaces (include/linux/kernel.h:61 kernel/nsproxy.c:233)
[ 286.673836][ C97] copy_process (kernel/fork.c:2450)
[ 286.673846][ C97] ? __pfx_copy_process (kernel/fork.c:1922)
[ 286.673851][ C97] ? _inline_copy_from_user (arch/x86/include/asm/uaccess_64.h:134 arch/x86/include/asm/uaccess_64.h:134 arch/x86/include/asm/uaccess_64.h:141 include/linux/uaccess.h:178)
[ 286.673859][ C97] ? copy_clone_args_from_user (include/linux/uaccess.h:401 kernel/fork.c:2771)
[ 286.673865][ C97] kernel_clone (include/linux/random.h:26 kernel/fork.c:2604)
[ 286.673870][ C97] ? __pfx_kernel_clone (kernel/fork.c:2563)
[ 286.673877][ C97] __do_sys_clone3 (kernel/fork.c:2907)
[ 286.673880][ C97] ? __pfx___do_sys_clone3 (kernel/fork.c:2887)
[ 286.673886][ C97] ? _raw_spin_lock_irq (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:120 kernel/locking/spinlock.c:170)
[ 286.673892][ C97] ? __pfx__raw_spin_lock_irq (kernel/locking/spinlock.c:169)
[ 286.673897][ C97] ? recalc_sigpending (arch/x86/include/asm/bitops.h:206 arch/x86/include/asm/bitops.h:238 include/asm-generic/bitops/instrumented-non-atomic.h:142 include/linux/thread_info.h:126 kernel/signal.c:180)
[ 286.673902][ C97] ? sigprocmask (kernel/signal.c:3259)
[ 286.673906][ C97] ? __pfx_sigprocmask (kernel/signal.c:3236)
[ 286.673910][ C97] ? wake_up_q (arch/x86/include/asm/atomic.h:93 include/linux/atomic/atomic-arch-fallback.h:949 include/linux/atomic/atomic-instrumented.h:401 include/linux/refcount.h:389 include/linux/refcount.h:432 include/linux/refcount.h:450 include/linux/sched/task.h:134 kernel/sched/core.c:1082)
[ 286.673916][ C97] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 286.673923][ C97] ? __x64_sys_rt_sigprocmask (kernel/signal.c:3341 kernel/signal.c:3318 kernel/signal.c:3318)
[ 286.673928][ C97] ? __pfx_rwsem_wake+0x10/0x10
[ 286.673934][ C97] ? __pfx___x64_sys_rt_sigprocmask (kernel/signal.c:3318)
[ 286.673938][ C97] ? handle_mm_fault (mm/memory.c:6254 mm/memory.c:6407)
[ 286.673948][ C97] ? do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 286.673953][ C97] ? exc_page_fault (arch/x86/include/asm/irqflags.h:37 arch/x86/include/asm/irqflags.h:114 arch/x86/mm/fault.c:1484 arch/x86/mm/fault.c:1532)
[ 286.673958][ C97] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 286.673963][ C97] RIP: 0033:0x7fd4206da889
[ 286.673967][ C97] Code: 31 ed e9 44 ff ff ff e8 25 e9 00 00 0f 1f 44 00 00 b8 ea ff ff ff 48 85 ff 74 2c 48 85 d2 74 27 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 18 74 01 c3 31 ed 48 83 e4 f0 4c 89 c7 ff d2 48 89 c7
All code
========
0: 31 ed xor %ebp,%ebp
2: e9 44 ff ff ff jmp 0xffffffffffffff4b
7: e8 25 e9 00 00 call 0xe931
c: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
11: b8 ea ff ff ff mov $0xffffffea,%eax
16: 48 85 ff test %rdi,%rdi
19: 74 2c je 0x47
1b: 48 85 d2 test %rdx,%rdx
1e: 74 27 je 0x47
20: 49 89 c8 mov %rcx,%r8
23: b8 b3 01 00 00 mov $0x1b3,%eax
28: 0f 05 syscall
2a:* 48 85 c0 test %rax,%rax <-- trapping instruction
2d: 7c 18 jl 0x47
2f: 74 01 je 0x32
31: c3 ret
32: 31 ed xor %ebp,%ebp
34: 48 83 e4 f0 and $0xfffffffffffffff0,%rsp
38: 4c 89 c7 mov %r8,%rdi
3b: ff d2 call *%rdx
3d: 48 89 c7 mov %rax,%rdi
Code starting with the faulting instruction
===========================================
0: 48 85 c0 test %rax,%rax
3: 7c 18 jl 0x1d
5: 74 01 je 0x8
7: c3 ret
8: 31 ed xor %ebp,%ebp
a: 48 83 e4 f0 and $0xfffffffffffffff0,%rsp
e: 4c 89 c7 mov %r8,%rdi
11: ff d2 call *%rdx
13: 48 89 c7 mov %rax,%rdi
[ 286.673970][ C97] RSP: 002b:00007ffe10129188 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3
[ 286.673975][ C97] RAX: ffffffffffffffda RBX: 00007fd420659ef0 RCX: 00007fd4206da889
[ 286.673978][ C97] RDX: 00007fd420659ef0 RSI: 0000000000000058 RDI: 00007ffe101291d0
[ 286.673981][ C97] RBP: 00007fba8a9ff6c0 R08: 00007fba8a9ff6c0 R09: 00007ffe101292c7
[ 286.673983][ C97] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffff78
[ 286.673986][ C97] R13: 0000000000000000 R14: 00007ffe101291d0 R15: 00007fba8a1ff000
[ 286.673991][ C97] </TASK>
[ 286.674639][ C97] BUG: scheduling while atomic: oom03/6748/0x7fffffff <-------- (2)
[ 286.674642][ C97] Modules linked in: intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common skx_edac skx_edac_common nfit libnvdimm btrfs blake2b_generic xor zstd_compress raid6_pq x86_pkg_temp_thermal intel_powerclamp sd_mod sg coretemp kvm_intel irdma kvm snd_pcm irqbypass ghash_clmulni_intel ice snd_timer rapl snd ast ahci intel_cstate gnss soundcore libahci drm_client_lib ib_uverbs nvme mei_me ipmi_ssif drm_shmem_helper intel_uncore ib_core pcspkr acpi_power_meter i2c_i801 nvme_core ioatdma libata drm_kms_helper mei ipmi_si lpc_ich i2c_smbus intel_pch_thermal acpi_ipmi wmi dca ipmi_devintf ipmi_msghandler acpi_pad joydev binfmt_misc drm fuse loop dm_mod ip_tables
[ 286.674732][ C97] CPU: 97 UID: 0 PID: 6748 Comm: oom03 Tainted: G W 6.16.0-rc5-00002-g56180dd20c19 #1 PREEMPT(voluntary)
[ 286.674738][ C97] Tainted: [W]=WARN
[ 286.674740][ C97] Call Trace:
[ 286.674742][ C97] <TASK>
[ 286.674744][ C97] dump_stack_lvl (lib/dump_stack.c:123 (discriminator 1))
[ 286.674748][ C97] __schedule_bug (kernel/sched/core.c:5958)
[ 286.674753][ C97] ? enqueue_task_fair (kernel/sched/fair.c:7030)
[ 286.674760][ C97] schedule_debug (arch/x86/include/asm/preempt.h:34 kernel/sched/core.c:5985)
[ 286.674765][ C97] __schedule (arch/x86/include/asm/jump_label.h:36 include/linux/jump_label.h:208 kernel/sched/features.h:66 kernel/sched/core.c:6689)
[ 286.674770][ C97] ? __pfx___resched_curr (kernel/sched/core.c:1094)
[ 286.674774][ C97] ? set_next_entity (kernel/sched/fair.c:892 kernel/sched/fair.c:5553)
[ 286.674779][ C97] ? __pfx___schedule (kernel/sched/core.c:6667)
[ 286.674783][ C97] ? mod_memcg_state (arch/x86/include/asm/atomic.h:23 include/linux/atomic/atomic-arch-fallback.h:457 include/linux/atomic/atomic-instrumented.h:33 mm/memcontrol.c:562 mm/memcontrol.c:587 mm/memcontrol.c:566 mm/memcontrol.c:707)
[ 286.674792][ C97] ? _raw_spin_lock_irqsave (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:111 kernel/locking/spinlock.c:162)
[ 286.674796][ C97] ? __pfx__raw_spin_lock_irqsave (kernel/locking/spinlock.c:161)
[ 286.674800][ C97] ? __memcg_kmem_uncharge_page (include/linux/percpu-refcount.h:174 include/linux/percpu-refcount.h:332 include/linux/percpu-refcount.h:351 include/linux/memcontrol.h:782 include/linux/memcontrol.h:779 mm/memcontrol.c:2872)
[ 286.674805][ C97] ? do_task_dead (kernel/sched/core.c:6802)
[ 286.674810][ C97] do_task_dead (kernel/sched/core.c:6808 (discriminator 15))
[ 286.674814][ C97] do_exit (include/trace/events/sched.h:335 include/trace/events/sched.h:335 kernel/exit.c:941)
[ 286.674818][ C97] ? __pfx_do_exit (kernel/exit.c:897)
[ 286.674821][ C97] ? task_work_run (kernel/task_work.c:230 (discriminator 1))
[ 286.674825][ C97] ? _raw_spin_lock_irq (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:120 kernel/locking/spinlock.c:170)
[ 286.674831][ C97] do_group_exit (kernel/exit.c:1086)
[ 286.674835][ C97] get_signal (include/linux/list.h:218 include/linux/list.h:287 kernel/signal.c:704 kernel/signal.c:2912)
[ 286.674840][ C97] ? __do_sys_clone3 (kernel/fork.c:2907)
[ 286.674843][ C97] ? __pfx___do_sys_clone3 (kernel/fork.c:2887)
[ 286.674847][ C97] ? __pfx_get_signal (kernel/signal.c:2800)
[ 286.674852][ C97] arch_do_signal_or_restart (arch/x86/kernel/signal.c:337)
[ 286.674858][ C97] ? __pfx_arch_do_signal_or_restart (arch/x86/kernel/signal.c:334)
[ 286.674862][ C97] ? __pfx__raw_spin_lock_irq (kernel/locking/spinlock.c:169)
[ 286.674867][ C97] ? recalc_sigpending (arch/x86/include/asm/bitops.h:206 arch/x86/include/asm/bitops.h:238 include/asm-generic/bitops/instrumented-non-atomic.h:142 include/linux/thread_info.h:126 kernel/signal.c:180)
[ 286.674871][ C97] ? sigprocmask (kernel/signal.c:3259)
[ 286.674875][ C97] ? __pfx_sigprocmask (kernel/signal.c:3236)
[ 286.674879][ C97] exit_to_user_mode_loop (kernel/entry/common.c:113)
[ 286.674884][ C97] do_syscall_64 (include/linux/entry-common.h:330 include/linux/entry-common.h:414 include/linux/entry-common.h:449 arch/x86/entry/syscall_64.c:100)
[ 286.674889][ C97] ? __x64_sys_rt_sigprocmask (kernel/signal.c:3341 kernel/signal.c:3318 kernel/signal.c:3318)
[ 286.674892][ C97] ? __pfx_rwsem_wake+0x10/0x10
[ 286.674897][ C97] ? __pfx___x64_sys_rt_sigprocmask (kernel/signal.c:3318)
[ 286.674901][ C97] ? handle_mm_fault (mm/memory.c:6254 mm/memory.c:6407)
[ 286.674907][ C97] ? do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 286.674913][ C97] ? exc_page_fault (arch/x86/include/asm/irqflags.h:37 arch/x86/include/asm/irqflags.h:114 arch/x86/mm/fault.c:1484 arch/x86/mm/fault.c:1532)
[ 286.674917][ C97] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 286.674921][ C97] RIP: 0033:0x7fd4206da889
[ 286.674924][ C97] Code: Unable to access opcode bytes at 0x7fd4206da85f.
Code starting with the faulting instruction
===========================================
[ 286.674926][ C97] RSP: 002b:00007ffe10129188 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3
[ 286.674929][ C97] RAX: fffffffffffffff4 RBX: 00007fd420659ef0 RCX: 00007fd4206da889
[ 286.674932][ C97] RDX: 00007fd420659ef0 RSI: 0000000000000058 RDI: 00007ffe101291d0
[ 286.674934][ C97] RBP: 00007fba8a9ff6c0 R08: 00007fba8a9ff6c0 R09: 00007ffe101292c7
[ 286.674936][ C97] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffff78
[ 286.674939][ C97] R13: 0000000000000000 R14: 00007ffe101291d0 R15: 00007fba8a1ff000
[ 286.674944][ C97] </TASK>
[ 286.705993][ T6788] oom03 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0
[ 286.707733][ T1358]
[ 286.709933][ T6788] CPU: 48 UID: 0 PID: 6788 Comm: oom03 Tainted: G W 6.16.0-rc5-00002-g56180dd20c19 #1 PREEMPT(voluntary)
[ 286.709942][ T6788] Tainted: [W]=WARN
[ 286.709944][ T6788] Call Trace:
[ 286.709946][ T6788] <TASK>
[ 286.709948][ T6788] dump_stack_lvl (lib/dump_stack.c:123 (discriminator 1))
[ 286.709956][ T6788] dump_header (mm/oom_kill.c:74 mm/oom_kill.c:468)
[ 286.709964][ T6788] oom_kill_process (mm/oom_kill.c:450 mm/oom_kill.c:1041)
[ 286.709970][ T6788] out_of_memory (mm/oom_kill.c:1180 (discriminator 4))
[ 286.709975][ T6788] ? __pfx_out_of_memory (mm/oom_kill.c:1113)
[ 286.709980][ T6788] ? try_to_free_mem_cgroup_pages (include/linux/sched/mm.h:339 include/linux/sched/mm.h:440 mm/vmscan.c:6710)
[ 286.709989][ T6788] mem_cgroup_out_of_memory (mm/memcontrol.c:1654)
[ 286.709998][ T6788] ? __pfx_mem_cgroup_out_of_memory (mm/memcontrol.c:1634)
[ 286.710005][ T6788] ? cgroup_file_notify (kernel/cgroup/cgroup.c:4570)
[ 286.710012][ T6788] try_charge_memcg (mm/memcontrol.c:1677 mm/memcontrol.c:2404)
[ 286.710018][ T6788] ? __pfx_try_charge_memcg (mm/memcontrol.c:2306)
[ 286.710023][ T6788] ? folio_alloc_mpol_noprof (arch/x86/include/asm/bitops.h:206 arch/x86/include/asm/bitops.h:238 include/asm-generic/bitops/instrumented-non-atomic.h:142 include/linux/page-flags.h:867 include/linux/page-flags.h:888 mm/internal.h:755 mm/mempolicy.c:2444)
[ 286.710029][ T6788] ? vma_alloc_folio_noprof (mm/mempolicy.c:2473)
[ 286.710034][ T6788] charge_memcg (mm/memcontrol.c:4771)
[ 286.710039][ T6788] __mem_cgroup_charge (include/linux/cgroup_refcnt.h:78 mm/memcontrol.c:4788)
[ 286.710044][ T6788] alloc_anon_folio (mm/memory.c:1073 mm/memory.c:5014)
[ 286.710050][ T6788] ? __folio_batch_add_and_move (arch/x86/include/asm/atomic.h:23 include/linux/atomic/atomic-arch-fallback.h:457 include/linux/atomic/atomic-instrumented.h:33 include/linux/swap.h:391 mm/swap.c:195)
[ 286.710058][ T6788] do_anonymous_page (mm/memory.c:5071)
[ 286.710063][ T6788] ? ___pte_offset_map (include/linux/pgtable.h:347 include/linux/pgtable.h:624 mm/pgtable-generic.c:289)
[ 286.710070][ T6788] handle_pte_fault (mm/memory.c:6069)
[ 286.710074][ T6788] ? reweight_entity (kernel/sched/fair.c:3836)
[ 286.710079][ T6788] ? __pfx_handle_pte_fault (mm/memory.c:6026)
[ 286.710083][ T6788] ? __pfx_run_posix_cpu_timers (kernel/time/posix-cpu-timers.c:1403)
[ 286.710091][ T6788] __handle_mm_fault (mm/memory.c:6212)
[ 286.710096][ T6788] ? __update_blocked_fair (kernel/sched/fair.c:9813)
[ 286.710100][ T6788] ? __pfx___handle_mm_fault (mm/memory.c:6121)
[ 286.710109][ T6788] handle_mm_fault (mm/memory.c:6381)
[ 286.710113][ T6788] ? irqtime_account_irq (kernel/sched/cputime.c:64)
[ 286.710118][ T6788] do_user_addr_fault (arch/x86/mm/fault.c:1337)
[ 286.710127][ T6788] exc_page_fault (arch/x86/include/asm/irqflags.h:37 arch/x86/include/asm/irqflags.h:114 arch/x86/mm/fault.c:1484 arch/x86/mm/fault.c:1532)
[ 286.710132][ T6788] asm_exc_page_fault (arch/x86/include/asm/idtentry.h:574)
[ 286.710136][ T6788] RIP: 0033:0x5597027a6fc8
[ 286.710139][ T6788] Code: f4 ff ff 48 83 f8 ff 0f 84 96 00 00 00 48 89 c5 41 83 fc 02 74 2c 41 83 fc 03 74 6e e8 91 fc ff ff 31 d2 48 98 0f 1f 44 00 00 <c6> 44 15 00 07 48 01 c2 48 39 d3 7f f3 31 c0 5b 5d 41 5c c3 0f 1f
All code
========
0: f4 hlt
1: ff (bad)
2: ff 48 83 decl -0x7d(%rax)
5: f8 clc
6: ff 0f decl (%rdi)
8: 84 96 00 00 00 48 test %dl,0x48000000(%rsi)
e: 89 c5 mov %eax,%ebp
10: 41 83 fc 02 cmp $0x2,%r12d
14: 74 2c je 0x42
16: 41 83 fc 03 cmp $0x3,%r12d
1a: 74 6e je 0x8a
1c: e8 91 fc ff ff call 0xfffffffffffffcb2
21: 31 d2 xor %edx,%edx
23: 48 98 cltq
25: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
2a:* c6 44 15 00 07 movb $0x7,0x0(%rbp,%rdx,1) <-- trapping instruction
2f: 48 01 c2 add %rax,%rdx
32: 48 39 d3 cmp %rdx,%rbx
35: 7f f3 jg 0x2a
37: 31 c0 xor %eax,%eax
39: 5b pop %rbx
3a: 5d pop %rbp
3b: 41 5c pop %r12
3d: c3 ret
3e: 0f .byte 0xf
3f: 1f (bad)
Code starting with the faulting instruction
===========================================
0: c6 44 15 00 07 movb $0x7,0x0(%rbp,%rdx,1)
5: 48 01 c2 add %rax,%rdx
8: 48 39 d3 cmp %rdx,%rbx
b: 7f f3 jg 0x0
d: 31 c0 xor %eax,%eax
f: 5b pop %rbx
10: 5d pop %rbp
11: 41 5c pop %r12
13: c3 ret
14: 0f .byte 0xf
15: 1f (bad)
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250723/202507231021.dcf24373-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists