lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list] 
Message-ID: <CA+G9fYtJENPx+vxd+J3Zw5LwXceTS-dEsp74ZrH9cDe4DKfvsA@mail.gmail.com>
Date: Tue, 5 Aug 2025 15:37:38 +0530
From: Naresh Kamboju <naresh.kamboju@...aro.org>
To: Harry Yoo <harry.yoo@...cle.com>
Cc: Linux ARM <linux-arm-kernel@...ts.infradead.org>, linux-mm <linux-mm@...ck.org>, 
	open list <linux-kernel@...r.kernel.org>, lkft-triage@...ts.linaro.org, 
	Linux Regressions <regressions@...ts.linux.dev>, Thomas Gleixner <tglx@...utronix.de>, 
	Andrew Morton <akpm@...ux-foundation.org>, 
	Sebastian Andrzej Siewior <bigeasy@...utronix.de>, Anders Roxell <anders.roxell@...aro.org>, 
	Arnd Bergmann <arnd@...db.de>, Dan Carpenter <dan.carpenter@...aro.org>, 
	Vlastimil Babka <vbabka@...e.cz>, "Paul E. McKenney" <paulmck@...nel.org>, Will Deacon <will@...nel.org>, 
	Catalin Marinas <catalin.marinas@....com>, Ben Copeland <benjamin.copeland@...aro.org>, 
	kunit-dev@...glegroups.com
Subject: Re: next-20250729: PREEMPT_RT: rock Pi 4b Internal error Oops
 kmem_cache_alloc_bulk_noprof - kernel locking rtmutex.c at __rt_mutex_slowlock_locked

On Mon, 4 Aug 2025 at 13:26, Harry Yoo <harry.yoo@...cle.com> wrote:
>
> On Sat, Aug 02, 2025 at 03:45:51PM +0530, Naresh Kamboju wrote:
> > Regressions found while validating Linux next on the Radxa Rock Pi 4B
> > platform, we observed kernel crashes and deadlock warnings when running LTP
> > syscall and controller tests under specific PREEMPT_RT configurations.
> > These issues appear to be regressions introduced in next-20250729.
> >
> > * CONFIG_EXPERT=y
> > * CONFIG_PREEMPT_RT=y
> > * CONFIG_LAZY_PREEMPT=y
> >
> > Regression Analysis:
> > - New regression? Yes
> > - Reproducibility? Intermittent
> >
> > First seen on the next-20250729
> > Good: next-20250728
> > Bad: next-20250729 and next-20250801
> >
> > Test regression: next-20250729 rock Pi 4b Internal error Oops
> > kmem_cache_alloc_bulk_noprof
> > Test regression: next-20250729 rock Pi 4b WARNING kernel locking
> > rtmutex.c at __rt_mutex_slowlock_locked
> > Test regression: next-20250729 rock Pi 4b WARNING kernel rcu
> > tree_plugin.h at rcu_note_context_switch
> >
> > Reported-by: Linux Kernel Functional Testing <lkft@...aro.org>
>
> Thanks for the report, Naresh!
>
> based on the stack trace, I think there might be a use-after-free or
> buffer overflow bug that could trigger this.
>
> Could you please try to reproduce it with KASAN enabled to confirm that
> it is the case?


I have recompiled the kernel with KASAN enabled and rerun the KUNIT tests,
along with the LTP syscall tests, in an effort to reproduce the previously
reported issue.

While the LTP syscall tests did not reproduce the problem, I consistently
observed a null pointer dereference during KUNIT testing, specifically in
the kunit_fault test, as shown in the log below.

I’ve seen this same crash across several kernel versions, and it is always
reproducible when running KUNIT tests.

Could you please confirm if this behavior is expected from the
kunit_fault test, or if it indicates an issue that requires further
investigation?

## Boot log
[   69.507629]     KTAP version 1
[   69.507638]     # Subtest: kunit_fault
[   69.507651]     # module: kunit_test
[   69.507677]     1..1
[   69.508631] Unable to handle kernel paging request at virtual
address dfff800000000000
[   69.508661] KASAN: null-ptr-deref in range
[0x0000000000000000-0x0000000000000007]
[   69.508676] Mem abort info:
[   69.508684]   ESR = 0x0000000096000005
[   69.508695]   EC = 0x25: DABT (current EL), IL = 32 bits
[   69.508709]   SET = 0, FnV = 0
[   69.508719]   EA = 0, S1PTW = 0
[   69.508730]   FSC = 0x05: level 1 translation fault
[   69.508742] Data abort info:
[   69.508750]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[   69.508761]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[   69.508774]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[   69.508787] [dfff800000000000] address between user and kernel address ranges
[   69.508804] Internal error: Oops: 0000000096000005 [#1]  SMP
[   69.508819] Modules linked in:
[   69.508846] CPU: 3 UID: 0 PID: 683 Comm: kunit_try_catch Tainted: G
   B            N  6.16.0-next-20250801 #1 PREEMPT_RT
[   69.508873] Tainted: [B]=BAD_PAGE, [N]=TEST
[   69.508881] Hardware name: Radxa ROCK Pi 4B (DT)
[   69.508891] pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   69.508907] pc : kunit_test_null_dereference+0x70/0x170
[   69.508940] lr : kunit_generic_run_threadfn_adapter+0x88/0x100
[   69.508959] sp : ffff80008a867d30
[   69.508967] x29: ffff80008a867d90 x28: 0000000000000000 x27: 0000000000000000
[   69.508992] x26: 0000000000000000 x25: 1fffe00001777601 x24: 0000000000000004
[   69.509017] x23: ffff00000bbbb00c x22: ffff800081203028 x21: ffff00000201aa08
[   69.509042] x20: 1ffff0001150cfa6 x19: ffff800088077970 x18: ffff800089386ed0
[   69.509067] x17: 0000000000000001 x16: ffff0000d1660de8 x15: 0000000000000000
[   69.509091] x14: 1fffe0001a2cc0c0 x13: 0002000000000000 x12: ffff6000022f7620
[   69.509116] x11: 1fffe000022f761f x10: ffff6000022f761f x9 : ffff8000811fa7b8
[   69.509141] x8 : ffff80008a867c18 x7 : 0000000000000000 x6 : 0000000041b58ab3
[   69.509165] x5 : ffff70001150cfa6 x4 : 00000000f1f1f1f1 x3 : 0000000000000003
[   69.509189] x2 : dfff800000000000 x1 : ffff0000117ba800 x0 : ffff800088077970
[   69.509214] Call trace:
[   69.509223]  kunit_test_null_dereference+0x70/0x170 (P)
[   69.509246]  kunit_generic_run_threadfn_adapter+0x88/0x100
[   69.509267]  kthread+0x328/0x648
[   69.509286]  ret_from_fork+0x10/0x20
[   69.509316] Code: b90004a3 d5384101 52800063 aa0003f3 (39c00042)
[   69.509330] ---[ end trace 0000000000000000 ]---

Links:
 * https://lkft.validation.linaro.org/scheduler/job/8383286#L7826
 * https://lkft.validation.linaro.org/scheduler/job/8383276#L7984
 * https://lkft.validation.linaro.org/scheduler/job/8383282#L8011
 * https://lkft.validation.linaro.org/scheduler/job/8383281#L7992
 * https://storage.tuxsuite.com/public/linaro/lkft/builds/30ptGIUaeIy9JtIhx9OmKXrzop5/

> > ## Test log
> > [  527.570253] Unable to handle kernel paging request at virtual
> > address 003f0020f94020a1
> > [  527.570274] Mem abort info:
> > [  527.570277]   ESR = 0x0000000096000004
> > [  527.570282]   EC = 0x25: DABT (current EL), IL = 32 bits
> > [  527.570288]   SET = 0, FnV = 0
> > [  527.570292]   EA = 0, S1PTW = 0
> > [  527.570297]   FSC = 0x04: level 0 translation fault
> > [  527.570302] Data abort info:
> > [  527.570305]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
> > [  527.570310]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> > [  527.570316]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> > [  527.570322] [003f0020f94020a1] address between user and kernel address ranges
> > [  527.570330] Internal error: Oops: 0000000096000004 [#1]  SMP
> > [  527.570336] Modules linked in: brcmfmac rockchip_dfi brcmutil
> > cfg80211 snd_soc_hdmi_codec dw_hdmi_i2s_audio dw_hdmi_cec
> > snd_soc_simple_card snd_soc_audio_graph_card hci_uart
> > snd_soc_rockchip_i2s snd_soc_es8316 snd_soc_spdif_tx
> > snd_soc_simple_card_utils btqca rtc_rk808 rockchipdrm btbcm
> > snd_soc_core dw_hdmi_qp bluetooth snd_compress reset_gpio analogix_dp
> > snd_pcm_dmaengine panfrost hantro_vpu dw_mipi_dsi rfkill rockchip_rga
> > drm_shmem_helper drm_dp_aux_bus snd_pcm gpu_sched dw_hdmi pwrseq_core
> > videobuf2_dma_sg v4l2_vp9 snd_timer drm_display_helper v4l2_h264
> > v4l2_jpeg phy_rockchip_pcie snd v4l2_mem2mem cec videobuf2_dma_contig
> > soundcore videobuf2_memops drm_client_lib videobuf2_v4l2
> > drm_dma_helper videobuf2_common rockchip_saradc drm_kms_helper
> > industrialio_triggered_buffer kfifo_buf rockchip_thermal
> > pcie_rockchip_host coresight_cpu_debug fuse drm backlight
> > [  527.570493] CPU: 3 UID: 0 PID: 34254 Comm: mkdir Not tainted
> > 6.16.0-next-20250801 #1 PREEMPT_RT
> > [  527.570502] Hardware name: Radxa ROCK Pi 4B (DT)
> > [  527.570506] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> > [  527.570512] pc : kmem_cache_alloc_bulk_noprof (mm/slub.c:5343
> > (discriminator 1) mm/slub.c:5403 (discriminator 1))
> > [  527.570527] lr : kmem_cache_alloc_bulk_noprof
> > (include/linux/atomic/atomic-arch-fallback.h:457
> > include/linux/atomic/atomic-instrumented.h:33
> > include/linux/kfence.h:127 mm/slub.c:5307 mm/slub.c:5403)
> > [  527.570533] sp : ffff80008e24b8f0
> > [  527.570536] x29: ffff80008e24b930 x28: 00ff000000584610 x27: ffff800082b30538
> > [  527.570545] x26: ffff8000816b64dc x25: 0000000000000cc0 x24: 0000000000000000
> > [  527.570554] x23: 0000000000000004 x22: ffff0000f7579d20 x21: 0000000000000001
> > [  527.570563] x20: 0000000000000001 x19: ffff000000405b00 x18: ffff80008e24bcd0
> > [  527.570572] x17: 0000000000000000 x16: ffff800081e18420 x15: 0000ffffa2670fff
> > [  527.570582] x14: 0000000000000000 x13: 1fffe000017942e1 x12: 0000ffffa2470fff
> > [  527.570591] x11: ffff00000bca1708 x10: 0000000000000001 x9 : ffff8000816e41a4
> > [  527.570600] x8 : ffff80008e24b850 x7 : fefefefefefefefe x6 : ffff800082b30000
> > [  527.570608] x5 : d63f0020f9402021 x4 : ffff0000f7579d58 x3 : 0000000000000000
> > [  527.570617] x2 : 0000000000000000 x1 : 0000000000000100 x0 : 0000000000000080
> > [  527.570627] Call trace:
> > [  527.570631] kmem_cache_alloc_bulk_noprof (mm/slub.c:5343
>
> It crashes in get_freepointer() because a bad pointer is passed to it.
>
> I think it is reasonable to suspect that the freelist chain is corrupt
> due to a use-after-free or buffer overflow (either in maple tree code,
> or something else that shares the cache with maple tree nodes).
>
> > (discriminator 1) mm/slub.c:5403 (discriminator 1)) (P)
> > [  527.570639] mas_alloc_nodes (lib/maple_tree.c:1278)
> > [  527.570651] mas_node_count_gfp (lib/maple_tree.c:1339)
> > [  527.570661] mas_preallocate (lib/maple_tree.c:5538 (discriminator 1))
> > [  527.570667] __split_vma (mm/vma.c:528 (discriminator 1))
> > [  527.570677] vma_modify (mm/vma.c:1633)
> > [  527.570685] vma_modify_flags (mm/vma.c:1650)
> > [  527.570694] mprotect_fixup (mm/mprotect.c:819)
> > [  527.570704] do_mprotect_pkey (mm/mprotect.c:993)
> > [  527.570713] __arm64_sys_mprotect (mm/mprotect.c:1011)
> > [  527.570722] invoke_syscall (arch/arm64/include/asm/current.h:19
> > arch/arm64/kernel/syscall.c:54)
> > [  527.570731] el0_svc_common.constprop.0
> > (include/linux/thread_info.h:135 (discriminator 2)
> > arch/arm64/kernel/syscall.c:140 (discriminator 2))
> > [  527.570737] do_el0_svc (arch/arm64/kernel/syscall.c:152)
> > [  527.570744] el0_svc (arch/arm64/include/asm/irqflags.h:82
> > (discriminator 1) arch/arm64/include/asm/irqflags.h:123 (discriminator
> > 1) arch/arm64/include/asm/irqflags.h:136 (discriminator 1)
> > arch/arm64/kernel/entry-common.c:169 (discriminator 1)
> > arch/arm64/kernel/entry-common.c:182 (discriminator 1)
> > arch/arm64/kernel/entry-common.c:880 (discriminator 1))
> > [  527.570752] el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:899)
> > [  527.570760] el0t_64_sync (arch/arm64/kernel/entry.S:596)
> > [ 527.570772] Code: 1400000c f94002c5 b4000aa5 b9402a60 (f86068a0)
> > All code
> > ========
> >    0: 1400000c b 0x30
> >    4: f94002c5 ldr x5, [x22]
> >    8: b4000aa5 cbz x5, 0x15c
> >    c: b9402a60 ldr w0, [x19, #40]
> >   10:* f86068a0 ldr x0, [x5, x0] <-- trapping instruction
> >
> > Code starting with the faulting instruction
> > ===========================================
> >    0: f86068a0 ldr x0, [x5, x0]
> > [  527.570778] ---[ end trace 0000000000000000 ]---
> > [  527.570800] ------------[ cut here ]------------
> > [  527.570803] rtmutex deadlock detected
> > [  527.570827] WARNING: kernel/locking/rtmutex.c:1674 at
> > __rt_mutex_slowlock_locked.constprop.0+0x800/0x8e0, CPU#3: mkdir/34254
> > [  527.570841] Modules linked in: brcmfmac rockchip_dfi brcmutil
> > cfg80211 snd_soc_hdmi_codec dw_hdmi_i2s_audio dw_hdmi_cec
> > snd_soc_simple_card snd_soc_audio_graph_card hci_uart
> > snd_soc_rockchip_i2s snd_soc_es8316 snd_soc_spdif_tx
> > snd_soc_simple_card_utils btqca rtc_rk808 rockchipdrm btbcm
> > snd_soc_core dw_hdmi_qp bluetooth snd_compress reset_gpio analogix_dp
> > snd_pcm_dmaengine panfrost hantro_vpu dw_mipi_dsi rfkill rockchip_rga
> > drm_shmem_helper drm_dp_aux_bus snd_pcm gpu_sched dw_hdmi pwrseq_core
> > videobuf2_dma_sg v4l2_vp9 snd_timer drm_display_helper v4l2_h264
> > v4l2_jpeg phy_rockchip_pcie snd v4l2_mem2mem cec videobuf2_dma_contig
> > soundcore videobuf2_memops drm_client_lib videobuf2_v4l2
> > drm_dma_helper videobuf2_common rockchip_saradc drm_kms_helper
> > industrialio_triggered_buffer kfifo_buf rockchip_thermal
> > pcie_rockchip_host coresight_cpu_debug fuse drm backlight
> > [  527.570965] CPU: 3 UID: 0 PID: 34254 Comm: mkdir Tainted: G      D
> >            6.16.0-next-20250801 #1 PREEMPT_RT
> > [  527.570973] Tainted: [D]=DIE
> > [  527.570976] Hardware name: Radxa ROCK Pi 4B (DT)
> > [  527.570979] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> > [  527.570985] pc : __rt_mutex_slowlock_locked.constprop.0
> > (kernel/locking/rtmutex.c:1674 (discriminator 1)
> > kernel/locking/rtmutex.c:1734 (discriminator 1)
> > kernel/locking/rtmutex.c:1760 (discriminator 1))
> > [  527.570993] lr : __rt_mutex_slowlock_locked.constprop.0
> > (kernel/locking/rtmutex.c:1674 (discriminator 1)
> > kernel/locking/rtmutex.c:1734 (discriminator 1)
> > kernel/locking/rtmutex.c:1760 (discriminator 1))
> > [  527.571001] sp : ffff80008e24b2e0
> > [  527.571004] x29: ffff80008e24b370 x28: ffff000007c1a600 x27: ffff000007c1a601
> > [  527.571013] x26: ffff80008e24b318 x25: ffff000007c1a600 x24: 00000000ffffffdd
> > [  527.571023] x23: 00000000ffffffdd x22: 0000000000000001 x21: ffff000007c1a601
> > [  527.571032] x20: ffff80008e24b2f0 x19: ffff00001d756e30 x18: 0000000000000000
> > [  527.571041] x17: 65676e6172207373 x16: 6572646461206c65 x15: 0000000000000000
> > [  527.571050] x14: 0000000000000020 x13: 0a64657463657465 x12: 64206b636f6c6461
> > [  527.571059] x11: 656820747563205b x10: ffff800082adac08 x9 : ffff80008015020c
> > [  527.571068] x8 : ffff80008e24af08 x7 : 0000000000000001 x6 : ffff800082a5e000
> > [  527.571077] x5 : ffff000007c1a600 x4 : 0000000000000000 x3 : 0000000000000027
> > [  527.571086] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000007c1a600
> > [  527.571094] Call trace:
> > [  527.571097] __rt_mutex_slowlock_locked.constprop.0
> > (kernel/locking/rtmutex.c:1674 (discriminator 1)
> > kernel/locking/rtmutex.c:1734 (discriminator 1)
> > kernel/locking/rtmutex.c:1760 (discriminator 1)) (P)
> > [  527.571107] __rwbase_read_lock (kernel/locking/rwbase_rt.c:114)
> > [  527.571117] down_read (kernel/locking/rwsem.c:1540)
> > [  527.571126] acct_collect (arch/arm64/include/asm/jump_label.h:36
> > include/linux/mmap_lock.h:41 include/linux/mmap_lock.h:454
> > kernel/acct.c:597)
> > [  527.571135] do_exit (kernel/exit.c:932)
> > [  527.571143] make_task_dead
> > (arch/arm64/include/asm/atomic_ll_sc.h:95 (discriminator 2)
> > arch/arm64/include/asm/atomic.h:52 (discriminator 2)
> > include/linux/atomic/atomic-arch-fallback.h:564 (discriminator 2)
> > include/linux/atomic/atomic-arch-fallback.h:1020 (discriminator 2)
> > include/linux/atomic/atomic-instrumented.h:454 (discriminator 2)
> > kernel/exit.c:1049 (discriminator 2))
> > [  527.571150] die (arch/arm64/kernel/traps.c:231)
> > [  527.571157] die_kernel_fault (arch/arm64/mm/fault.c:313)
> > [  527.571167] __do_kernel_fault (arch/arm64/mm/fault.c:375 (discriminator 5))
> > [  527.571177] do_bad_area (arch/arm64/mm/fault.c:482)
> > [  527.571186] do_translation_fault (arch/arm64/mm/fault.c:792)
> > [  527.571195] do_mem_abort (arch/arm64/mm/fault.c:929 (discriminator 1))
> > [  527.571204] el1_abort (arch/arm64/include/asm/daifflags.h:28
> > arch/arm64/kernel/entry-common.c:482)
> > [  527.571210] el1h_64_sync_handler (arch/arm64/kernel/entry-common.c:637)
> > [  527.571218] el1h_64_sync (arch/arm64/kernel/entry.S:591)
>
> The deadlock wouldn't have been triggered if it didn't crash in SLUB, so
> this looks rather irrelevant.
>
> --
> Cheers,
> Harry / Hyeonggon
>
> > [  527.571225] kmem_cache_alloc_bulk_noprof (mm/slub.c:5343
> > (discriminator 1) mm/slub.c:5403 (discriminator 1)) (P)
> > [  527.571232] mas_alloc_nodes (lib/maple_tree.c:1278)
> > [  527.571241] mas_node_count_gfp (lib/maple_tree.c:1339)
> > [  527.571251] mas_preallocate (lib/maple_tree.c:5538 (discriminator 1))
> > [  527.571257] __split_vma (mm/vma.c:528 (discriminator 1))
> > [  527.571265] vma_modify (mm/vma.c:1633)
> > [  527.571273] vma_modify_flags (mm/vma.c:1650)
> > [  527.571282] mprotect_fixup (mm/mprotect.c:819)
> > [  527.571290] do_mprotect_pkey (mm/mprotect.c:993)
> > [  527.571299] __arm64_sys_mprotect (mm/mprotect.c:1011)
> > [  527.571308] invoke_syscall (arch/arm64/include/asm/current.h:19
> > arch/arm64/kernel/syscall.c:54)
> > [  527.571314] el0_svc_common.constprop.0
> > (include/linux/thread_info.h:135 (discriminator 2)
> > arch/arm64/kernel/syscall.c:140 (discriminator 2))
> > [  527.571321] do_el0_svc (arch/arm64/kernel/syscall.c:152)
> > [  527.571327] el0_svc (arch/arm64/include/asm/irqflags.h:82
> > (discriminator 1) arch/arm64/include/asm/irqflags.h:123 (discriminator
> > 1) arch/arm64/include/asm/irqflags.h:136 (discriminator 1)
> > arch/arm64/kernel/entry-common.c:169 (discriminator 1)
> > arch/arm64/kernel/entry-common.c:182 (discriminator 1)
> > arch/arm64/kernel/entry-common.c:880 (discriminator 1))
> > [  527.571334] el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:899)
> > [  527.571341] el0t_64_sync (arch/arm64/kernel/entry.S:596)
> > [  527.571349] ---[ end trace 0000000000000000 ]---
> > [  527.571354] ------------[ cut here ]------------
> > [  527.571356] Voluntary context switch within RCU read-side critical section!
> > [  527.571372] WARNING: kernel/rcu/tree_plugin.h:332 at
> > rcu_note_context_switch+0x4ec/0x538, CPU#3: mkdir/34254
> > [  527.571383] Modules linked in: brcmfmac rockchip_dfi brcmutil
> > cfg80211 snd_soc_hdmi_codec dw_hdmi_i2s_audio dw_hdmi_cec
> > snd_soc_simple_card snd_soc_audio_graph_card hci_uart
> > snd_soc_rockchip_i2s snd_soc_es8316 snd_soc_spdif_tx
> > snd_soc_simple_card_utils btqca rtc_rk808 rockchipdrm btbcm
> > snd_soc_core dw_hdmi_qp bluetooth snd_compress reset_gpio analogix_dp
> > snd_pcm_dmaengine panfrost hantro_vpu dw_mipi_dsi rfkill rockchip_rga
> > drm_shmem_helper drm_dp_aux_bus snd_pcm gpu_sched dw_hdmi pwrseq_core
> > videobuf2_dma_sg v4l2_vp9 snd_timer drm_display_helper v4l2_h264
> > v4l2_jpeg phy_rockchip_pcie snd v4l2_mem2mem cec videobuf2_dma_contig
> > soundcore videobuf2_memops drm_client_lib videobuf2_v4l2
> > drm_dma_helper videobuf2_common rockchip_saradc drm_kms_helper
> > industrialio_triggered_buffer kfifo_buf rockchip_thermal
> > pcie_rockchip_host coresight_cpu_debug fuse drm backlight
> > [  527.571503] CPU: 3 UID: 0 PID: 34254 Comm: mkdir Tainted: G      D
> > W           6.16.0-next-20250801 #1 PREEMPT_RT
> > [  527.571512] Tainted: [D]=DIE, [W]=WARN
> > [  527.571514] Hardware name: Radxa ROCK Pi 4B (DT)
> > [  527.571517] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> > [  527.571523] pc : rcu_note_context_switch
> > (kernel/rcu/tree_plugin.h:332 (discriminator 1))
> > [  527.571529] lr : rcu_note_context_switch
> > (kernel/rcu/tree_plugin.h:332 (discriminator 1))
> > [  527.571535] sp : ffff80008e24b1e0
> > [  527.571538] x29: ffff80008e24b1e0 x28: ffff000007c1a600 x27: ffff000007c1a601
> > [  527.571548] x26: 0000000000000000 x25: ffff000007c1a600 x24: ffff800082a60368
> > [  527.571557] x23: 0000000000000000 x22: ffff000007c1a600 x21: ffff800083125260
> > [  527.571566] x20: 0000000000000000 x19: ffff0000f7576080 x18: 0000000000000000
> > [  527.571575] x17: 65676e6172207373 x16: 6572646461206c65 x15: 0000000000000000
> > [  527.571583] x14: 0000000000000020 x13: 216e6f6974636573 x12: 206c616369746972
> > [  527.571593] x11: 6320656469732d64 x10: 6165722055435220 x9 : ffff80008015020c
> > [  527.571602] x8 : 6863746977732074 x7 : 7865746e6f632079 x6 : 7261746e756c6f56
> > [  527.571611] x5 : ffff80008317146f x4 : 0000000000000000 x3 : 0000000000000027
> > [  527.571619] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000007c1a600
> > [  527.571628] Call trace:
> > [  527.571630] rcu_note_context_switch (kernel/rcu/tree_plugin.h:332
> > (discriminator 1)) (P)
> > [  527.571638] __schedule (kernel/sched/core.c:634
> > kernel/sched/sched.h:1519 kernel/sched/sched.h:1841
> > kernel/sched/core.c:6865)
> > [  527.571647] rt_mutex_schedule (kernel/sched/core.c:7044
> > kernel/sched/core.c:7339)
> > [  527.571655] __rt_mutex_slowlock_locked.constprop.0
> > (kernel/locking/rtmutex.c:1676 kernel/locking/rtmutex.c:1734
> > kernel/locking/rtmutex.c:1760)
> > [  527.571665] __rwbase_read_lock (kernel/locking/rwbase_rt.c:114)
> > [  527.571674] down_read (kernel/locking/rwsem.c:1540)
> > [  527.571683] acct_collect (arch/arm64/include/asm/jump_label.h:36
> > include/linux/mmap_lock.h:41 include/linux/mmap_lock.h:454
> > kernel/acct.c:597)
> > [  527.571690] do_exit (kernel/exit.c:932)
> > [  527.571696] make_task_dead
> > (arch/arm64/include/asm/atomic_ll_sc.h:95 (discriminator 2)
> > arch/arm64/include/asm/atomic.h:52 (discriminator 2)
> > include/linux/atomic/atomic-arch-fallback.h:564 (discriminator 2)
> > include/linux/atomic/atomic-arch-fallback.h:1020 (discriminator 2)
> > include/linux/atomic/atomic-instrumented.h:454 (discriminator 2)
> > kernel/exit.c:1049 (discriminator 2))
> > [  527.571703] die (arch/arm64/kernel/traps.c:231)
> > [  527.571710] die_kernel_fault (arch/arm64/mm/fault.c:313)
> > [  527.571719] __do_kernel_fault (arch/arm64/mm/fault.c:375 (discriminator 5))
> > [  527.571729] do_bad_area (arch/arm64/mm/fault.c:482)
> > [  527.571738] do_translation_fault (arch/arm64/mm/fault.c:792)
> > [  527.571746] do_mem_abort (arch/arm64/mm/fault.c:929 (discriminator 1))
> > [  527.571755] el1_abort (arch/arm64/include/asm/daifflags.h:28
> > arch/arm64/kernel/entry-common.c:482)
> > [  527.571761] el1h_64_sync_handler (arch/arm64/kernel/entry-common.c:637)
> > [  527.571769] el1h_64_sync (arch/arm64/kernel/entry.S:591)
> > [  527.571775] kmem_cache_alloc_bulk_noprof (mm/slub.c:5343
> > (discriminator 1) mm/slub.c:5403 (discriminator 1)) (P)
> > [  527.571782] mas_alloc_nodes (lib/maple_tree.c:1278)
> > [  527.571792] mas_node_count_gfp (lib/maple_tree.c:1339)
> > [  527.571802] mas_preallocate (lib/maple_tree.c:5538 (discriminator 1))
> > [  527.571808] __split_vma (mm/vma.c:528 (discriminator 1))
> > [  527.571816] vma_modify (mm/vma.c:1633)
> > [  527.571824] vma_modify_flags (mm/vma.c:1650)
> > [  527.571833] mprotect_fixup (mm/mprotect.c:819)
> > [  527.571842] do_mprotect_pkey (mm/mprotect.c:993)
> > [  527.571850] __arm64_sys_mprotect (mm/mprotect.c:1011)
> > [  527.571859] invoke_syscall (arch/arm64/include/asm/current.h:19
> > arch/arm64/kernel/syscall.c:54)
> > [  527.571866] el0_svc_common.constprop.0
> > (include/linux/thread_info.h:135 (discriminator 2)
> > arch/arm64/kernel/syscall.c:140 (discriminator 2))
> > [  527.571872] do_el0_svc (arch/arm64/kernel/syscall.c:152)
> > [  527.571878] el0_svc (arch/arm64/include/asm/irqflags.h:82
> > (discriminator 1) arch/arm64/include/asm/irqflags.h:123 (discriminator
> > 1) arch/arm64/include/asm/irqflags.h:136 (discriminator 1)
> > arch/arm64/kernel/entry-common.c:169 (discriminator 1)
> > arch/arm64/kernel/entry-common.c:182 (discriminator 1)
> > arch/arm64/kernel/entry-common.c:880 (discriminator 1))
> > [  527.571885] el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:899)
> > [  527.571893] el0t_64_sync (arch/arm64/kernel/entry.S:596)
> > [  527.571900] ---[ end trace 0000000000000000 ]---
> > [  540.645451] sched: DL replenish lagged too much
> >
> > ## Source
> > * Git tree: https://kernel.googlesource.com/pub/scm/linux/kernel/git/next/linux-next.git
> > * Git sha: 54efec8782214652b331c50646013f8526570e8d
> > * Git describe: next-20250729
> > * Project details:
> > https://qa-reports.linaro.org/lkft/linux-next-master/build/next-20250729
> > * Architectures: arm64
> > * Toolchains: gcc-13
> > * Kconfigs: Preempt_rt
> >
> > ## Test
> > * Test log 1: https://qa-reports.linaro.org/api/testruns/29282584/log_file/
> > * Test log 2:https://qa-reports.linaro.org/api/testruns/29337984/log_file/
> > * Test lava log: https://lkft.validation.linaro.org/scheduler/job/8373114#L19186
> > * Test details:
> > https://regressions.linaro.org/lkft/linux-next-master/next-20250729/log-parser-test/exception-rtmutex-deadlock-detected/
> > * Test plan: https://tuxapi.tuxsuite.com/v1/groups/linaro/projects/lkft/tests/30XMjtCEi0VzsU1gYZ0a7kcTkLJ
> > * Build link: https://storage.tuxsuite.com/public/linaro/lkft/builds/30fq2ElntxgscJ13dnaD7iL5Z1G/
> > * Kernel config:
> > https://storage.tuxsuite.com/public/linaro/lkft/builds/30fq2ElntxgscJ13dnaD7iL5Z1G/config

- Naresh

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ