Re: [lkp] 8700e3e7c4: BUG: unable to handle kernel NULL pointer dereference at 000001fc

From: Yonatan Cohen
Date: Wed Aug 17 2016 - 11:04:55 EST



-----Original Message-----
From: lkp-request@xxxxxxxxxxxxxxxxx [mailto:lkp-request@xxxxxxxxxxxxxxxxx] On Behalf Of kernel test robot
Sent: Monday, August 15, 2016 7:40 AM
To: Moni Shoua <monis@xxxxxxxxxxxx>
Cc: Doug Ledford <dledford@xxxxxxxxxx>; Kamal Heib <kamalh@xxxxxxxxxxxx>; Amir Vadai (revoke on 17.10.15) <amirv@xxxxxxxxxxxx>; Haggai Eran <haggaie@xxxxxxxxxxxx>; LKML <linux-kernel@xxxxxxxxxxxxxxx>; Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>; lkp@xxxxxx
Subject: [lkp] 8700e3e7c4: BUG: unable to handle kernel NULL pointer dereference at 000001fc


FYI, we noticed the following commit:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master commit 8700e3e7c4857d28ebaa824509934556da0b3e76 ("Soft RoCE driver")

in testcase: boot

on test machine: 1 threads qemu-system-i386 -enable-kvm with 256M memory

caused below changes:


+-----------------------------------------------------+----------+------------+
| | v4.7-rc4 |
| 8700e3e7c4 |
+-----------------------------------------------------+----------+------------+
| boot_successes | 15 | 0 |
| boot_failures | 10 | 18 |
| invoked_oom-killer:gfp_mask=0x | 1 | |
| Mem-Info | 1 | |
| INFO:task_blocked_for_more_than#seconds | 2 | |
| EIP_is_at__default_send_IPI_dest_field | 2 | |
| Kernel_panic-not_syncing:hung_task:blocked_tasks | 2 | |
| backtrace:torture_shuffle | 2 | |
| WARNING:at_arch/x86/mm/dump_pagetables.c:#note_page | 7 | |
| backtrace:mark_rodata_ro | 7 | |
| BUG:unable_to_handle_kernel | 0 | 18 |
| Oops | 0 | 18 |
| EIP_is_at_setup_udp_tunnel_sock | 0 | 18 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 18 |
| backtrace:rxe_net_init | 0 | 18 |
| backtrace:rxe_module_init | 0 | 18 |
| backtrace:kernel_init_freeable | 0 | 18 |
+-----------------------------------------------------+----------+------------+



[ 46.816381] usnic_verbs:usnic_uiom_init:581: IOMMU required but not present or enabled. USNIC QPs will not function w/o enabling IOMMU
[ 46.835874] usnic_verbs:usnic_ib_init:647: Unable to initalize umem with err -1
[ 46.864766] iscsi: registered transport (iser)
[ 46.884623] BUG: unable to handle kernel NULL pointer dereference at 000001fc
[ 46.888632] IP: [<c220705a>] setup_udp_tunnel_sock+0x6/0x4f
[ 46.891355] *pdpt = 0000000000000000 *pde = f000ff53f000ff53
[ 46.893918] Oops: 0002 [#1] PREEMPT
[ 46.896014] CPU: 0 PID: 1 Comm: swapper Not tainted 4.7.0-rc4-00001-g8700e3e #1
[ 46.900280] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
[ 46.904905] task: cf06c040 ti: cf05e000 task.ti: cf05e000
[ 46.907854] EIP: 0060:[<c220705a>] EFLAGS: 00210246 CPU: 0
[ 46.911137] EIP is at setup_udp_tunnel_sock+0x6/0x4f
[ 46.914070] EAX: 00000044 EBX: 00000001 ECX: cf05fef0 EDX: ca8142e0
[ 46.917236] ESI: c2c4505b EDI: cf05fef0 EBP: cf05fed0 ESP: cf05fed0
[ 46.919836] DS: 007b ES: 007b FS: 0000 GS: 00e0 SS: 0068
[ 46.922046] CR0: 80050033 CR2: 000001fc CR3: 02cec000 CR4: 000006b0
[ 46.924550] Stack:
[ 46.926014] cf05ff10 c1fd4657 ca8142e0 0000000a 00000000 00000000 0000b712 00000008
[ 46.931274] 00000000 6bb5bd01 c1fd48de 00000000 00000000 cf05ff1c 00000000 00000000
[ 46.936122] cf05ff1c c1fd4bdf 00000000 cf05ff28 c2c4507b ffffffff cf05ff88 c2bf1c74
[ 46.942350] Call Trace:
[ 46.944403] [<c1fd4657>] rxe_setup_udp_tunnel+0x8f/0x99
[ 46.947689] [<c1fd48de>] ? net_to_rxe+0x4e/0x4e
[ 46.950567] [<c1fd4bdf>] rxe_net_init+0xe/0xa4
[ 46.953147] [<c2c4507b>] rxe_module_init+0x20/0x4c
[ 46.955448] [<c2bf1c74>] do_one_initcall+0x89/0x113
[ 46.957797] [<c2bf15eb>] ? set_debug_rodata+0xf/0xf
[ 46.959966] [<c2bf1dbc>] ? kernel_init_freeable+0xbe/0x15b
[ 46.962262] [<c2bf1ddc>] kernel_init_freeable+0xde/0x15b
[ 46.964418] [<c232eb54>] kernel_init+0x8/0xd0
[ 46.966618] [<c2333122>] ret_from_kernel_thread+0xe/0x24
[ 46.969592] [<c232eb4c>] ? rest_init+0x6f/0x6f
[ 46.973288] Code: 80 04 f7 ff c7 06 00 00 00 00 89 d8 8b 75 f0 65 33 35 14 00 00 00 74 05 e8 3a 1f e6 fe 8d 65 f4 5b 5e 5f 5d c3 55 8b 42 14 89 e5 <80> a0 b8 01 00 00 ef fe 80 bb 01 00 00 8b 11 89 90 60 01 00 00
[ 46.991320] EIP: [<c220705a>] setup_udp_tunnel_sock+0x6/0x4f SS:ESP 0068:cf05fed0
[ 46.995035] CR2: 00000000000001fc
[ 46.996817] ---[ end trace 1be5f94d2ecf9b78 ]---
[ 47.001073] Kernel panic - not syncing: Fatal exception


FYI, raw QEMU command line is:

qemu-system-i386 -enable-kvm -kernel /pkg/linux/i386-randconfig-c0-08121125/gcc-4.9/8700e3e7c4857d28ebaa824509934556da0b3e76/vmlinuz-4.7.0-rc4-00001-g8700e3e -append 'ip=::::vm-intel12-openwrt-i386-1::dhcp root=/dev/ram0 user=lkp job=/lkp/scheduled/vm-intel12-openwrt-i386-1/boot-1-openwrt-i386.cgz-8700e3e7c4857d28ebaa824509934556da0b3e76-20160812-54756-6to0wa-0.yaml ARCH=i386 kconfig=i386-randconfig-c0-08121125 branch=linus/master commit=8700e3e7c4857d28ebaa824509934556da0b3e76 BOOT_IMAGE=/pkg/linux/i386-randconfig-c0-08121125/gcc-4.9/8700e3e7c4857d28ebaa824509934556da0b3e76/vmlinuz-4.7.0-rc4-00001-g8700e3e max_uptime=600 RESULT_ROOT=/result/boot/1/vm-intel12-openwrt-i386/openwrt-i386.cgz/i386-randconfig-c0-08121125/gcc-4.9/8700e3e7c4857d28ebaa824509934556da0b3e76/0 LKP_SERVER=inn debug apic=debug sysrq_always_enabled rcupdate.rcu_cpu_stall_timeout=100 panic=-1 softlockup_panic=1 nmi_watchdog=panic oops=panic load_ramdisk=2 prompt_ramdisk=0 systemd.log_level=err ignore_loglevel earlyprintk=ttyS0,115200 console=ttyS0,115200 console=tty0 vga=normal rw drbd.minor_count=8' -initrd /fs/KVM/initrd-vm-intel12-openwrt-i386-1 -m 256 -smp 1 -device e1000,netdev=net0 -netdev user,id=net0 -boot order=nc -no-reboot -watchdog i6300esb -watchdog-action debug -rtc base=localtime -drive file=/fs/KVM/disk0-vm-intel12-openwrt-i386-1,media=disk,if=virtio -drive file=/fs/KVM/disk1-vm-intel12-openwrt-i386-1,media=disk,if=virtio -pidfile /dev/shm/kboot/pid-vm-intel12-openwrt-i386-1 -serial file:/dev/shm/kboot/serial-vm-intel12-openwrt-i386-1 -daemonize -display none -monitor null





Thanks,
Xiaolong

can you please provide more info to help reproduced this crash ?
on which operating system did this happen ?
which HCA device was the rxe device attached to ? mlx4 or mlx5 ?
thanks
Yonatan