Re: [PATCH 4.4 00/37] 4.4.110-stable review

[Linus Torvalds]

On Thu, Jan 4, 2018 at 8:38 AM, Pavel Tatashin <soleen@xxxxxxxxx> wrote:
> I am getting the following panic when trying to boot 4.4.110rc1 on
> Intel(R) Xeon(R) CPU E5-2630:
>
> [    5.923489] BUG: unable to handle kernel NULL pointer dereference at 000000000000000d
> [    5.932259] IP: [<ffffffff810e70d2>] dyntick_save_progress_counter+0x12/0x50

Hmm. You don't have the "Code:" line in this oops anywhere, do you?

> [    5.977905] RIP: dyntick_save_progress_counter+0x12/0x50
> [    5.988505] RSP: 0000:ffff881ff2f27dc0  EFLAGS: 00010046
> [    5.994434] RAX: 0000000000000001 RBX: ffffffff81b02140 RCX: ffff883fec768000
> [    6.002403] RDX: 0000000000000000 RSI: ffff881ff2f27e5f RDI: ffff88407e958140
> [    6.010368] RBP: ffff881ff2f27dc0 R08: ffff881ff2f27e78 R09: 000000016110f359
> [    6.018333] R10: 0000000000000b10 R11: 0000000000000000 R12: ffffffff81b02140
> [    6.026297] R13: 00000000ffffffdf R14: 0000000000000021 R15: 0000000200000000
> [    6.034262] FS:  0000000000000000(0000) GS:ffff881fff940000(0000) knlGS:0000000000000000
> [    6.043293] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [    6.049707] CR2: 000000000000000d CR3: 0000000001aa6000 CR4: 0000000000360670
> [    6.057672] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [    6.065638] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [    6.073603] Stack:
> [    6.075847]  ffff881ff2f27e18 ffffffff810e8fac 0000000000000202 ffff881ff2f27e60
> [    6.084158]  ffff881ff2f27e5f ffffffff810e70c0 ffffffff81b02140 ffffffff81b127a0
> [    6.092465]  0000000000000001 0000000000000000 0000000000000003 ffff881ff2f27eb8
> [    6.100768] Call Trace:
> [    6.103501]  [<ffffffff810e8fac>] force_qs_rnp+0xdc/0x150

The oops looks like it *might* be this:

        lock xadd %edx,0xc(%rax)

which is from the

        int snap = atomic_add_return(0, &rdtp->dynticks);

in rcu_dynticks_snap() because %rax is 1 and that would give you the
invalid page fault and the right faulting address.

But that would be complete rcu data structure corruption (that rdtp
pointer comes from

        per_cpu_ptr(rsp->rda, cpu)

in force_qs_rnp(), afaik.

The PTI patches obviously change percpu stuff, but this looks like an
odd place for that to manifest.

                 Linus