Re: slub freelist issue / BUG: unable to handle page fault for address: 000000003ffe0018

[Vegard Nossum]

On 2020-06-05 11:36, Vegard Nossum wrote:
> On 2020-06-05 11:11, Vlastimil Babka wrote:
> > On 6/4/20 8:46 PM, Vlastimil Babka wrote:
> > > On 6/4/20 7:57 PM, Kees Cook wrote:
> > > > On Thu, Jun 04, 2020 at 07:20:18PM +0200, Vegard Nossum wrote:
> > > > > On 2020-06-04 19:18, Vlastimil Babka wrote:
> > > > > > On 6/4/20 7:14 PM, Vegard Nossum wrote:
> > > > > > > Hi all,
> > > > > > >
> > > > > > > I ran into a boot problem with latest linus/master
> > > > > > > (6929f71e46bdddbf1c4d67c2728648176c67c555) that manifests like this:
> > > > > >
> > > > > > Hi, what's the .config you use?
> > > > >
> > > > > Pretty much x86_64 defconfig minus a few options (PCI, USB, ...)
> > > >
> > > > Oh yes indeed. I immediately crash in the same way with this config. 
> > > > I'll
> > > > start digging...
> > > >
> > > > (defconfig finishes boot)
> > >
> > > This is funny, booting with slub_debug=F results in:
> > > I'm not sure if it's ACPI or ftrace wrong here, but looks like the 
> > > changed
> > > free pointer offset merely exposes a bug in something else.
> >
> > So, with Kees' patch reverted, booting with slub_debug=F (or even more
> > specific slub_debug=F,ftrace_event_field) also hits this bug below. I
> > wanted to bisect it, but v5.7 was also bad, and also v5.6. Didn't try
> > further in history. So it's not new at all, and likely very specific to
> > your config+QEMU? (and related to the ACPI error messages that precede 
> > it?).
>
> I see it too, but not on v5.0. I can bisect it.

commit 67a72420a326b45514deb3f212085fb2cd1595b5
Author: Bob Moore <robert.moore@xxxxxxxxx>
Date:   Fri Aug 16 14:43:21 2019 -0700

    ACPICA: Increase total number of possible Owner IDs

    ACPICA commit 1f1652dad88b9d767767bc1f7eb4f7d99e6b5324

    From 255 to 4095 possible IDs.

    Link: https://github.com/acpica/acpica/commit/1f1652da
    Reported-by: Hedi Berriche <hedi.berriche @hpe.com>
    Signed-off-by: Bob Moore <robert.moore@xxxxxxxxx>
    Signed-off-by: Erik Schmauss <erik.schmauss@xxxxxxxxx>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@xxxxxxxxx>


Vegard

> > > This would mean acpi_os_release_object() calling 
> > > kmem_cache_free(ftrace_event_field, x)
> > > where x is actually from kmalloc-64? Both parts of that sounds wrong.
> > >
> > > Thread starts here: 
> > > https://lore.kernel.org/linux-mm/4dc93ff8-f86e-f4c9-ebeb-6d3153a78d03@xxxxxxxxxx/ 
> > >
> > >
> > > [ÂÂÂ 0.144386] ACPI: Added _OSI(Module Device)
> > > [ÂÂÂ 0.144496] ACPI: Added _OSI(Processor Device)
> > > [ÂÂÂ 0.144956] ACPI: Added _OSI(3.0 _SCP Extensions)
> > > [ÂÂÂ 0.145432] ACPI: Added _OSI(Processor Aggregator Device)
> > > [ÂÂÂ 0.145501] ACPI: Added _OSI(Linux-Dell-Video)
> > > [ÂÂÂ 0.145951] ACPI: Added _OSI(Linux-Lenovo-NV-HDMI-Audio)
> > > [ÂÂÂ 0.146522] ACPI: Added _OSI(Linux-HPI-Hybrid-Graphics)
> > > [ÂÂÂ 0.147070] ACPI Error: AE_BAD_PARAMETER, During Region 
> > > initialization (20200430/tbxfload-52)
> > > [ÂÂÂ 0.147494] ACPI: Unable to load the System Description Tables
> > > [ÂÂÂ 0.148104] ACPI Error: Could not remove SCI handler 
> > > (20200430/evmisc-251)
> > > [ÂÂÂ 0.148507] ------------[ cut here ]------------
> > > [ÂÂÂ 0.148985] cache_from_obj: Wrong slab cache. ftrace_event_field 
> > > but object is from kmalloc-64
> > > [ÂÂÂ 0.149502] WARNING: CPU: 0 PID: 1 at mm/slab.h:523 
> > > kmem_cache_free+0x248/0x260
> > > [ÂÂÂ 0.150254] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.7.0+ #43
> > > [ÂÂÂ 0.150490] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), 
> > > BIOS rel-1.13.0-0-gf21b5a4-rebuilt.opensuse.org 04/01/2014
> > > [ÂÂÂ 0.150490] RIP: 0010:kmem_cache_free+0x248/0x260
> > > [ÂÂÂ 0.150490] Code: ff 0f 0b e9 9d fe ff ff 49 8b 4d 58 48 8b 55 58 
> > > 48 c7 c6 10 47 c1 a4 48 c7 c7 f0 c1 d0 a4 c6 05 9f 05 b1 00 01 e8 bc 
> > > cc eb ff <0f> 0b 48 8b 15 5f 36 9b 00 4c 89 ed e9 d6 fd ff ff 0f 1f 
> > > 80 00 00
> > > [ÂÂÂ 0.150490] RSP: 0018:ffffb4dac0013dc0 EFLAGS: 00010282
> > > [ÂÂÂ 0.150490] RAX: 0000000000000000 RBX: ffffa38a07409e00 RCX: 
> > > 0000000000000000
> > > [ÂÂÂ 0.150490] RDX: 0000000000000001 RSI: 0000000000000092 RDI: 
> > > ffffffffa51dd32c
> > > [ÂÂÂ 0.150490] RBP: ffffa38a07403900 R08: ffffb4dac0013c7d R09: 
> > > 00000000000000eb
> > > [ÂÂÂ 0.150490] R10: ffffb4dac0013c78 R11: ffffb4dac0013c7d R12: 
> > > ffffa38a87409e00
> > > [ÂÂÂ 0.150490] R13: ffffa38a07401d00 R14: 0000000000000000 R15: 
> > > 0000000000000000
> > > [ÂÂÂ 0.150490] FS:Â 0000000000000000(0000) GS:ffffa38a07a00000(0000) 
> > > knlGS:0000000000000000
> > > [ÂÂÂ 0.150490] CS:Â 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > [ÂÂÂ 0.150490] CR2: 0000000000000000 CR3: 000000000560a000 CR4: 
> > > 00000000003406f0
> > > [ÂÂÂ 0.150490] Call Trace:
> > > [ÂÂÂ 0.150490]Â acpi_os_release_object+0x5/0x10
> > > [ÂÂÂ 0.150490]Â acpi_ns_delete_children+0x46/0x59
> > > [ÂÂÂ 0.150490]Â acpi_ns_delete_namespace_subtree+0x5c/0x79
> > > [ÂÂÂ 0.150490]Â ? acpi_sleep_proc_init+0x1f/0x1f
> > > [ÂÂÂ 0.150490]Â acpi_ns_terminate+0xc/0x31
> > > [ÂÂÂ 0.150490]Â acpi_ut_subsystem_shutdown+0x45/0xa3
> > > [ÂÂÂ 0.150490]Â ? acpi_sleep_proc_init+0x1f/0x1f
> > > [ÂÂÂ 0.150490]Â acpi_terminate+0x5/0xf
> > > [ÂÂÂ 0.150490]Â acpi_init+0x27b/0x308
> > > [ÂÂÂ 0.150490]Â ? video_setup+0x79/0x79
> > > [ÂÂÂ 0.150490]Â do_one_initcall+0x7b/0x160
> > > [ÂÂÂ 0.150490]Â kernel_init_freeable+0x190/0x1f2
> > > [ÂÂÂ 0.150490]Â ? rest_init+0x9a/0x9a
> > > [ÂÂÂ 0.150490]Â kernel_init+0x5/0xf6
> > > [ÂÂÂ 0.150490]Â ret_from_fork+0x22/0x30
> > > [ÂÂÂ 0.150490] ---[ end trace 967e9fbc065d7911 ]---