Re: [linus:master] [tracing] b5cc230af5: WARNING:at_kernel/trace/trace_events.c:#test_double_dereference

[Masami Hiramatsu (Google)]

On Fri, 6 Nov 2026 11:07:56 +0800, kernel test robot <yi1.lai@xxxxxxxxx> wrote:
> 
> 
> Hello,
> 
> kernel test robot noticed "WARNING:at_kernel/trace/trace_events.c:#test_double_dereference" on:
> 
> commit: b5cc230af5e536ff752f8bd5c30e23612936d5c3 ("tracing: Warn when an event dereferences a pointer in TP_printk()") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
> 
> [test failed on linux-next/master ddfe51b0a0f5dc9e415cc2c8ad8db17532dd426b]
> 
> in testcase: boot
> 
> config: x86_64-randconfig-r2309-20261012
> compiler: gcc-14
> test machine: qemu-system-x86_64 -enable-kvm -cpu Cascadelake-Server-noTSX,enforce -smp 4 -m 16G
> 
> (please refer to attached dmesg/kmsg for entire log/backtrace)
> 
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <yi1.lai@xxxxxxxxx>
> | Closes: https://lore.kernel.org/oe-lkp/202611060303.c90f27a7-lkp@xxxxxxxxx
> 
> 
> [    0.808840][    T0] ------------[ cut here ]------------
> [    0.810236][    T0] Event hfi1_txq_complete has double dereference in TP_printk: REC->sde ? REC->sde->this_idx : 0

This seems to be expected behavior. Because "REC->sde" can point already
freed/reused object, this should not be allowed. The event must save the
sde->this_idx at TP_fast_assign() instead of recording sde.

In drivers/infiniband/hw/hfi1/trace_tx.h:

DECLARE_EVENT_CLASS(/* AIP  */
        hfi1_ipoib_txq_template,
	...
        TP_printk(/* print  */
                "[%s] txq %llx idx %u sde %llx:%u cpu %d head %lx tail %lx flow %x used %u stops %d no_desc %d stopped %u",
                __get_str(dev),
                (unsigned long long)__entry->txq,
                __entry->idx,
                (unsigned long long)__entry->sde,
                __entry->sde ? __entry->sde->this_idx : 0, // this must be recorded as a value
                __entry->sde ? __entry->sde->cpu : 0,	// ditto


So this is a bug in an infiniband driver.

Thank you,

-- 
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>