Dear Linux Kernel Developers, I have reason to believe that the commit 4012603cbd469223f225637d265a233f034c567a, which was backported to the linux-5.10 branch, is introducing a bug that leads to a kernel crash.
Environment Details:
Kernel Version: linux-5.10.234 Architecture: aarch64 Kernel Configuration: Available at https://syzkaller.appspot.com/bug?extid=75dc11b3aa0369757b7c QEMU Version: 8.2.2
QEMU Launch Command:
qemu-system-aarch64 \ -m 4G \ -smp 4,sockets=1,cores=4,threads=1 \ -cpu cortex-a57 \ -machine virt,accel=tcg \ -kernel /home/user/lvc/linux-stable/arch/arm64/boot/Image \ -append "console=ttyS0 root=/dev/vda2 earlyprintk=serial net.ifnames=0 rw debug loglevel=8" \ -drive file=/home/user/lvc/image/disk.raw,format=raw,if=virtio,index=1 \ -bios /usr/share/AAVMF/AAVMF_CODE.fd \ -netdev user,id=net0,hostfwd=tcp::10022-:22 \ -device virtio-net-device,netdev=net0 \ -nographic
Steps to Reproduce:
mount -t sysfs sysfs /sys mount -t proc proc /proc mount -t efivarfs efivarfs /sys/firmware/efi/efivars tools/testing/selftests/efivarfs/efivarfs.sh
Crash log:
[ 101.403235][ T38] Unable to handle kernel paging request at virtual address ffffa00023b20000 [ 101.403905][ T38] Mem abort info: [ 101.404159][ T38] ESR = 0x96000047 [ 101.404448][ T38] EC = 0x25: DABT (current EL), IL = 32 bits [ 101.404748][ T38] SET = 0, FnV = 0 [ 101.404988][ T38] EA = 0, S1PTW = 0 [ 101.405233][ T38] Data abort info: [ 101.405469][ T38] ISV = 0, ISS = 0x00000047 [ 101.405721][ T38] CM = 0, WnR = 1 [ 101.406070][ T38] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000103336000 [ 101.406415][ T38] [ffffa00023b20000] pgd=000000013ffff003, p4d=000000013ffff003, pud=000000013fffe003, pmd=000000013fff9003, pte=0000000000000000 [ 101.407997][ T38] Internal error: Oops: 0000000096000047 [#1] PREEMPT SMP [ 101.408446][ T38] Modules linked in: [ 101.409010][ T38] CPU: 1 PID: 38 Comm: kworker/u8:2 Not tainted 5.10.234 #61 [ 101.409376][ T38] Hardware name: QEMU QEMU Virtual Machine, BIOS 2024.02-2ubuntu0.1 10/25/2024 [ 101.410689][ T38] Workqueue: efi_rts_wq efi_call_rts [ 101.411219][ T38] pstate: 000003c5 (nzcv DAIF -PAN -UAO -TCO BTYPE=--) [ 101.411574][ T38] pc : el1_sync+0xc/0x140 [ 101.411930][ T38] lr : 0x0 [ 101.412132][ T38] sp : ffffa00023b1ffd0 [ 101.412363][ T38] x29: 0000000000000000 x28: ffff0000cc741a80 [ 101.412761][ T38] x27: 0000000000000001 x26: 0000000000e800e8 [ 101.413117][ T38] x25: 0000000000800080 x24: ffff940004765298 [ 101.413465][ T38] x23: 00000000100003c5 x22: ffffa00018c95600 [ 101.413809][ T38] x21: ffffa0001923a980 x20: ffffa00018d30380 [ 101.414170][ T38] x19: ffffa0001bab8008 x18: 1fffe000198e8491 [ 101.414515][ T38] x17: 0000000000000000 x16: ffffa000102a26c0 [ 101.414882][ T38] x15: 0000000000000001 x14: ffff0000ccf34400 [ 101.415277][ T38] x13: 000000000000003c x12: ffff0000ccf34000 [ 101.415656][ T38] x11: 0000000000000018 x10: 0000000000000054 [ 101.416072][ T38] x9 : 4fc79849210be57c x8 : 11d293ca8be4df61 [ 101.416446][ T38] x7 : 0000000041b58ab3 x6 : ffff94000476522a [ 101.416820][ T38] x5 : 0000002200000000 x4 : 0000000200000000 [ 101.417190][ T38] x3 : 1fffe000198e8352 x2 : ffffa0001923a820 [ 101.417560][ T38] x1 : ffff0000cc741a80 x0 : 0000000000000000 [ 101.418109][ T38] Call trace: [ 101.418601][ T38] Code: d503201f a90007e0 a9010fe2 a90217e4 (a9031fe6) [ 101.419579][ T38] ---[ end trace 61316cddfdbbcb95 ]--- [ 103.623221][ T38] Kernel panic - not syncing: Oops: Fatal exception [ 103.623723][ T38] SMP: stopping secondary CPUs [ 105.221708][ T38] SMP: failed to stop secondary CPUs 0-3 [ 105.222306][ T38] Kernel Offset: disabled [ 105.222711][ T38] CPU features: 0x28240022,61002082 [ 105.222969][ T38] Memory Limit: none
I identified this commit as the potential cause of the crash using git bisect. The issue is reproducible with the above setup and configuration. If you need more details or logs, I am more than willing to provide them. Thank you for your attention to this matter.
Best regards,
Alexey Nepomnyashih