Subject: [linux-next:master] [net] 934c29999b: Kernel_BUG_at

From: kernel test robot <[email-masked]>
Date: Fri, 21 Jun 2024 16:45:45 +0800

Hello,

we reported similar issue for this patch in
https://lore.kernel.org/all/[email-masked]/
and we saw a lot of dicussion there.

now the patch is merged into linux-next/master, we are not sure if there
is a fix or debug patch is on-going, which will be our pleasure to test.

anyway, just report again FYI that we still observe issues in our tests for
linux-nexts/master

kernel test robot noticed "Kernel_BUG_at" on:

commit: 934c29999b57b835d65442da6f741d5e27f3b584 ("net: micro-optimize skb_datagram_iter")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master

[test failed on linux-next/master 2102cb0d050d34d50b9642a3a50861787527e922]

in testcase: boot

compiler: gcc-13
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

(please refer to attached dmesg/kmsg for entire log/backtrace)

+------------------------------------------------+------------+------------+
|                                                | abef84957b | 934c29999b |
+------------------------------------------------+------------+------------+
| Kernel_BUG_at                                  | 0          | 6          |
| Oops:invalid_opcode:#[##]                      | 0          | 6          |
| EIP:usercopy_abort                             | 0          | 6          |
| Kernel_panic-not_syncing:Fatal_exception       | 0          | 6          |
+------------------------------------------------+------------+------------+

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email-masked]>
| Closes: https://lore.kernel.org/oe-lkp/[email-masked]

[    8.659454][  T161] ------------[ cut here ]------------
[ 8.659874][ T161] Kernel BUG at usercopy_abort+0x58/0x67 [verbose debug info unavailable] 
[    8.660744][  T161] Oops: invalid opcode: 0000 [#1]
[    8.661134][  T161] CPU: 0 PID: 161 Comm: systemctl Not tainted 6.10.0-rc3-00688-g934c29999b57 #1 63c7b7fbd2f7622d539d732370d21837ac16d760
[ 8.662098][ T161] EIP: usercopy_abort (mm/usercopy.c:102) 
[ 8.662483][ T161] Code: 25 40 43 b9 c8 38 41 43 eb 0a bf 9d 73 50 43 b9 e4 ce 3f 43 ff 75 0c ff 75 08 56 52 53 50 57 51 68 d1 38 41 43 e8 50 cc ee ff <0f> 0b b8 4c 09 c7 43 83 c4 24 e8 c2 69 42 00 55 89 e5 57 56 89 d7
All code
========
   0:	25 40 43 b9 c8       	and    $0xc8b94340,%eax
   5:	38 41 43             	cmp    %al,0x43(%rcx)
   8:	eb 0a                	jmp    0x14
   a:	bf 9d 73 50 43       	mov    $0x4350739d,%edi
   f:	b9 e4 ce 3f 43       	mov    $0x433fcee4,%ecx
  14:	ff 75 0c             	push   0xc(%rbp)
  17:	ff 75 08             	push   0x8(%rbp)
  1a:	56                   	push   %rsi
  1b:	52                   	push   %rdx
  1c:	53                   	push   %rbx
  1d:	50                   	push   %rax
  1e:	57                   	push   %rdi
  1f:	51                   	push   %rcx
  20:	68 d1 38 41 43       	push   $0x434138d1
  25:	e8 50 cc ee ff       	call   0xffffffffffeecc7a
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	b8 4c 09 c7 43       	mov    $0x43c7094c,%eax
  31:	83 c4 24             	add    $0x24,%esp
  34:	e8 c2 69 42 00       	call   0x4269fb
  39:	55                   	push   %rbp
  3a:	89 e5                	mov    %esp,%ebp
  3c:	57                   	push   %rdi
  3d:	56                   	push   %rsi
  3e:	89 d7                	mov    %edx,%edi

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	b8 4c 09 c7 43       	mov    $0x43c7094c,%eax
   7:	83 c4 24             	add    $0x24,%esp
   a:	e8 c2 69 42 00       	call   0x4269d1
   f:	55                   	push   %rbp
  10:	89 e5                	mov    %esp,%ebp
  12:	57                   	push   %rdi
  13:	56                   	push   %rsi
  14:	89 d7                	mov    %edx,%edi
[    8.664049][  T161] EAX: 00000052 EBX: 435c7250 ECX: 00000000 EDX: 43c4b518
[    8.664589][  T161] ESI: 435c7250 EDI: 43402547 EBP: bf159c68 ESP: bf159c38
[    8.665127][  T161] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010286
[    8.665708][  T161] CR0: 80050033 CR2: 005c8afc CR3: 7f060000 CR4: 000406d0
[    8.666244][  T161] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[    8.666774][  T161] DR6: fffe0ff0 DR7: 00000400
[    8.667136][  T161] Call Trace:
[ 8.667395][ T161] ? show_regs (arch/x86/kernel/dumpstack.c:478 (discriminator 1)) 
[ 8.667732][ T161] ? __die_body (arch/x86/kernel/dumpstack.c:421) 
[ 8.668060][ T161] ? __die (arch/x86/kernel/dumpstack.c:435) 
[ 8.668358][ T161] ? die (arch/x86/kernel/dumpstack.c:449) 
[ 8.668646][ T161] ? do_trap (arch/x86/kernel/traps.c:114 arch/x86/kernel/traps.c:155) 
[ 8.668968][ T161] ? do_error_trap (arch/x86/kernel/traps.c:176) 
[ 8.669323][ T161] ? usercopy_abort (mm/usercopy.c:102) 
[ 8.669690][ T161] ? exc_overflow (arch/x86/kernel/traps.c:252) 
[ 8.670057][ T161] ? handle_invalid_op (arch/x86/kernel/traps.c:214) 
[ 8.670434][ T161] ? usercopy_abort (mm/usercopy.c:102) 
[ 8.670803][ T161] ? exc_invalid_op (arch/x86/kernel/traps.c:267) 
[ 8.671174][ T161] ? handle_exception (arch/x86/entry/entry_32.S:1054) 
[ 8.671567][ T161] ? __ia32_sys_membarrier (kernel/sched/membarrier.c:497 kernel/sched/membarrier.c:659 kernel/sched/membarrier.c:625 kernel/sched/membarrier.c:625) 
[ 8.671980][ T161] ? exc_overflow (arch/x86/kernel/traps.c:252) 
[ 8.672322][ T161] ? usercopy_abort (mm/usercopy.c:102) 
[ 8.672684][ T161] ? exc_overflow (arch/x86/kernel/traps.c:252) 
[ 8.673039][ T161] ? usercopy_abort (mm/usercopy.c:102) 
[ 8.673406][ T161] check_heap_object (mm/usercopy.c:182) 
[ 8.673780][ T161] __check_object_size (mm/usercopy.c:123 mm/usercopy.c:254) 
[ 8.674169][ T161] simple_copy_to_iter (include/linux/uio.h:196 net/core/datagram.c:513) 
[ 8.674554][ T161] __skb_datagram_iter (net/core/datagram.c:424 (discriminator 1)) 
[ 8.674955][ T161] skb_copy_datagram_iter (net/core/datagram.c:529) 
[ 8.675359][ T161] ? skb_free_datagram (include/linux/thread_info.h:249 (discriminator 1) include/linux/uio.h:195 (discriminator 1) net/core/datagram.c:513 (discriminator 1)) 
[ 8.675724][ T161] ? unix_copy_addr (net/unix/af_unix.c:2866) 
[ 8.676083][ T161] unix_stream_read_actor (net/unix/af_unix.c:2871) 
[ 8.676481][ T161] unix_stream_read_generic (net/unix/af_unix.c:2803) 
[ 8.676914][ T161] unix_stream_recvmsg (net/unix/af_unix.c:2907) 
[ 8.677301][ T161] ? unix_copy_addr (net/unix/af_unix.c:2866) 
[ 8.677669][ T161] ? unix_stream_splice_read (net/unix/af_unix.c:2890) 
[ 8.678097][ T161] sock_recvmsg_nosec (net/socket.c:1046 (discriminator 1)) 
[ 8.678472][ T161] ____sys_recvmsg (net/socket.c:1068 (discriminator 2) net/socket.c:2804 (discriminator 2)) 
[ 8.678835][ T161] ___sys_recvmsg (net/socket.c:2846) 
[ 8.679188][ T161] __sys_recvmsg (net/socket.c:2878) 
[ 8.679534][ T161] __do_sys_socketcall (net/socket.c:3173) 
[ 8.679926][ T161] __ia32_sys_socketcall (net/socket.c:3077) 
[ 8.680304][ T161] ia32_sys_call (kbuild/obj/consumer/i386-randconfig-012-20230823-CONFIG_NVME_CORE/./arch/x86/include/generated/asm/syscalls_32.h:103) 
[ 8.680671][ T161] do_int80_syscall_32 (arch/x86/entry/common.c:165 (discriminator 1) arch/x86/entry/common.c:339 (discriminator 1)) 
[ 8.681053][ T161] entry_INT80_32 (arch/x86/entry/entry_32.S:944) 
[    8.681401][  T161] EIP: 0x37f37092
[ 8.681686][ T161] Code: 00 00 00 e9 90 ff ff ff ff a3 24 00 00 00 68 30 00 00 00 e9 80 ff ff ff ff a3 f8 ff ff ff 66 90 00 00 00 00 00 00 00 00 cd 80 <c3> 8d b4 26 00 00 00 00 8d b6 00 00 00 00 8b 1c 24 c3 8d b4 26 00
All code
========
   0:	00 00                	add    %al,(%rax)
   2:	00 e9                	add    %ch,%cl
   4:	90                   	nop
   5:	ff                   	(bad)
   6:	ff                   	(bad)
   7:	ff                   	(bad)
   8:	ff a3 24 00 00 00    	jmp    *0x24(%rbx)
   e:	68 30 00 00 00       	push   $0x30
  13:	e9 80 ff ff ff       	jmp    0xffffffffffffff98
  18:	ff a3 f8 ff ff ff    	jmp    *-0x8(%rbx)
  1e:	66 90                	xchg   %ax,%ax
	...
  28:	cd 80                	int    $0x80
  2a:*	c3                   	ret		<-- trapping instruction
  2b:	8d b4 26 00 00 00 00 	lea    0x0(%rsi,%riz,1),%esi
  32:	8d b6 00 00 00 00    	lea    0x0(%rsi),%esi
  38:	8b 1c 24             	mov    (%rsp),%ebx
  3b:	c3                   	ret
  3c:	8d                   	.byte 0x8d
  3d:	b4 26                	mov    $0x26,%ah
	...

Code starting with the faulting instruction
===========================================
   0:	c3                   	ret
   1:	8d b4 26 00 00 00 00 	lea    0x0(%rsi,%riz,1),%esi
   8:	8d b6 00 00 00 00    	lea    0x0(%rsi),%esi
   e:	8b 1c 24             	mov    (%rsp),%ebx
  11:	c3                   	ret
  12:	8d                   	.byte 0x8d
  13:	b4 26                	mov    $0x26,%ah

The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20240621/[email-masked]

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki