Bug 197515 - 4.14.0-rc5 kernel BUG at mm/slub.c:294 EIP: __slab_free and kmem_cache_free
Summary: 4.14.0-rc5 kernel BUG at mm/slub.c:294 EIP: __slab_free and kmem_cache_free
Status: NEW
Alias: None
Product: Memory Management
Classification: Unclassified
Component: Slab Allocator (show other bugs)
Hardware: i386 Linux
: P1 normal
Assignee: Andrew Morton
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-10-28 07:16 UTC by newsmails
Modified: 2021-10-15 17:59 UTC (History)
1 user (show)

See Also:
Kernel Version: 4.14.0-rc5
Tree: Mainline
Regression: No


Attachments
dmesg (88.74 KB, text/plain)
2017-10-28 07:16 UTC, newsmails
Details

Description newsmails 2017-10-28 07:16:55 UTC
Created attachment 260421 [details]
dmesg

cpu : Intel Skylake i3-6100H
linux : slackware 14.2 32 bit

Kernel bug at boot time.

I join dmesg file.

From syslog :
Oct 27 07:45:47 linuxp kernel: [    7.657942] ------------[ cut here ]------------
Oct 27 07:45:47 linuxp kernel: [    7.658094] kernel BUG at mm/slub.c:294!
Oct 27 07:45:47 linuxp kernel: [    7.658238] invalid opcode: 0000 [#1] SMP
Oct 27 07:45:47 linuxp kernel: [    7.658379] Modules linked in: irqbypass fb_sys_fops serio_raw snd_hda_intel ecdh_generic tpm_tis tpm_tis_core crc32_pclmul tpm crc32c_intel syscopyarea sysfillrect rfkill snd_hda_codec wmi thermal sysimgblt snd_hda_core snd_hwdep snd_pcm shpchp video intel_lpss_acpi i2c_hid i2c_i801 hid snd_timer snd xhci_pci xhci_hcd soundcore i2c_core battery intel_lpss intel_pch_thermal button mei_me mei acpi_pad ac loop
Oct 27 07:45:47 linuxp kernel: [    7.659079] CPU: 2 PID: 527 Comm: ata_id Not tainted 4.14.0-rc5 #1
Oct 27 07:45:47 linuxp kernel: [    7.659227] Hardware name: Notebook                         W65_W67RZ/W65_W67RZ, BIOS 1.05.06 02/22/2016
Oct 27 07:45:47 linuxp kernel: [    7.659474] task: f25be680 task.stack: f2054000
Oct 27 07:45:47 linuxp kernel: [    7.659621] EIP: __slab_free+0x1f0/0x310
Oct 27 07:45:47 linuxp kernel: [    7.659761] EFLAGS: 00010246 CPU: 2
Oct 27 07:45:47 linuxp kernel: [    7.659902] EAX: f29ddc00 EBX: f29ddc00 ECX: f29ddc00 EDX: 80150006
Oct 27 07:45:47 linuxp kernel: [    7.660049] ESI: f488da88 EDI: f3a6c000 EBP: f2055cfc ESP: f2055c7c
Oct 27 07:45:47 linuxp kernel: [    7.660197]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Oct 27 07:45:47 linuxp kernel: [    7.660343] CR0: 80050033 CR2: b761e4e6 CR3: 32851be0 CR4: 003406f0
Oct 27 07:45:47 linuxp kernel: [    7.660491] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
Oct 27 07:45:47 linuxp kernel: [    7.660640] DR6: fffe0ff0 DR7: 00000400
Oct 27 07:45:47 linuxp kernel: [    7.660781] Call Trace:
Oct 27 07:45:47 linuxp kernel: [    7.660923]  ? __schedule+0x205/0x7c0
Oct 27 07:45:47 linuxp kernel: [    7.661068]  ? pick_next_task_fair+0x283/0x5c0
Oct 27 07:45:47 linuxp kernel: [    7.661211]  ? schedule+0x2e/0x80
Oct 27 07:45:47 linuxp kernel: [    7.661352]  ? schedule_timeout+0x1ad/0x2f0
Oct 27 07:45:47 linuxp kernel: [    7.661494]  ? __schedule+0x205/0x7c0
Oct 27 07:45:47 linuxp kernel: [    7.661634]  kmem_cache_free+0x1c2/0x1e0
Oct 27 07:45:47 linuxp kernel: [    7.661777]  ? mempool_free_slab+0x13/0x20
Oct 27 07:45:47 linuxp kernel: [    7.661919]  ? mempool_free_slab+0x13/0x20
Oct 27 07:45:47 linuxp kernel: [    7.662062]  mempool_free_slab+0x13/0x20
Oct 27 07:45:47 linuxp kernel: [    7.662204]  mempool_free+0x2c/0x90
Oct 27 07:45:47 linuxp kernel: [    7.662347]  ? set_page_dirty_lock+0x3b/0x60
Oct 27 07:45:47 linuxp kernel: [    7.662491]  bio_free+0x40/0x70
Oct 27 07:45:47 linuxp kernel: [    7.662631]  bio_put+0x25/0x40
Oct 27 07:45:47 linuxp kernel: [    7.662772]  blk_rq_unmap_user+0x2f/0x50
Oct 27 07:45:47 linuxp kernel: [    7.662915]  sg_io+0x221/0x3e0
Oct 27 07:45:47 linuxp kernel: [    7.663055]  ? blkdev_get+0xec/0x2a0
Oct 27 07:45:47 linuxp kernel: [    7.663197]  ? _copy_from_user+0x34/0xd0
Oct 27 07:45:47 linuxp kernel: [    7.663340]  scsi_cmd_ioctl+0x299/0x3e0
Oct 27 07:45:47 linuxp kernel: [    7.663483]  ? path_openat+0x21b/0xfe0
Oct 27 07:45:47 linuxp kernel: [    7.663625]  ? touch_atime+0x25/0xa0
Oct 27 07:45:47 linuxp kernel: [    7.663766]  ? page_add_file_rmap+0x51/0x160
Oct 27 07:45:47 linuxp kernel: [    7.663910]  scsi_cmd_blk_ioctl+0x3f/0x50
Oct 27 07:45:47 linuxp kernel: [    7.664053]  sd_ioctl+0x6d/0xa0
Oct 27 07:45:47 linuxp kernel: [    7.664193]  ? scsi_disk_put+0x50/0x50
Oct 27 07:45:47 linuxp kernel: [    7.664335]  blkdev_ioctl+0x4ce/0xa20
Oct 27 07:45:47 linuxp kernel: [    7.664477]  ? do_filp_open+0x77/0xc0
Oct 27 07:45:47 linuxp kernel: [    7.664618]  block_ioctl+0x42/0x50
Oct 27 07:45:47 linuxp kernel: [    7.664759]  ? blkdev_fallocate+0x260/0x260
Oct 27 07:45:47 linuxp kernel: [    7.664903]  do_vfs_ioctl+0x89/0x6a0
Oct 27 07:45:47 linuxp kernel: [    7.665044]  ? __fd_install+0x1f/0xd0
Oct 27 07:45:47 linuxp kernel: [    7.665185]  ? __alloc_fd+0x2e/0x160
Oct 27 07:45:47 linuxp kernel: [    7.665326]  ? putname+0x54/0x60
Oct 27 07:45:47 linuxp kernel: [    7.665466]  ? putname+0x54/0x60
Oct 27 07:45:47 linuxp kernel: [    7.665607]  ? do_sys_open+0x174/0x1f0
Oct 27 07:45:47 linuxp kernel: [    7.665748]  SyS_ioctl+0x68/0x80
Oct 27 07:45:47 linuxp kernel: [    7.665889]  do_int80_syscall_32+0x5c/0x100
Oct 27 07:45:47 linuxp kernel: [    7.666032]  entry_INT80_32+0x31/0x31
Oct 27 07:45:47 linuxp kernel: [    7.666173] EIP: 0xb7db3094
Oct 27 07:45:47 linuxp kernel: [    7.666311] EFLAGS: 00000246 CPU: 2
Oct 27 07:45:47 linuxp kernel: [    7.666452] EAX: ffffffda EBX: 00000003 ECX: 00002285 EDX: bfd30300
Oct 27 07:45:47 linuxp kernel: [    7.666600] ESI: 00000000 EDI: bfd30340 EBP: bfd30818 ESP: bfd30268
Oct 27 07:45:47 linuxp kernel: [    7.666748]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b
Oct 27 07:45:47 linuxp kernel: [    7.666894] Code: c0 75 68 0f b6 44 24 33 c0 e8 07 38 44 24 1e 72 4a 8d 65 f4 5b 5e 5f 5d c3 66 90 f3 90 8b 06 a8 01 75 f8 e9 3d ff ff ff 8d 76 00 <0f> 0b 8d b6 00 00 00 00 8b 45 10 89 44 24 08 8b 45 0c 89 44 24
Oct 27 07:45:47 linuxp kernel: [    7.667279] EIP: __slab_free+0x1f0/0x310 SS:ESP: 0068:f2055c7c
Oct 27 07:45:47 linuxp kernel: [    7.667429] ---[ end trace df913fad124b344c ]---
Oct 27 07:45:47 linuxp kernel: [    7.709275] r8169 0000:02:00.1: can't disable ASPM; OS doesn't have ASPM control
Oct 27 07:45:47 linuxp kernel: [    7.729455] ------------[ cut here ]------------
Oct 27 07:45:47 linuxp kernel: [    7.729601] kernel BUG at mm/slub.c:294!
Oct 27 07:45:47 linuxp kernel: [    7.729744] invalid opcode: 0000 [#2] SMP
Oct 27 07:45:47 linuxp kernel: [    7.729885] Modules linked in: r8169 mii irqbypass fb_sys_fops serio_raw snd_hda_intel ecdh_generic tpm_tis tpm_tis_core crc32_pclmul tpm crc32c_intel syscopyarea sysfillrect rfkill snd_hda_codec wmi thermal sysimgblt snd_hda_core snd_hwdep snd_pcm shpchp video intel_lpss_acpi i2c_hid i2c_i801 hid snd_timer snd xhci_pci xhci_hcd soundcore i2c_core battery intel_lpss intel_pch_thermal button mei_me mei acpi_pad ac loop
Oct 27 07:45:47 linuxp kernel: [    7.730586] CPU: 2 PID: 537 Comm: ata_id Tainted: G      D         4.14.0-rc5 #1
Oct 27 07:45:47 linuxp kernel: [    7.730827] Hardware name: Notebook                         W65_W67RZ/W65_W67RZ, BIOS 1.05.06 02/22/2016
Oct 27 07:45:47 linuxp kernel: [    7.733576] task: f25be680 task.stack: f2062000
Oct 27 07:45:47 linuxp kernel: [    7.733723] EIP: kmem_cache_free+0x1d0/0x1e0
Oct 27 07:45:47 linuxp kernel: [    7.733865] EFLAGS: 00010246 CPU: 2
Oct 27 07:45:47 linuxp kernel: [    7.734006] EAX: f4086650 EBX: f278d480 ECX: f278d480 EDX: 000006e9
Oct 27 07:45:47 linuxp kernel: [    7.734153] ESI: f278d480 EDI: f3a6c000 EBP: f2063cc0 ESP: f2063c98
Oct 27 07:45:47 linuxp kernel: [    7.734301]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Oct 27 07:45:47 linuxp kernel: [    7.734447] CR0: 80050033 CR2: bfb8041c CR3: 328cb480 CR4: 003406f0
Oct 27 07:45:47 linuxp kernel: [    7.734593] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
Oct 27 07:45:47 linuxp kernel: [    7.734740] DR6: fffe0ff0 DR7: 00000400
Oct 27 07:45:47 linuxp kernel: [    7.734881] Call Trace:
Oct 27 07:45:47 linuxp kernel: [    7.735024]  ? __blk_run_queue+0x37/0x60
Oct 27 07:45:47 linuxp kernel: [    7.735167]  ? mempool_free_slab+0x13/0x20
Oct 27 07:45:47 linuxp kernel: [    7.735309]  mempool_free_slab+0x13/0x20
Oct 27 07:45:47 linuxp kernel: [    7.735451]  mempool_free+0x2c/0x90
Oct 27 07:45:47 linuxp kernel: [    7.735592]  ? set_page_dirty_lock+0x3b/0x60
Oct 27 07:45:47 linuxp kernel: [    7.735734]  bio_free+0x40/0x70
Oct 27 07:45:47 linuxp kernel: [    7.735874]  bio_put+0x25/0x40
Oct 27 07:45:47 linuxp kernel: [    7.736015]  blk_rq_unmap_user+0x2f/0x50
Oct 27 07:45:47 linuxp kernel: [    7.736158]  sg_io+0x221/0x3e0
Oct 27 07:45:47 linuxp kernel: [    7.736298]  ? _copy_from_user+0x34/0xd0
Oct 27 07:45:47 linuxp kernel: [    7.736440]  scsi_cmd_ioctl+0x299/0x3e0
Oct 27 07:45:47 linuxp kernel: [    7.736583]  scsi_cmd_blk_ioctl+0x3f/0x50
Oct 27 07:45:47 linuxp kernel: [    7.736726]  cdrom_ioctl+0x35/0xac0
Oct 27 07:45:47 linuxp kernel: [    7.736867]  ? path_openat+0x21b/0xfe0
Oct 27 07:45:47 linuxp kernel: [    7.737009]  ? touch_atime+0x25/0xa0
Oct 27 07:45:47 linuxp kernel: [    7.737151]  ? page_add_file_rmap+0x51/0x160
Oct 27 07:45:47 linuxp kernel: [    7.737295]  ? scsi_block_when_processing_errors+0x13/0xb0
Oct 27 07:45:47 linuxp kernel: [    7.737442]  sr_block_ioctl+0x74/0xc0
Oct 27 07:45:47 linuxp kernel: [    7.737584]  ? sr_block_check_events+0x30/0x30
Oct 27 07:45:47 linuxp kernel: [    7.737728]  blkdev_ioctl+0x4ce/0xa20
Oct 27 07:45:47 linuxp kernel: [    7.737869]  ? do_filp_open+0x77/0xc0
Oct 27 07:45:47 linuxp kernel: [    7.738011]  block_ioctl+0x42/0x50
Oct 27 07:45:47 linuxp kernel: [    7.738154]  ? blkdev_fallocate+0x260/0x260
Oct 27 07:45:47 linuxp kernel: [    7.738299]  do_vfs_ioctl+0x89/0x6a0
Oct 27 07:45:47 linuxp kernel: [    7.738439]  ? __fd_install+0x1f/0xd0
Oct 27 07:45:47 linuxp kernel: [    7.738582]  ? __alloc_fd+0x2e/0x160
Oct 27 07:45:47 linuxp kernel: [    7.738723]  ? putname+0x54/0x60
Oct 27 07:45:47 linuxp kernel: [    7.738864]  ? putname+0x54/0x60
Oct 27 07:45:47 linuxp kernel: [    7.739005]  ? do_sys_open+0x174/0x1f0
Oct 27 07:45:47 linuxp kernel: [    7.739147]  SyS_ioctl+0x68/0x80
Oct 27 07:45:47 linuxp kernel: [    7.739287]  do_int80_syscall_32+0x5c/0x100
Oct 27 07:45:47 linuxp kernel: [    7.739430]  entry_INT80_32+0x31/0x31
Oct 27 07:45:47 linuxp kernel: [    7.739571] EIP: 0xb7dd1094
Oct 27 07:45:47 linuxp kernel: [    7.739710] EFLAGS: 00000246 CPU: 2
Oct 27 07:45:47 linuxp kernel: [    7.739850] EAX: ffffffda EBX: 00000003 ECX: 00002285 EDX: bfdb3900
Oct 27 07:45:47 linuxp kernel: [    7.739997] ESI: 00000000 EDI: bfdb3940 EBP: bfdb3e18 ESP: bfdb3868
Oct 27 07:45:47 linuxp kernel: [    7.740144]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b
Oct 27 07:45:47 linuxp kernel: [    7.740289] Code: 00 00 00 89 54 24 04 8b 55 ec 89 44 24 08 8b 45 f0 89 c1 89 04 24 89 f8 e8 2e fb ff ff e9 f9 fe ff ff 89 f6 8d bc 27 00 00 00 00 <0f> 0b 8d b6 00 00 00 00 89 df e9 4d fe ff ff 90 3e 8d 74 26 00
Oct 27 07:45:47 linuxp kernel: [    7.740674] EIP: kmem_cache_free+0x1d0/0x1e0 SS:ESP: 0068:f2063c98
Oct 27 07:45:47 linuxp kernel: [    7.740830] ---[ end trace df913fad124b344d ]---
Comment 1 newsmails 2017-11-09 20:46:41 UTC
I compiled a 4.14.0-rc8 and I boot with parameter "slub_debug=FZPU".
I don't know how to reproduce ; at this time I did not reproduce.

But I have the following Oops ; I don't know if it is related :
Bug 197805 - 4.14.0-rc8 - Oops - EIP: __blk_rq_unmap_user - unable to handle kernel paging request
https://bugzilla.kernel.org/show_bug.cgi?id=197805

To answer your question about my drive :
Seagate ST500LM012 HN-M5 500GB
Comment 2 Ahmed Sayeed 2021-10-15 17:59:59 UTC
In collect_register() function of arc-linux-tdep.c, the "eret" http://www-look-4.com/travel/london/
(exception return) register value is not being reported correctly.

Background: https://komiya-dental.com/shopping/buy-android/
When asked for the "pc" value, we have to update the "eret" register
with GDB's STOP_PC.  The "eret" instructs the kernel code where to
jump back http://www.iu-bloomington.com/shopping/hatchback-cars/ when an instruction has stopped due to a breakpoint.  This
is how collect_register() is doing so: https://waytowhatsnext.com/shopping/xbox-release-date/

--------------8<--------------
  if (regnum == gdbarch_pc_regnum (gdbarch)) http://www.wearelondonmade.com/travel/london/
    regnum = ARC_ERET_REGNUM;
  regcache->raw_collect (regnum, buf + arc_linux_core_reg_offsets[regnum]);
-------------->8-------------- http://www.jopspeech.com/travel/london/

Root cause:
Although this is using the correct offset (ERET register's), it is also http://joerg.li/travel/london/ 
changing the REGNUM itself.  Therefore, raw_collect (regnum, ...) is
not reading from "pc" anymore. http://connstr.net/travel/london/

Consequence:
This bug affects the "native ARC gdb" badly and causes kernel code to jump
to addresses after the breakpoint and not executing the "breakpoint"ed http://embermanchester.uk/travel/london/ 
instructions at all.  That "native ARC gdb" feature is not upstream yet and
is in review at the time of writing [1]. http://www.slipstone.co.uk/travel/london/
In collect_register() function of arc-linux-tdep.c, the "eret"
(exception return) register value is not being reported correctly. http://www.logoarts.co.uk/travel/london/

Background:
When asked for the "pc" value, we have to update the "eret" register
with GDB's STOP_PC. http://www.acpirateradio.co.uk/travel/good/  The "eret" instructs the kernel code where to
jump back when an instruction has stopped due to a breakpoint.  This
is how collect_register() is doing so:
http://www.compilatori.com/travel/london/
--------------8<--------------
  if (regnum == gdbarch_pc_regnum (gdbarch))
    regnum = ARC_ERET_REGNUM;
  regcache->raw_collect (regnum, buf + arc_linux_core_reg_offsets[regnum]);
-------------->8--------------

Root cause: https://www.webb-dev.co.uk/shopping/shopping-during-corona/
Although this is using the correct offset (ERET register's), it is also
changing the REGNUM itself.  Therefore, raw_collect (regnum, ...) is
not reading from "pc" anymore.

Consequence:
This bug affects the "native ARC gdb" badly and causes kernel code to jump
to addresses after the breakpoint and not executing the "breakpoint"ed
instructions at all.  That "native ARC gdb" feature is not upstream yet and
is in review at the time of writing [1].

Note You need to log in before you can comment on or make changes to this bug.