Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.36 as permitted sender) client-ip=23.128.96.36;
Feedback-ID: i56a14606:Fastmail
User-Agent: Cyrus-JMAP/3.9.0-alpha0-1048-g9229b632c5-fm-20231019.001-g9229b632
MIME-Version: 1.0
Message-Id: <8f86f22a-e182-4ddf-b533-b4ae8b088dd4@app.fastmail.com>
In-Reply-To: <CA+G9fYt6pY+tMZEOg=SoEywQOe19fGP3uR15SGowkdK+_X85Cg@mail.gmail.com>
References: <CA+G9fYt6pY+tMZEOg=SoEywQOe19fGP3uR15SGowkdK+_X85Cg@mail.gmail.com>
Date:   Fri, 27 Oct 2023 14:55:14 +0200
From:   "Arnd Bergmann" <arnd@arndb.de>
To:     "Naresh Kamboju" <naresh.kamboju@linaro.org>,
        "open list:KERNEL SELFTEST FRAMEWORK" 
        <linux-kselftest@vger.kernel.org>,
        linux-trace-kernel@vger.kernel.org,
        "open list" <linux-kernel@vger.kernel.org>,
        linux-mm <linux-mm@kvack.org>, lkft-triage@lists.linaro.org
Cc:     "Masami Hiramatsu" <mhiramat@kernel.org>,
        "Mark Rutland" <mark.rutland@arm.com>,
        "Andrew Morton" <akpm@linux-foundation.org>,
        "Steven Rostedt" <rostedt@goodmis.org>,
        "Oleg Nesterov" <oleg@redhat.com>, "Dave Jones" <davej@redhat.com>,
        "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
        "Paul McKenney" <paulmck@linux.vnet.ibm.com>,
        "Alan Stern" <stern@rowland.harvard.edu>,
        "Sasha Levin" <sasha.levin@oracle.com>,
        "Peter Zijlstra" <peterz@infradead.org>,
        "Ingo Molnar" <mingo@kernel.org>,
        "Dan Carpenter" <dan.carpenter@linaro.org>,
        "Ajay Kaher" <akaher@vmware.com>
Subject: Re: selftests: ftrace: RIP: 0010:__lock_acquire
 (kernel/locking/lockdep.c:5005)
Content-Type: text/plain
Precedence: bulk

On Fri, Oct 27, 2023, at 13:47, Naresh Kamboju wrote:
> Following kernel crash noticed on x86_64 while running selftests ftracetests
> running 6.6.0-rc7-next-20231026.
>
> Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>

My guess would be that this is caused by 5790b1fb3d67 ("eventfs:
Remove eventfs_file and just use eventfs_inode"), in which
Steven Rostedt recently added the create_dir_dentry() function
through a rewrite:


> log:
> -----
> # ok 44 ftrace - test for function traceon/off triggers
> # ok 45 ftrace - test tracing error log support
> # ok 46 Test creation and deletion of trace instances while setting an event
> [ 1402.419605] BUG: kernel NULL pointer dereference, address: 0000000000000097
> [ 1402.426574] #PF: supervisor read access in kernel mode
...
> [ 1402.581170] ? exc_page_fault (arch/x86/include/asm/irqflags.h:26
> arch/x86/include/asm/irqflags.h:67 arch/x86/include/asm/irqflags.h:127
> arch/x86/mm/fault.c:1513 arch/x86/mm/fault.c:1561)
> [ 1402.585094] ? asm_exc_page_fault (arch/x86/include/asm/idtentry.h:570)
> [ 1402.589283] ? __lock_acquire (kernel/locking/lockdep.c:5005)
> [ 1402.593296] ? lock_acquire (kernel/locking/lockdep.c:467
> (discriminator 4) kernel/locking/lockdep.c:5755 (discriminator 4)
> kernel/locking/lockdep.c:5718 (discriminator 4))

The lock passed to spin_lock() and lock_acquire() is a NULL
pointer.

> [ 1402.597045] ? create_dir_dentry.part.0
> (fs/tracefs/event_inode.c:357 (discriminator 1))
> [ 1402.601928] lock_acquire (kernel/locking/lockdep.c:467
> (discriminator 4) kernel/locking/lockdep.c:5755 (discriminator 4)
> kernel/locking/lockdep.c:5718 (discriminator 4))
> [ 1402.605503] ? d_invalidate (fs/dcache.c:1725 (discriminator 1))


This lock is part of the dentry passed to d_invalidate()

> [ 1402.609170] ? lock_release (kernel/locking/lockdep.c:5429
> kernel/locking/lockdep.c:5773)
> [ 1402.612923] ? create_dir_dentry.part.0 (fs/tracefs/event_inode.c:387)
> [ 1402.617803] _raw_spin_lock (include/linux/spinlock_api_smp.h:134
> kernel/locking/spinlock.c:154)
> [ 1402.621467] ? d_invalidate (fs/dcache.c:1725 (discriminator 1))
> [ 1402.625126] d_invalidate (fs/dcache.c:1725 (discriminator 1))
> [ 1402.628619] create_dir_dentry.part.0 (fs/tracefs/event_inode.c:390)

Which is called by create_dir_dentry(). I don't see a bug
in that function, but maybe Steve has an idea.

    Arnd