Received-SPF: pass (google.com: domain of linux-kernel+bounces-87995-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Fri, 1 Mar 2024 15:14:46 +0800
From: Chen Yu <yu.c.chen@intel.com>
To: Abel Wu <wuyun.abel@bytedance.com>
CC: Breno Leitao <leitao@debian.org>, <peterz@infradead.org>, <bp@alien8.de>,
	<tglx@linutronix.de>, <linux-kernel@vger.kernel.org>, Oliver Sang
	<oliver.sang@intel.com>
Subject: Re: general protection fault, probably for non-canonical address in
 pick_next_task_fair()
Message-ID: <ZeGAZg/JXifpX7bp@chenyu5-mobl2>
References: <ZeCo7STWxq+oyN2U@gmail.com>
 <123ebd58-9ca1-4a12-bdb7-c35d0c48c93c@bytedance.com>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <123ebd58-9ca1-4a12-bdb7-c35d0c48c93c@bytedance.com>
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?pWF0o7yxA/zwHSASQybqdsQwjoWeDNjCLR/ikMY1tew3diPpAFcLPZY/VU1L?=
 =?us-ascii?Q?t9JOzUS0XmnyYjZFb6G3eyo2B7H9sJaYGaicHc4n3yvkfAq3U9Pm9hKg9j8P?=
 =?us-ascii?Q?2ufqxlccFmTXkXQt9vQdjGSqeLCl9wkjz9GBNvu4dd0ltaRei2GWx1JB7IqA?=
 =?us-ascii?Q?tuaI8vJV67g2/GvTpdxwdsX8rP18AN/nCbx7+znnZ2XepvjAn7wbgPbeJrQ9?=
 =?us-ascii?Q?QrNCR7P92oGbO3V//lQ0ghNpef9ZPrm8MbFgCtNjxbwbrVQk2qWb5TJ6ixgV?=
 =?us-ascii?Q?dhe9VHHYJQtZqdgS5imURd7WMnl7o2i425iunCHa6Qrcip137XcOSoivVDbv?=
 =?us-ascii?Q?mcghhVoZ2t5sJc4zH8QWgBpmcv89M0W7m2jlyegRNoUMTmZazUkvEZobYXlV?=
 =?us-ascii?Q?zCEnNzEkbrFVMJMjTza7KOQwhSfNJuA9c+fsSoKxoMY++OevitffIvsxLGkF?=
 =?us-ascii?Q?0V6z+BdUa6sKJwIkDs/GYO0mbAI/J7VUzl07ngAMwgrKZ7HIN0xUhwIoeJbM?=
 =?us-ascii?Q?FPhgC6IQY+NXUEkaMB1s2PgaMzXnl/D80JMvKDdDDy6tL/HZzapt4d8IRinr?=
 =?us-ascii?Q?dwEDgZV6BlzcU5w6on67bP8EleTTO9VfWpxRCS8Nn98Yo1Y2bPPJHNaXdjJn?=
 =?us-ascii?Q?V/mzLwjky/rvWOH7O465YqrnG9JUSKEQ8x4R28IlaoKXHCmfiewA6lAJ0lyh?=
 =?us-ascii?Q?8lUC3ujYHTcv+aimFdFprEbN3D8vUL9+1vF7SRoH+PANOj5YZZRwgsfN9bVD?=
 =?us-ascii?Q?N3NsU1s+DPQZp4lt+t+qAtZsC+zIAmjIIEs2PlmwxSYWPz6b3wOH8VKxTGDc?=
 =?us-ascii?Q?ubR14TBH98yI/V71R7L5RyAqA8F5wlZ2tl88j7xQoHMbam92aGbZCrsgxJ/j?=
 =?us-ascii?Q?PyTaYqt7UkIDPTao2BnYMMlC8SqfZ7oMccMvQW8BP4vSU/6NPy4Y2/Kq0Bnf?=
 =?us-ascii?Q?DsLjs5W6m18M1gPrNrqiEzvO3yzsmpK1aeih/Cewucv0XDwNF9jnJoOGVXyI?=
 =?us-ascii?Q?MfqT00HVC5jU5CPubVcBzUZIV2sf6JXCgDaMBHBC7DOM0ZSaPdiSwNRNNPqo?=
 =?us-ascii?Q?a4EOLLK6iJ+w4hWfzbIbXlPnxdAZJwBrcNXLl2k21Jr2HadvnT/ahFmz1Vn/?=
 =?us-ascii?Q?9lXfiZJzGd7UgYGOusaYoU9moQmKdWhEjuM1Q+1hPWP5pDEfc+a2tIupwpwa?=
 =?us-ascii?Q?aTCnaJ8qOhmTN7dEDT4R2UkZYUO8W8N4RMRJCLThqrFvbiYASEZZUYvAjHHg?=
 =?us-ascii?Q?JInb9bDb6GpSLqxtQA4+chcEincSONRsft7Z/HwTXqztg92w8+GE0ecl9anE?=
 =?us-ascii?Q?to5IYydqcD+Vd1sf2/QP8m0xvOCRVAl4cKaQEpRpIYbNUqVTDhKeEU2qUP2M?=
 =?us-ascii?Q?8gbB0RfdyxvwD/Qs7KFfZEa20GXJG/lQBIDR6AVNB7j5SLrneLs+48IF43ge?=
 =?us-ascii?Q?phMPGKbnhmgV0gYNnCJC8k8vQV5xiqkHpct0gTPpa9hbdM1E6sDHCiBoT+Yi?=
 =?us-ascii?Q?knVTPGJ8L1KKV1fhD8N3Hx4ifwn22TNyTyc/QqwXbkE68IkwLxRoKiFiXxpg?=
 =?us-ascii?Q?7M8sq62cKWEbGHe8nRuV8PgRnykvvsCgAKNTI6Vj?=
X-MS-Exchange-CrossTenant-Network-Message-Id: e402966e-1c48-45cc-44b9-08dc39bf4b96
X-MS-Exchange-CrossTenant-AuthSource: PH7PR11MB6005.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Mar 2024 07:14:55.1055
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: R7k3Bvmcx8G24VFipAfeSsidMwggYfK2JcX7Hf9FLVlMPENXGADgcxie+tBVRybZX5Tp1cWoHHiASTvC3p68YA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB7421
X-OriginatorOrg: intel.com

On 2024-03-01 at 11:47:05 +0800, Abel Wu wrote:
> (+ Chen Yu, Oliver Sang)
> 
> On 2/29/24 11:55 PM, Breno Leitao Wrote:
> > I've been running some stress test using stress-ng with a kernel with some
> > debug options enabled, such as KASAN and friends (See the config below).
> > 
> > I saw it in rc4 and the decode instructions are a bit off (as it is here
> > also - search for mavabs in dmesg below and you will find something as `(bad)`,
> > so I though it was a machine issue. But now I see it again, and I am sharing
> > for awareness.
> > 
> > This is happening in upstream kernel against the following commit
> > d206a76d7d2726 ("Linux 6.8-rc6")
> > 
> > This is the exercpt that shows before the crash:
> > 
> > 	general protection fault, probably for non-canonical address 0xdffffc0000000014: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN
> > 	KASAN: null-ptr-deref in range [0x00000000000000a0-0x00000000000000a7]
> > 
> > This is the stack that is getting it
> > 
> > 	? __die_body (arch/x86/kernel/dumpstack.c:421)
> > 	? die_addr (arch/x86/kernel/dumpstack.c:460)
> > 	? exc_general_protection (arch/x86/kernel/traps.c:? arch/x86/kernel/traps.c:643)
> > 	? asm_exc_general_protection (arch/x86/include/asm/idtentry.h:564)
> > 	? pick_next_task_fair (kernel/sched/sched.h:1453 kernel/sched/fair.c:8435)

Seems to be the same reason pick_eevdf returns NULL.. it panic here..
cfs_rq = group_cfs_rq(se);

I remember lkp has regular stress-ng test for regression test, but
not detect this yet.

thanks,
Chenyu