FYI, we noticed the following commit (built with gcc-7): commit: 3ad20fe393b31025bebfc2d76964561f65df48aa ("binder: implement binderfs") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master in testcase: trinity with following parameters: runtime: 300s test-description: Trinity is a linux system call fuzz tester. test-url: http://codemonkey.org.uk/projects/trinity/ on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 768M caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace): +------------------------------------------+------------+------------+ | | 80cd795630 | 3ad20fe393 | +------------------------------------------+------------+------------+ | boot_successes | 17 | 1 | | boot_failures | 8 | 31 | | invoked_oom-killer:gfp_mask=0x | 6 | | | Mem-Info | 6 | | | BUG:kernel_in_stage | 2 | 4 | | RIP:__put_user_8 | 1 | | | BUG:unable_to_handle_kernel | 0 | 27 | | Oops:#[##] | 0 | 27 | | RIP:binderfs_mount | 0 | 27 | | Kernel_panic-not_syncing:Fatal_exception | 0 | 27 | +------------------------------------------+------------+------------+ [ 8.360965] BUG: unable to handle kernel NULL pointer dereference at 00000000000006a0 [ 8.362067] PGD 0 P4D 0 [ 8.362437] Oops: 0000 [#1] PREEMPT DEBUG_PAGEALLOC [ 8.363131] CPU: 0 PID: 1 Comm: swapper Not tainted 4.20.0-rc6-00107-g3ad20fe #2 [ 8.364177] RIP: 0010:binderfs_mount+0x42/0x480 [ 8.364820] Code: 89 fc 49 c7 c7 ff ff ff ff 48 83 ec 20 e8 86 5d 86 ff 48 8b 04 25 40 10 e3 ab 48 8b 80 28 06 00 00 be 15 00 00 00 48 8b 58 10 <48> 8b bb a0 06 00 00 e8 e2 3c 7d ff 84 c0 75 19 e8 59 5d 86 ff 48 [ 8.367104] RSP: 0000:ffffb6a78000bd98 EFLAGS: 00010293 [ 8.367104] RAX: ffffffffabe48e40 RBX: 0000000000000000 RCX: ffffffffab2bfd6a [ 8.367104] RDX: 0000000000000000 RSI: 0000000000000015 RDI: ffffffffabf38d60 [ 8.367104] RBP: ffffb6a78000bde8 R08: 0000000000000000 R09: 0000000000000000 [ 8.367104] R10: 0000000000000000 R11: ffff90c7ec4f2980 R12: ffffffffabf38d60 [ 8.367104] R13: 0000000000400000 R14: ffffffffabf38d60 R15: ffffffffffffffff [ 8.367104] FS: 0000000000000000(0000) GS:ffffffffabe2d000(0000) knlGS:0000000000000000 [ 8.367104] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.367104] CR2: 00000000000006a0 CR3: 0000000027e19000 CR4: 00000000000406b0 [ 8.367104] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 8.367104] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 8.367104] Call Trace: [ 8.367104] ? __lockdep_init_map+0x4d/0x1b0 [ 8.367104] mount_fs+0x30/0xe0 [ 8.367104] vfs_kern_mount+0x63/0x160 [ 8.367104] ? set_debug_rodata+0x1e/0x1e [ 8.367104] kern_mount_data+0x39/0x70 [ 8.367104] ? parse_cec_param+0x5b/0x5b [ 8.367104] init_binderfs+0x6d/0xa5 [ 8.367104] ? parse_cec_param+0x5b/0x5b [ 8.367104] do_one_initcall+0x6c/0x270 [ 8.367104] ? set_debug_rodata+0x1e/0x1e [ 8.367104] kernel_init_freeable+0x295/0x34a [ 8.367104] ? rest_init+0x150/0x150 [ 8.367104] kernel_init+0x14/0x180 [ 8.367104] ? _raw_spin_unlock_irq+0x34/0x50 [ 8.367104] ? rest_init+0x150/0x150 [ 8.367104] ret_from_fork+0x3a/0x50 [ 8.367104] Modules linked in: [ 8.367104] CR2: 00000000000006a0 [ 8.367104] _warn_unseeded_randomness: 10 callbacks suppressed [ 8.367104] random: get_random_bytes called from print_oops_end_marker+0x52/0x60 with crng_init=0 [ 8.367104] ---[ end trace bb3965315c8c70c2 ]--- To reproduce: git clone https://github.com/intel/lkp-tests.git cd lkp-tests bin/lkp qemu -k job-script # job-script is attached in this email Thanks, lkp