[tip:sched/urgent] [sched/fair] 78f8764d34: Oops:general_protection_fault,probably_for_non-canonical_address#:#[##]SMP_KASAN_PTI

[tip:sched/urgent] [sched/fair] 78f8764d34: Oops:general_protection_fault,probably_for_non-canonical_address#:#[##]SMP_KASAN_PTI

[kernel test robot]

Hello,

kernel test robot noticed "Oops:general_protection_fault,probably_for_non-canonical_address#:#[##]SMP_KASAN_PTI" on:

commit: 78f8764d34c0a1912ce209bb2a428a94d062707f ("sched/fair: Forfeit vruntime on yield()")
https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git sched/urgent


in testcase: trinity
version: trinity-x86_64-ba2360ed-1_20241228
with following parameters:

	runtime: 300s
	group: group-03
	nr_groups: 5



config: x86_64-randconfig-073-20250921
compiler: clang-20
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

(please refer to attached dmesg/kmsg for entire log/backtrace)



If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202509251504.1f53d5d1-lkp@intel.com


[  172.153051][ T3790] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000a: 0000 [#1] SMP KASAN PTI
[  172.156503][ T3790] KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057]
[  172.158211][ T3790] CPU: 1 UID: 65534 PID: 3790 Comm: trinity-c7 Not tainted 6.17.0-rc6-00001-g78f8764d34c0 #1 VOLUNTARY
[ 172.159150][ T3790] RIP: 0010:pick_task_fair (kbuild/src/consumer/kernel/sched/fair.c:5525 kbuild/src/consumer/kernel/sched/fair.c:8758) 
[ 172.159674][ T3790] Code: 74 08 4c 89 f7 e8 28 63 55 00 4d 8b 2e eb 40 4c 89 e7 be 01 00 00 00 e8 d6 f9 00 00 49 89 c5 4c 8d 60 51 4c 89 e0 48 c1 e8 03 <8a> 04 18 84 c0 0f 85 a0 00 00 00 41 80 3c 24 00 74 13 48 8b 3c 24
All code
========
   0:	74 08                	je     0xa
   2:	4c 89 f7             	mov    %r14,%rdi
   5:	e8 28 63 55 00       	call   0x556332
   a:	4d 8b 2e             	mov    (%r14),%r13
   d:	eb 40                	jmp    0x4f
   f:	4c 89 e7             	mov    %r12,%rdi
  12:	be 01 00 00 00       	mov    $0x1,%esi
  17:	e8 d6 f9 00 00       	call   0xf9f2
  1c:	49 89 c5             	mov    %rax,%r13
  1f:	4c 8d 60 51          	lea    0x51(%rax),%r12
  23:	4c 89 e0             	mov    %r12,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
  2a:*	8a 04 18             	mov    (%rax,%rbx,1),%al		<-- trapping instruction
  2d:	84 c0                	test   %al,%al
  2f:	0f 85 a0 00 00 00    	jne    0xd5
  35:	41 80 3c 24 00       	cmpb   $0x0,(%r12)
  3a:	74 13                	je     0x4f
  3c:	48 8b 3c 24          	mov    (%rsp),%rdi

Code starting with the faulting instruction
===========================================
   0:	8a 04 18             	mov    (%rax,%rbx,1),%al
   3:	84 c0                	test   %al,%al
   5:	0f 85 a0 00 00 00    	jne    0xab
   b:	41 80 3c 24 00       	cmpb   $0x0,(%r12)
  10:	74 13                	je     0x25
  12:	48 8b 3c 24          	mov    (%rsp),%rdi
[  172.161272][ T3790] RSP: 0018:ffffc90006147bc0 EFLAGS: 00010006
[  172.161779][ T3790] RAX: 000000000000000a RBX: dffffc0000000000 RCX: 0000000000000000
[  172.162425][ T3790] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[  172.163106][ T3790] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[  172.163768][ T3790] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000051
[  172.164429][ T3790] R13: 0000000000000000 R14: ffff8881aa616c60 R15: ffff8883af132210
[  172.165093][ T3790] FS:  00007f7ee462a740(0000) GS:ffff888428b43000(0000) knlGS:0000000000000000
[  172.165864][ T3790] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  172.166439][ T3790] CR2: 000055e445018050 CR3: 00000001bf01c000 CR4: 00000000000406b0
[  172.167095][ T3790] DR0: 00007f7ee272f000 DR1: 0000000000000000 DR2: 0000000000000000
[  172.167741][ T3790] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000030602
[  172.168388][ T3790] Call Trace:
[  172.168665][ T3790]  <TASK>
[ 172.168914][ T3790] pick_next_task_fair (kbuild/src/consumer/kernel/sched/fair.c:8779) 
[ 172.169368][ T3790] __pick_next_task (kbuild/src/consumer/kernel/sched/core.c:6002) 
[ 172.169774][ T3790] __schedule (kbuild/src/consumer/kernel/sched/core.c:? kbuild/src/consumer/kernel/sched/core.c:6902) 
[ 172.170152][ T3790] ? __cgroup_account_cputime (kbuild/src/consumer/arch/x86/include/asm/preempt.h:85 kbuild/src/consumer/kernel/cgroup/rstat.c:615 kbuild/src/consumer/kernel/cgroup/rstat.c:625) 


The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250925/202509251504.1f53d5d1-lkp@intel.com



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [tip:sched/urgent] [sched/fair] 78f8764d34: Oops:general_protection_fault,probably_for_non-canonical_address#:#[##]SMP_KASAN_PTI

[Peter Zijlstra]

On Thu, Sep 25, 2025 at 03:26:41PM +0800, kernel test robot wrote:
> 
> 
> Hello,
> 
> kernel test robot noticed "Oops:general_protection_fault,probably_for_non-canonical_address#:#[##]SMP_KASAN_PTI" on:
> 
> commit: 78f8764d34c0a1912ce209bb2a428a94d062707f ("sched/fair: Forfeit vruntime on yield()")
> https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git sched/urgent

I suppose I'll just zap this patch -- there is a new version of it
anyway.