From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f99.google.com (mail-dl1-f99.google.com [74.125.82.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 17BD23033DF for ; Thu, 12 Feb 2026 21:12:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.99 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770930739; cv=none; b=NN0d/dYeLp07oWKYET99Dg/QYSRwelHza6hWVXyZMznamGtLqavsVTSxUkhycnO1wD67+gfAQ2JLPODp87ig+r4828e/xEmwUFMdKY/xlNW7Na05scMfyD20mhNQdzlD2Jvqy/zkQT2eKEqWLdjTMRy4aXtON1PexUQ5UwIhACs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770930739; c=relaxed/simple; bh=2/YaXjWFVJIVmVbl3nJvcQoTov5tjeQ1Z9BFsIlGp2Y=; h=Cc:Subject:To:Date:Message-Id:From; b=kkHmTR2u7VkHTln/55V7z16LHQyh9uJnS1xsLy4LAA1ztq8jgXG7c6NKmtChShEBHW6eWg/ASHwZVAJDTFqPN0/5A+4jqP2qX2iJLDi485GXZVPRunxKntx8I0XKau609DxlGQgHFkU8eqoYB6iO+6qbw43bcZyIJQ+gFytCOQw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=windowsforum.com; spf=pass smtp.mailfrom=windowsforum.com; dkim=pass (1024-bit key) header.d=windowsforum.com header.i=@windowsforum.com header.b=Y2NnPePg; arc=none smtp.client-ip=74.125.82.99 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=windowsforum.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=windowsforum.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=windowsforum.com header.i=@windowsforum.com header.b="Y2NnPePg" Received: by mail-dl1-f99.google.com with SMTP id a92af1059eb24-1273349c56bso427138c88.0 for ; Thu, 12 Feb 2026 13:12:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windowsforum.com; s=google; t=1770930737; x=1771535537; darn=vger.kernel.org; h=from:message-id:date:user-agent:to:subject:cc:from:to:cc:subject :date:message-id:reply-to; bh=E2c0KVzuh9JhwtxUA96wBFN9HP9U6gVAVVLaHh55Yzs=; b=Y2NnPePgnq6aiH3+3y4A+iy1z5gsP/vfJfNVZoHKebM/vFRw2hzvV7/vvbvzFtzShT wr+n0K+cIrcEAzkc6ihu/ZlqKTBaZnzlU/AWRZLToDWmetsKWmSuZeyq8aSYkHIlSOtW l/jI0Cv+vB/X/8UKBtb0RDJNwkCaoAaxzFNak= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770930737; x=1771535537; h=from:message-id:date:user-agent:to:subject:cc:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=E2c0KVzuh9JhwtxUA96wBFN9HP9U6gVAVVLaHh55Yzs=; b=eSmhJZwstD1d1Ie2LSXzlUdXuyg4AHuVMNjhM6MKXqlewl34LtTfRfYqKhnqVyzcIJ aoYCEaq6A9+NswjjO1VQbdPgRreDfAIzyzuqjJ2qCT4B6be6fZEn5xanuuC3n9B+muhW jEMQJqFdOdHlqcZQWl+aTdRfffpUO6XkfejdHllyJ55OsQEQOp7S6WxK2NSrW5cnBBeq sEMYokC1o+tBBnLIqGrDxX97ktNMdzoFSnkfofuHq1QdZRVGwGXjDuEyXOzUqmr1YdUf Y76pJkSDs9N48LqtZLSCBLWNFo0GuomIX2gQL+55gNWo2mS2QzklqVbPYb4GVH5sL3ZZ 1cdA== X-Forwarded-Encrypted: i=1; AJvYcCWObIKMIRL8huhvkSq2SP0oG7M4dJowgrPSR9xyEE+UWQDxH6IWmC9hqDQZhrKRKVpx1YlfpoKPY2EsiHM=@vger.kernel.org X-Gm-Message-State: AOJu0Yxp1rl/eJ7+OnmySN640+fZgHJ3CNvLIZdzv/qIVICubpB9s/J3 hEZ6y0TtidnmXOHmDk33IkiP13tmAsEjodoaxwWg/W22LSlwLhsaR+qgJRA10KhJnc2GO0SaGje LZHKyVwHUEVEM/8b+zF9jULj5zGNR3a5lhtwh X-Gm-Gg: AZuq6aK578c2mpdlbZRAdX86zdVjQ++O5bKc035aHmCJ6pNVjxsaTcuXHaRdFsOlHRe fEhrkp/BL48WM+I8KQtWr2H19iCscVgRaI+5dstGafYJf0Q+oaJb+f9WXOXjM4o5m3ibuHrBw+U G+X3m+Xf9ludFmlEaYOTVHAL6rExb4O0opO/4t6pedSsIhHEdhD4EjiRE2XQdgPBfinKdHu71+7 a1GQJgIarZcopzJeltniXAJRHpVp2rbumy+dSEE6c8R41gsvLVyoI8VY8+joLUd3Rk3L9hf6+Hb VgXiDbqUPjcZHG3Z9YANTiBwMPm7SIw6GhvcExUwnTlaAMtuZyrNwRbo714tRwdBlAIEVMwaJF1 XcfVMK6K1zn1z5h62eAcy4WpEv9IUxilt7offZEcG/GzrqjAkplf/G9Zzc67TNxnEEwpxNiLN X-Received: by 2002:a05:7022:628b:b0:119:e569:f61b with SMTP id a92af1059eb24-127397cee0amr164255c88.20.1770930737054; Thu, 12 Feb 2026 13:12:17 -0800 (PST) Received: from windowsforum.com (116.9.196.104.bc.googleusercontent.com. [104.196.9.116]) by smtp-relay.gmail.com with ESMTPS id a92af1059eb24-1272a6dd6dfsm933324c88.7.2026.02.12.13.12.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 12 Feb 2026 13:12:17 -0800 (PST) X-Relaying-Domain: windowsforum.com Received: by windowsforum.com (Postfix, from userid 0) id F1BE52A1C1D; Thu, 12 Feb 2026 21:12:13 +0000 (UTC) Cc: ,,, Subject: [BUG] sched_mm_cid_exit+0xe2: page fault on CID bitmap write with nopti on 6.19.0 To: User-Agent: mail (GNU Mailutils 3.20) Date: Thu, 12 Feb 2026 21:12:13 +0000 Message-Id: <20260212211213.F1BE52A1C1D@windowsforum.com> From: root Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: To: mathieu.desnoyers@efficios.com Cc: peterz@infradead.org, mingo@redhat.com, linux-kernel@vger.kernel.org Subject: [BUG] sched_mm_cid_exit+0xe2: page fault on CID bitmap write with nopti on 6.19.0 Hi Mathieu, I'm hitting a repeatable page fault in sched_mm_cid_exit() on 6.19.0 when booting with nopti. The crash occurs during process exit (do_exit -> sched_mm_cid_exit) on an atomic bit-clear (lock btr) of the CID bitmap. The faulting address is within a 2MB huge page that returns a permissions violation on supervisor write access. The bug triggered 8 times over ~20 hours on a single boot, hitting multiple unrelated processes (git, gce_workload_ce). Eventually D-Bus died and systemd became non-functional, requiring a hard power-off. Reproducer: Boot 6.19.0 with "nopti" (or "mitigations=off") on the cmdline. Run any workload that spawns and exits processes frequently (e.g. repeated git operations). Crashes begin within hours. Workarounds tested: - CONFIG_SCHED_MM_CID=n: eliminates the crash (confirmed) - Removing "nopti" from cmdline (PTI enabled): no crash observed (other spectre/ibrs params remained disabled during this test) Environment: Kernel: 6.19.0 (built from kernel.org tarball, LOCALVERSION=-gce) Config: CONFIG_SCHED_MM_CID=y, CONFIG_CPU_MITIGATIONS=y (but mitigations disabled at boot via cmdline, see below) Boot params: nospectre_v1 nospectre_v2 spectre_v2=off spec_store_bypass_disable=off nopti noibrs noibpb no_stf_barrier mitigations=off CPU: Intel Xeon Platinum 8581C @ 2.30GHz (pcid, invpcid, la57, 52-bit physical / 57-bit virtual) Platform: Google Compute Engine VM 8 vCPUs, 4 cores (HT), 30GB RAM, single NUMA node Preemption: PREEMPT_NONE, HZ_250 Modules: all unsigned (E taint) — stock: xfs, nft_compat, aesni_intel, virtio_rng, ip_tables, etc. Full .config available on request. All 8 crashes share identical characteristics: - RIP: sched_mm_cid_exit+0xe2/0x200 - Fault type: supervisor write, permissions violation (error 0x0003) - PMD: 2MB huge page mapping (bit 7 set), dirty+accessed - Affected process exits with irqs disabled and preempt_count 1 Crash summary (oops #1-#2 occurred early in the boot but were not captured by journald; the D taint on #3 confirms prior oopses): Oops Time Process CPU Fault address PMD #3 16:21:40 git[872493] 0 ff12983438c79bd0 80000001f8c001a1 #4 16:24:26 git[874084] 3 ff1298343a86c5d0 80000001fa8001a1 #5 16:33:52 git[882005] 0 ff1298343a86b0d0 80000001fa8001a1 #6 16:49:41 gce_workload_ce[919343] 4 ff1298343a868dd0 80000001fa8001a1 #7 18:54:23 git[982223] 1 ff1298343a86e8d0 80000001fa8001a1 #8 19:27:13 git[1010036] 6 ff1298343a86bed0 80000001fa8001a1 Observations: - Oopses #4-#8 all fault within the same PMD (80000001fa8001a1) at different offsets, suggesting the 2MB huge page mapping for the CID bitmap has incorrect write permissions, rather than individual bitmap entries being corrupted. - Oops #3 uses a different PMD (80000001f8c001a1), indicating the issue can affect multiple huge page mappings. - Crashes occur on all CPUs (0,1,3,4,6) — not tied to a specific core. - Not process-specific: both git (via exit(2) syscall) and gce_workload_ce (via signal delivery -> do_group_exit) trigger it. Full oops from first captured occurrence (#3): BUG: unable to handle page fault for address: ff12983438c79bd0 #PF: supervisor write access in kernel mode #PF: error_code(0x0003) - permissions violation PGD 1fba01067 P4D 1fba02067 PUD 1002a0063 PMD 80000001f8c001a1 Oops: Oops: 0003 [#3] SMP NOPTI CPU: 0 UID: 0 PID: 872493 Comm: git Tainted: G D E 6.19.0-gce #1 PREEMPT(none) Tainted: [D]=DIE, [E]=UNSIGNED_MODULE Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/24/2025 RIP: 0010:sched_mm_cid_exit+0xe2/0x200 Code: 48 03 05 29 54 44 02 8b 10 81 e2 ff ff ff bf 89 10 8b 05 51 0b fa 01 83 c0 3f c1 e8 03 25 f8 ff ff 1f 48 8d 84 43 c0 06 00 00 48 0f b3 10 48 81 f9 ff ef ff ff 77 0c 48 8d bb 10 01 00 00 e8 RSP: 0018:ff7720274e6a3b58 EFLAGS: 00010002 RAX: ff12983434c79bd0 RBX: ff12983434c79500 RCX: ff12983434c7960f RDX: 0000000020000006 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ff7720274e6a3b80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ff129836b560b180 R14: ff129833634d0000 R15: ff129833634d0000 FS: 000077b36aadc6c0(0000) GS:ff12983a5742b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ff12983438c79bd0 CR3: 0000000351154002 CR4: 0000000000371ef0 Call Trace: do_exit+0xc3/0xa00 __x64_sys_exit+0x1b/0x20 x64_sys_call+0x234d/0x2360 do_syscall_64+0x7b/0x580 ? _raw_spin_unlock_irq+0xe/0x50 ? __x64_sys_rt_sigprocmask+0xdd/0x160 ? x64_sys_call+0x160f/0x2360 ? do_syscall_64+0xb4/0x580 ? __do_sys_newfstatat+0x56/0x90 ? __x64_sys_newfstatat+0x1c/0x30 ? x64_sys_call+0x1510/0x2360 ? do_syscall_64+0xb4/0x580 ? __x64_sys_newfstatat+0x1c/0x30 ? x64_sys_call+0x1510/0x2360 ? do_syscall_64+0xb4/0x580 ? x64_sys_call+0x1510/0x2360 ? do_syscall_64+0xb4/0x580 ? exc_page_fault+0x8b/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Modules linked in: xt_comment(E) nft_compat(E) tcp_diag(E) inet_diag(E) 8021q(E) garp(E) mrp(E) nls_iso8859_1(E) xfs(E) intel_rapl_msr(E) intel_rapl_common(E) intel_uncore_frequency_common(E) ghash_clmulni_intel(E) aesni_intel(E) rapl(E) pvpanic_mmio(E) pvpanic(E) mac_hid(E) efi_pstore(E) virtio_rng(E) ip_tables(E) ---[ end trace 0000000000000000 ]--- note: git[872493] exited with irqs disabled note: git[872493] exited with preempt_count 1 Thanks,