From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751749AbdI3HfS (ORCPT <rfc822;w@1wt.eu>);
        Sat, 30 Sep 2017 03:35:18 -0400
Received: from mx2.suse.de ([195.135.220.15]:59388 "EHLO mx1.suse.de"
        rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP
        id S1750933AbdI3HfR (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Sat, 30 Sep 2017 03:35:17 -0400
From: NeilBrown <neilb@suse.com>
To: kernel test robot <xiaolong.ye@intel.com>
Date: Thu, 21 Sep 2017 09:02:29 +0200
Cc: Jens Axboe <axboe@kernel.dk>, Christoph Hellwig <hch@lst.de>,
        Ming Lei <ming.lei@redhat.com>, LKML <linux-kernel@vger.kernel.org>,
        Linus Torvalds <torvalds@linux-foundation.org>, lkp@01.org
Subject: Re: [lkp-robot] [blk]  47e0fb461f: BUG:unable_to_handle_kernel
In-Reply-To: <20170921024603.GB8188@yexl-desktop>
References: <20170921024603.GB8188@yexl-desktop>
Message-ID: <87a81or0u2.fsf@notabene.neil.brown.name>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
        micalg=pgp-sha256; protocol="application/pgp-signature"
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

--=-=-=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Thu, Sep 21 2017, kernel test robot wrote:

> FYI, we noticed the following commit:
>
> commit: 47e0fb461fca1a68a566c82fcc006cc787312d8c ("blk: make the bioset r=
escue_workqueue optional.")
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
>
> in testcase: trinity
> with following parameters:
>
> 	runtime: 300s
>
> test-description: Trinity is a linux system call fuzz tester.
> test-url: http://codemonkey.org.uk/projects/trinity/
>
>
> on test machine: qemu-system-x86_64 -enable-kvm -cpu IvyBridge -m 420M
>
> caused below changes (please refer to attached dmesg/kmsg for entire log/=
backtrace):

Interesting.
I cannot see how that bug could be caused by that patch.

I think it is crashing in
static inline bool ata_is_host_link(const struct ata_link *link)
{
	return link =3D=3D &link->ap->link || link =3D=3D link->ap->slave_link;
}
from
static inline int ata_link_max_devices(const struct ata_link *link)
{
	if (ata_is_host_link(link) && link->ap->flags & ATA_FLAG_SLAVE_POSS)
		return 2;
	return 1;
}
from ata_dev_next().

I think %rdi holds link->ap, so the "link->ap->slave_link" dereference
causes the crash.

link->ap seems to be initialized quite early, and never cleared, so I
don't know how it could  be NULL...

Confused.

Thanks,
NeilBrown

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEG8Yp69OQ2HB7X0l6Oeye3VZigbkFAlnDZAUACgkQOeye3VZi
gbmqOxAAmSMP8XKhdL4zU+ZpriLYGeaKM7G5q7fuoLTBJdp5oxuIJ5PPzS02SkMH
EwFdrY+8CTm0nPOe4vDV0BF+MXKScUFrcFtDxd4v6dFNGUDp16X6SvLLKxr1ZQve
pubKyhXwANd4skXm5Wv3XArMrWApJyv52oC8EVQWXENQNRSOP0yDwIj/dpiQqttM
u0dcYC+7fljcj+XDIOHTWUbDXaFq9rvBRE+4vbR9m1rkP1GzNqZDndIICO+RwF2g
fhwcATbWwXkqSeZOhUCLh0UBuPG4+HBFDdq2gTDgTuhjToC2WhR2ibCQAAFSo0Y6
5G13N28SvAOAPJV2xH0dZArUU3Agt0sLhUhDzu9kCTHPgHIVJ5r3BCD0aTcvRshV
PFOB/7D63En2OAR27mDXrTi1HeYSiQg6Ou75qfVa9wMnq5xKvzUdRJDyHgaLcoqI
wrQpzAwptmVLXDBQbtvyiSEjQ17izIO9hkmiBA45rDUf4fNpvOSqjjiYuMOv35VC
j/dez3a7xgbwpjCRNdPUMW5RiMPGVTdvRPQ7cCeR396h4h+cYoxM6Bv9YSQR/bJY
YfmfGmHlVYGY17XcW+puDXCQioYhO7XR5lQaFSPnbu9P68uOk4gCl/fReSpNYE+S
AjAQhevUX7FS3WqaIF+y4j44LrgOx3IonOikGIg3DfDYMNMce0Y=
=QpP6
-----END PGP SIGNATURE-----
--=-=-=--