arm and arm64 "kernel BUG at mm/vmalloc.c:1638!" after commit c5c0ba953b8c969 in -next

[nathanchance]

After https://git.kernel.org/tip/c5c0ba953b8c969c5d51bf1c57f239866a97c47c, I hit the BUG_ON(!IS_ALIGNED(va->va_start, align)); in mm/vmalloc.c when building and booting at least Arch Linux ARM's 32-bit v7 and 64-bit configurations.

Bisect log

# bad: [6db29e14f4fb7bce9eb5290288e71b05c2b0d118] Add linux-next specific files for 20230606
# good: [f8dba31b0a826e691949cd4fdfa5c30defaac8c5] Merge tag 'asym-keys-fix-for-linus-v6.4-rc5' of https://github.com/robertosassu/linux
git bisect start '6db29e14f4fb7bce9eb5290288e71b05c2b0d118' 'f8dba31b0a826e691949cd4fdfa5c30defaac8c5'
# good: [ac1f8e586b1c36577285b54ceece41b52cf30874] Merge branch 'drm-next' of git://git.freedesktop.org/git/drm/drm.git
git bisect good ac1f8e586b1c36577285b54ceece41b52cf30874
# good: [f868e26144a7ecea918b853b945d6983b05ac1bf] Merge branch 'for-backlight-next' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight.git
git bisect good f868e26144a7ecea918b853b945d6983b05ac1bf
# bad: [76b1c80746b11cb5fff26b53f471fd81924c4f85] Merge branch 'char-misc-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
git bisect bad 76b1c80746b11cb5fff26b53f471fd81924c4f85
# bad: [3509daf023c87b1c3213d2a7e977cdb4b6965d07] Merge branch 'rcu/next' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu.git
git bisect bad 3509daf023c87b1c3213d2a7e977cdb4b6965d07
# bad: [a82b4db121875930b23c97a2f2a7c623f0562bef] Merge ras/core into tip/master
git bisect bad a82b4db121875930b23c97a2f2a7c623f0562bef
# bad: [76930c89ca4b39372455924d9952373c8b462b24] Merge branch into tip/master: 'smp/core'
git bisect bad 76930c89ca4b39372455924d9952373c8b462b24
# bad: [222cbc95eb775a8d2093889ab2dbd16e5ab45860] Merge branch into tip/master: 'ras/core'
git bisect bad 222cbc95eb775a8d2093889ab2dbd16e5ab45860
# bad: [dc4e51fd9846c8890fae4216d2e169e098a3e953] Merge branch into tip/master: 'locking/core'
git bisect bad dc4e51fd9846c8890fae4216d2e169e098a3e953
# bad: [b1fe7f2cda2a003afe316ce8dfe8d3645694a67e] x86,intel_iommu: Replace cmpxchg_double()
git bisect bad b1fe7f2cda2a003afe316ce8dfe8d3645694a67e
# good: [b23e139d0b66c0216e7e9361a5021290395f504c] arch: Introduce arch_{,try_}_cmpxchg128{,_local}()
git bisect good b23e139d0b66c0216e7e9361a5021290395f504c
# bad: [6d12c8d308e68b9b0fa98ca2df4f83db4b4c965d] percpu: Wire up cmpxchg128
git bisect bad 6d12c8d308e68b9b0fa98ca2df4f83db4b4c965d
# bad: [c5c0ba953b8c969c5d51bf1c57f239866a97c47c] percpu: Add {raw,this}_cpu_try_cmpxchg()
git bisect bad c5c0ba953b8c969c5d51bf1c57f239866a97c47c
# good: [8c8b096a23d12fedf3c0f50524f30113ef97aa8c] instrumentation: Wire up cmpxchg128()
git bisect good 8c8b096a23d12fedf3c0f50524f30113ef97aa8c
# first bad commit: [c5c0ba953b8c969c5d51bf1c57f239866a97c47c] percpu: Add {raw,this}_cpu_try_cmpxchg()

ARCH=arm64 reproduction steps

$ curl -LSso .config https://github.com/archlinuxarm/PKGBUILDs/raw/master/core/linux-aarch64/config

$ make -skj"$(nproc)" ARCH=arm64 LLVM=1 olddefconfig Image.gz
...

$ boot-qemu.py -k . -t 15s
...
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x000f0510]
[    0.000000] Linux version 6.4.0-rc2-ARCH+ (nathan@dev-arch.thelio-3990X) (ClangBuiltLinux clang version 17.0.0 (https://github.com/llvm/llvm-project 5ac240bbea14d4edd0c484f5f879cd0f26be59e3), ClangBuiltLinux LLD 17.0.0) #1 SMP PREEMPT_DYNAMIC Tue Jun  6 15:21:46 MST 2023
...
[    0.000000] ------------[ cut here ]------------
[    0.000000] kernel BUG at mm/vmalloc.c:1638!
[    0.000000] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
[    0.000000] Modules linked in:
[    0.000000] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-rc2-ARCH+ #1
[    0.000000] Hardware name: linux,dummy-virt (DT)
[    0.000000] pstate: 200000c9 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    0.000000] pc : alloc_vmap_area+0x7ec/0x7f8
[    0.000000] lr : alloc_vmap_area+0x7e8/0x7f8
[    0.000000] sp : ffff800009e73c10
[    0.000000] x29: ffff800009e73c70 x28: 0000000000007fff x27: ffff800009cd0548
[    0.000000] x26: ffff800009e87300 x25: ffffffffffff8000 x24: ffff80000a342068
[    0.000000] x23: ffff000002805000 x22: 0000000000005000 x21: 0000000000000000
[    0.000000] x20: 0000000000000001 x19: 000000000000cfff x18: ffffffffffffffff
[    0.000000] x17: 0000000000000000 x16: 00000000000000e8 x15: 0000000000000004
[    0.000000] x14: ffff800009ecb080 x13: 0000000000001fff x12: 0000000000402dc2
[    0.000000] x11: 00000000000000c0 x10: 0000000000000000 x9 : 0000000000000001
[    0.000000] x8 : ffff800016085000 x7 : 0000000000000000 x6 : 0000000000000048
[    0.000000] x5 : 0000000000000000 x4 : ffff800009e73ba0 x3 : 0000000000000001
[    0.000000] x2 : 0000000000000cc0 x1 : ffff800009afb70e x0 : 0000000000000000
[    0.000000] Call trace:
[    0.000000]  alloc_vmap_area+0x7ec/0x7f8
[    0.000000]  __get_vm_area_node+0x100/0x184
[    0.000000]  __vmalloc_node_range+0x1d8/0x6a0
[    0.000000]  __vmalloc_node+0x54/0x64
[    0.000000]  init_IRQ+0x68/0xb0
[    0.000000]  start_kernel+0x1a4/0x3c4
[    0.000000]  __primary_switched+0xb4/0xbc
[    0.000000] Code: f000c380 911c3800 944043e8 d53cd048 (d4210000)
[    0.000000] ---[ end trace 0000000000000000 ]---
[    0.000000] Kernel panic - not syncing: Attempted to kill the idle task!
[    0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---
...

ARCH=arm reproduction steps:

$ curl -LSso .config https://github.com/archlinuxarm/PKGBUILDs/raw/master/core/linux-armv7/config

$ make -skj"$(nproc)" ARCH=arm LLVM=1 olddefconfig zImage
...

$ boot-qemu.py -a arm -k . -t 15s
...
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 6.4.0-rc2-ARCH+ (nathan@dev-arch.thelio-3990X) (ClangBuiltLinux clang version 17.0.0 (https://github.com/llvm/llvm-project 5ac240bbea14d4edd0c484f5f879cd0f26be59e3), ClangBuiltLinux LLD 17.0.0) #1 SMP PREEMPT Tue Jun  6 15:25:42 MST 2023
...
[    0.000000] ------------[ cut here ]------------
[    0.000000] kernel BUG at mm/vmalloc.c:1638!
[    0.000000] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
[    0.000000] Modules linked in:
[    0.000000] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-rc2-ARCH+ #1
[    0.000000] Hardware name: Generic DT based system
[    0.000000] PC is at alloc_vmap_area+0x9d0/0x9d8
[    0.000000] LR is at alloc_vmap_area+0x9cc/0x9d8
[    0.000000] pc : [<c0535e08>]    lr : [<c0535e04>]    psr: 200000d3
[    0.000000] sp : c1d01e80  ip : c2007b8c  fp : 00003fff
[    0.000000] r10: 00006fff  r9 : ffffc000  r8 : e0800000
[    0.000000] r7 : 00003000  r6 : 00004000  r5 : 00000000  r4 : c2007b68
[    0.000000] r3 : 00000000  r2 : 00000000  r1 : c18e0b0e  r0 : 19f2c000
[    0.000000] Flags: nzCv  IRQs off  FIQs off  Mode SVC_32  ISA ARM  Segment none
[    0.000000] Control: 10c5387d  Table: 4020406a  DAC: 00000051
[    0.000000] Register r0 information: non-paged memory
[    0.000000] Register r1 information: non-slab/vmalloc memory
[    0.000000] Register r2 information: NULL pointer
[    0.000000] Register r3 information: NULL pointer
[    0.000000] Register r4 information: slab vmap_area start c2007b68 pointer offset 0 size 36
[    0.000000] Register r5 information: NULL pointer
[    0.000000] Register r6 information: non-paged memory
[    0.000000] Register r7 information: non-paged memory
[    0.000000] Register r8 information: non-paged memory
[    0.000000] Register r9 information: non-paged memory
[    0.000000] Register r10 information: non-paged memory
[    0.000000] Register r11 information: non-paged memory
[    0.000000] Register r12 information: slab vmap_area start c2007b68 pointer offset 36 size 36
[    0.000000] Process swapper/0 (pid: 0, stack limit = 0x(ptrval))
[    0.000000] Stack: (0xc1d01e80 to 0xc1d02000)
[    0.000000] 1e80: 19f2c000 c2003a40 c1c1f9fc ffffffff 00000dc0 c2001180 00400dc0 c0557e58
[    0.000000] 1ea0: c1d01eb0 c20077a8 00000cc0 ff800000 c1d0fc00 e0800000 00000001 00002000
[    0.000000] 1ec0: 00000000 00000000 00003000 c2003a40 00004000 e0800000 00000022 ffffffff
[    0.000000] 1ee0: 00400dc0 c0535f30 ffffffff 00400dc0 00000000 ff800000 00400dc0 00002000
[    0.000000] 1f00: 00004000 00400dc0 e0800000 10c5387d 00000022 c0536728 ff800000 ffffffff
[    0.000000] 1f20: 00400dc0 c1b0411c 00000cc0 c05101bc 00000000 c0557e58 c1d01f48 00000004
[    0.000000] 1f40: 00000000 00000004 00000000 0000065f 00000000 c1b0411c c1d0b060 00400dc0
[    0.000000] 1f60: c1d0b2d4 10c5387d 00000000 c0536cc4 00400dc0 0000065f 00000000 ffffffff
[    0.000000] 1f80: c1b0411c 0000000f c1b0411c 00000000 c1c17000 c1b04200 c1b0411c c1b1da2c
[    0.000000] 1fa0: 00000000 c1d0b005 c1b011a0 0000ffff 48392000 414fc0f0 00000000 c1b0411c
[    0.000000] 1fc0: 00000000 c1b00900 ffffffff ffffffff 00000000 c1b00f24 00000000 c1bb6f64
[    0.000000] 1fe0: c1b00420 00000051 10c0387d ffffffff 00000000 00000000 00000000 00000000
[    0.000000]  alloc_vmap_area from __get_vm_area_node+0xe4/0x14c
[    0.000000]  __get_vm_area_node from __vmalloc_node_range+0xb0/0x600
[    0.000000]  __vmalloc_node_range from __vmalloc_node+0x4c/0x54
[    0.000000]  __vmalloc_node from init_irq_stacks+0x64/0xbc
[    0.000000]  init_irq_stacks from init_IRQ+0x8/0x88
[    0.000000]  init_IRQ from start_kernel+0x1d8/0x398
[    0.000000]  start_kernel from 0x0
[    0.000000] Code: e3000b0e e34c018e eb394fca ee1d0f90 (e7f001f2)
[    0.000000] ---[ end trace 0000000000000000 ]---
[    0.000000] Kernel panic - not syncing: Attempted to kill the idle task!
[    0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---
qemu-system-arm: terminating on signal 15 from pid 3452127 (timeout)

ERROR: QEMU timed out!

I have not figured out what is special about these configurations yet (if anything, the -next build is really broken for many in-tree configurations at the moment). I have not tried to see if older LLVM versions work or have the same issues either.

[nathanchance]

I forgot to note that I do not see this issue with GCC 13.1.0 from kernel.org.

[nathanchance]

This is not reproducible with LLVM 14.x but it is with LLVM 15.x and newer. My bisect landed on llvm/llvm-project@1f88d80.

1f88d804083a8a1b68df1e6677920e38ab2a6b40 is the first bad commit
commit 1f88d804083a8a1b68df1e6677920e38ab2a6b40
Author: Nikita Popov <npopov@redhat.com>
Date:   Fri Jun 3 11:42:07 2022 +0200

    [SCCP] Don't mark edges feasible when resolving undefs

    As branch on undef is immediate undefined behavior, there is no need
    to mark one of the edges as feasible. We can leave all the edges
    non-feasible. In IPSCCP, we can replace the branch with an unreachable
    terminator.

    Differential Revision: https://reviews.llvm.org/D126962

 llvm/lib/Transforms/Scalar/SCCP.cpp                |  14 ++-
 llvm/lib/Transforms/Utils/SCCPSolver.cpp           | 112 +++------------------
 .../bug52821-use-after-free.ll                     |   2 +-
 .../bug55000-read-uninitialized-value.ll           |   2 +-
 .../Transforms/SCCP/2004-12-10-UndefBranchBug.ll   |   9 +-
 .../Transforms/SCCP/2008-01-27-UndefCorrelate.ll   |  13 +--
 llvm/test/Transforms/SCCP/PR26044.ll               |  25 ++---
 llvm/test/Transforms/SCCP/indirectbr.ll            |   7 +-
 .../SCCP/ipsccp-branch-unresolved-undef.ll         |   4 +-
 llvm/test/Transforms/SCCP/return-zapped.ll         |  21 ++--
 .../Transforms/SCCP/switch-constantfold-crash.ll   |  73 +++-----------
 .../SCCP/switch-undef-constantfoldterminator.ll    |   4 +-
 12 files changed, 71 insertions(+), 215 deletions(-)
bisect found first bad commit

# bad: [809855b56f06dd7182685f88fbbc64111df9339a] Bump the trunk major version to 16
# good: [a2601c98873376bbbeff4b6eddf0f4d920535f8b] Bump the trunk major version to 15
git bisect start 'llvmorg-16-init' 'llvmorg-15-init'
# good: [787ee99d4fd9fd45c9546202e9b73b01ce28c49e] [flang] Allow for host association in ConvertTo(Object|Proc)Entity
git bisect good 787ee99d4fd9fd45c9546202e9b73b01ce28c49e
# good: [263f1b2f5df71c71397f5bb05c353f3d9d27522e] [PowerPC] Fix combine step for shufflevector.
git bisect good 263f1b2f5df71c71397f5bb05c353f3d9d27522e
# bad: [1023ddaf779015a991cc02d4e61fb29efb767327] [LLVM] Add the support for fmax and fmin in atomicrmw instruction
git bisect bad 1023ddaf779015a991cc02d4e61fb29efb767327
# bad: [186bea3750d6b349de0e71044d95e2a42e087b4c] [MSVC] Add initial support for MSVC pragma optimize
git bisect bad 186bea3750d6b349de0e71044d95e2a42e087b4c
# good: [ba3f2667b60cf730105dc6f3146e67b1b938a348] [DAG] Add MaskedVectorIsZero helper
git bisect good ba3f2667b60cf730105dc6f3146e67b1b938a348
# good: [706e89db97d3dea63dac1ee2c5a26cb2af9651a2] Fix interaction of pragma FENV_ACCESS with other pragmas
git bisect good 706e89db97d3dea63dac1ee2c5a26cb2af9651a2
# bad: [ab89c132b547951945788fc2a0969cf64b0df4cd] [flang] Add lowering TODO for separate module procedures
git bisect bad ab89c132b547951945788fc2a0969cf64b0df4cd
# bad: [89a1d03e2b379e325daa5249411e414bbd995b5e] [clang-tidy] Organize test files into subdirectories by module (NFC)
git bisect bad 89a1d03e2b379e325daa5249411e414bbd995b5e
# bad: [3c867898c7be7ed2b5d119a2478a836a0c85f19b] [lldb] Add setting to override PE/COFF ABI by module name
git bisect bad 3c867898c7be7ed2b5d119a2478a836a0c85f19b
# bad: [8958e70ccbe9c12b2d0b622b8b5623a8f47bb183] [NVPTX] Keep metadata attached to module-scope variables
git bisect bad 8958e70ccbe9c12b2d0b622b8b5623a8f47bb183
# bad: [563cf93776e7100aabe6d91afdcd7e7405ee7338] [ADCE] Update tests to use opaque pointers (NFC)
git bisect bad 563cf93776e7100aabe6d91afdcd7e7405ee7338
# bad: [aa0a413df819f80dbb22ee382dffeaad2e5caa55] [AArch64][SME] Add some SME PSTATE setting/query intrinsics
git bisect bad aa0a413df819f80dbb22ee382dffeaad2e5caa55
# bad: [1f88d804083a8a1b68df1e6677920e38ab2a6b40] [SCCP] Don't mark edges feasible when resolving undefs
git bisect bad 1f88d804083a8a1b68df1e6677920e38ab2a6b40
# good: [74f066016096c60e0cee07f0af8de193ecb2f6c3] [mlir][Transform] NFC - Pass TransformState as an argument to applyToOne methods
git bisect good 74f066016096c60e0cee07f0af8de193ecb2f6c3
# first bad commit: [1f88d804083a8a1b68df1e6677920e38ab2a6b40] [SCCP] Don't mark edges feasible when resolving undefs

[nickdesaulniers]

As branch on undef is immediate undefined behavior

That's right, and makes me wonder if there is UB in this config where that commit to LLVM changed the control flow to expose this. Perhaps a boot with CONFIG_UBSAN=y might highlight where such a branch is (if any)?

I'm bisecting configs now to see if anything in particular exposes this on top of defconfig.

[nathanchance]

Unfortunately, CONFIG_UBSAN and its defaults reveal nothing interesting :/

$ rg UBSAN .config
11383:CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y
11384:CONFIG_UBSAN=y
11385:# CONFIG_UBSAN_TRAP is not set
11386:CONFIG_CC_HAS_UBSAN_ARRAY_BOUNDS=y
11387:CONFIG_UBSAN_BOUNDS=y
11388:CONFIG_UBSAN_ARRAY_BOUNDS=y
11389:CONFIG_UBSAN_SHIFT=y
11390:# CONFIG_UBSAN_UNREACHABLE is not set
11391:CONFIG_UBSAN_BOOL=y
11392:CONFIG_UBSAN_ENUM=y
11393:# CONFIG_UBSAN_ALIGNMENT is not set
11394:CONFIG_UBSAN_SANITIZE_ALL=y
11395:# CONFIG_TEST_UBSAN is not set

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x000f0510]
[    0.000000] Linux version 6.4.0-rc5-next-20230607-ARCH (nathan@dev-arch.thelio-3990X) (ClangBuiltLinux clang version 17.0.0 (https://github.com/llvm/llvm-project aeca4252e000ca45788f8d1c8cf05ea7316a4420), ClangBuiltLinux LLD 17.0.0) #1 SMP PREEMPT_DYNAMIC Wed Jun  7 10:00:40 MST 2023
[    0.000000] random: crng init done
[    0.000000] Machine model: linux,dummy-virt
[    0.000000] efi: UEFI not found.
[    0.000000] earlycon: pl11 at MMIO 0x0000000009000000 (options '')
[    0.000000] printk: bootconsole [pl11] enabled
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] cma: Reserved 64 MiB at 0x000000005b600000
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: Trusted OS migration not required
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] percpu: Embedded 22 pages/cpu s51752 r8192 d30168 u90112
[    0.000000] Detected PIPT I-cache on CPU0
[    0.000000] CPU features: detected: Branch Target Identification
[    0.000000] CPU features: detected: Address authentication (IMP DEF algorithm)
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: detected: HCRX_EL2 register
[    0.000000] CPU features: detected: Virtualization Host Extensions
[    0.000000] CPU features: detected: Hardware dirty bit management
[    0.000000] CPU features: detected: Spectre-v4
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: console=ttyAMA0 earlycon
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 129024
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 404148K/524288K available (20480K kernel code, 5226K rwdata, 10600K rodata, 1728K init, 980K bss, 54604K reserved, 65536K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] Dynamic Preempt: full
[    0.000000] rcu: Preemptible hierarchical RCU implementation.
[    0.000000] rcu: 	RCU restricting CPUs from NR_CPUS=64 to nr_cpu_ids=1.
[    0.000000] 	Trampoline variant of Tasks RCU enabled.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 100 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=1
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] ------------[ cut here ]------------
[    0.000000] kernel BUG at mm/vmalloc.c:1638!
[    0.000000] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
[    0.000000] Modules linked in:
[    0.000000] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-rc5-next-20230607-ARCH #1
[    0.000000] Hardware name: linux,dummy-virt (DT)
[    0.000000] pstate: 200000c9 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    0.000000] pc : alloc_vmap_area+0x7ec/0x7f8
[    0.000000] lr : alloc_vmap_area+0x7e8/0x7f8
[    0.000000] sp : ffff800082033bf0
[    0.000000] x29: ffff800082033c50 x28: 0000000000007fff x27: ffff800081e80574
[    0.000000] x26: ffff800082047500 x25: ffffffffffff8000 x24: ffff8000825a8850
[    0.000000] x23: ffff000002c059d8 x22: 0000000000005000 x21: 0000000000000000
[    0.000000] x20: 0000000000000001 x19: 000000000000cfff x18: ffff800082145fe0
[    0.000000] x17: 000000000000000a x16: ffff8000820968f8 x15: ffff800082095878
[    0.000000] x14: ffff800082033b90 x13: 0000000000000000 x12: 0000000000402dc2
[    0.000000] x11: ffff800081c680be x10: 0000000000000000 x9 : 0000000000000001
[    0.000000] x8 : ffff7fff9ded5000 x7 : 0000000000000000 x6 : 0000000000000048
[    0.000000] x5 : 0000000000000000 x4 : ffff800082033b80 x3 : 0000000000000001
[    0.000000] x2 : 0000000000000cc0 x1 : ffff800081c9a48b x0 : 0000000000000000
[    0.000000] Call trace:
[    0.000000]  alloc_vmap_area+0x7ec/0x7f8
[    0.000000]  __get_vm_area_node+0x108/0x1a4
[    0.000000]  __vmalloc_node_range+0x1d0/0x6c4
[    0.000000]  __vmalloc_node+0x54/0x9c
[    0.000000]  init_IRQ+0x68/0xb0
[    0.000000]  start_kernel+0x1b4/0x3e4
[    0.000000]  __primary_switched+0xb4/0xbc
[    0.000000] Code: b000cf20 91122c00 9444be02 d53cd048 (d4210000) 
[    0.000000] ---[ end trace 0000000000000000 ]---
[    0.000000] Kernel panic - not syncing: Attempted to kill the idle task!
[    0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---

[nickdesaulniers]

Difference between good (+) and bad (-)
 INIT_STACK_ALL_ZERO y -> n
 INIT_STACK_NONE n -> y

so Arch's config doesn't set CONFIG_INIT_STACK_ALL_ZERO and instead has CONFIG_INIT_STACK_NONE=y. Based on the highlighted llvm change, I highly suspect there's a branch on uninitialized stack memory somewhere.

In IPSCCP, we can replace the branch with an unreachable
terminator.

11390:# CONFIG_UBSAN_UNREACHABLE is not set

Turning on CONFIG_UBSAN_UNREACHABLE=y causes the machine to inf loop (I think?)...

[nickdesaulniers]

The static analyzer is producing an instance of clang-analyzer-core.uninitialized.Assign that looks relevant here.

I first did make -j"$(nproc)" ARCH=arm64 LLVM=1 clang-analyzer &> log.txt to dump all warnings to a log file. Then I grepped for vmalloc.c in log.txt. clang-analyzer-core.uninitialized.Assign generally are pretty interesting, so seeing warnings on mm/vmalloc.c:1575 and mm/vmalloc.c:1570 looked interesting. I cut down the generated compile_commands.json file to just have the entry for building mm/vmalloc.o, then added -fmacro-backtrace-limit=0 to the "command" entry in compile_commands.json (seems to do nothing though...so I hacked DefaultMacroBacktraceLimit in clang/include/clang/Basic/DiagnosticOptions.h and rebuilt clang-tidy), then ran clang-tidy -p compile_commands.json mm/vmalloc.c -checks=clang-analyzer-core.uninitialized.Assign, which produced this wall of text to decipher. https://gist.github.com/nickdesaulniers/d272827f15721d18b156bdc294dd158e , this trace looked relevant again because raw_cpu_generic_try_cmpxchg is mentioned in the trace, and was modified by https://git.kernel.org/tip/c5c0ba953b8c969c5d51bf1c57f239866a97c47c. Clang-tidy seems not happy starting from this statement: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/mm/vmalloc.c?h=next-20230606#n1575.

If I add a BUILD_BUG_ON to raw_cpu_generic_try_cmpxchg, I get a build failure.

diff --git a/include/asm-generic/percpu.h b/include/asm-generic/percpu.h
index 68c410e85cd7..e9ecc973c9d5 100644
--- a/include/asm-generic/percpu.h
+++ b/include/asm-generic/percpu.h
@@ -101,6 +101,7 @@ do {									\
 #define raw_cpu_generic_try_cmpxchg(pcp, ovalp, nval)			\
 ({									\
 	typeof(pcp) *__p = raw_cpu_ptr(&(pcp));				\
+	BUILD_BUG_ON(__p == NULL);	\
 	typeof(pcp) __val = *__p, __old = *(ovalp);			\
 	bool __ret;							\
 	if (__val == __old) {						\

mm/vmalloc.c:1575:12: error: call to '__compiletime_assert_485' declared with 'error' attribute: BUILD_BUG_ON failed: __p == NULL

But if I add that same build bug on at 6db29e1 (the commit immediately before c5c0ba9, I trigger it as well... has this code had UB for a long time?

[nickdesaulniers]

If it's expected that raw_cpu_ptr may return NULL, then this is the diff I'd recommend:

diff --git a/include/asm-generic/percpu.h b/include/asm-generic/percpu.h
index 68c410e85cd7..6a38aef08585 100644
--- a/include/asm-generic/percpu.h
+++ b/include/asm-generic/percpu.h
@@ -101,13 +101,18 @@ do {									\
 #define raw_cpu_generic_try_cmpxchg(pcp, ovalp, nval)			\
 ({									\
 	typeof(pcp) *__p = raw_cpu_ptr(&(pcp));				\
-	typeof(pcp) __val = *__p, __old = *(ovalp);			\
+	typeof(pcp) __old = *(ovalp);					\
 	bool __ret;							\
-	if (__val == __old) {						\
-		*__p = nval;						\
-		__ret = true;						\
+	if (__p) {							\
+		if (*__p == __old) {					\
+			*__p = nval;					\
+			__ret = true;					\
+		} else {						\
+			*(ovalp) = *__p;				\
+			__ret = false;					\
+		}							\
 	} else {							\
-		*(ovalp) = __val;					\
+		*(ovalp) = NULL;					\
 		__ret = false;						\
 	}								\
 	__ret;								\

if not, then something else needs to be fixed and probably my BUILD_BUG_ON added.

EDIT: nathan pointed out on IRC that there's an insidious -Wshadow going on with these macros, observable when building with W=2.

[nathanchance]

Patch submitted: https://lore.kernel.org/20230607-fix-shadowing-in-raw_cpu_generic_try_cmpxchg-v1-1-8f0a3d930d43@kernel.org/