Greeting, FYI, we noticed the following commit (built with gcc-9): commit: 489b8e8c9ac06aa59ba1a364802c19addbb04e49 ("mm/mlock: Use vma iterator and instead of vma linked list") https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master in testcase: trinity version: trinity-i386-4d2343bd-1_20200320 with following parameters: runtime: 300s group: group-01 test-description: Trinity is a linux system call fuzz tester. test-url: http://codemonkey.org.uk/projects/trinity/ on test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 4G caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace): If you fix the issue, kindly add following tag Reported-by: kernel test robot <oliver.sang(a)intel.com&gt; [ 42.001218][ T3974] BUG: kernel NULL pointer dereference, address: 00000000 [ 42.006507][ T3974] #PF: supervisor read access in kernel mode [ 42.010965][ T3974] #PF: error_code(0x0000) - not-present page [ 42.016000][ T3974] *pdpt = 0000000034ebc001 *pde = 0000000000000000 [ 42.020836][ T3974] Oops: 0000 [#1] SMP PTI [ 42.024572][ T3974] CPU: 1 PID: 3974 Comm: trinity-c5 Tainted: G E 5.17.0-rc4-00060-g489b8e8c9ac0 #1 [ 42.030056][ T3974] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 42.035333][ T3974] EIP: mas_ascend (lib/maple_tree.c:339 lib/maple_tree.c:1081) [ 42.039331][ T3974] Code: 7d f0 0f b6 4d f0 83 e1 01 80 f9 01 19 c9 83 e1 f8 83 c1 18 09 c8 89 c3 30 db b9 03 00 00 00 d3 ea 83 c8 04 88 56 1d 89 46 0c <8b> 1b 89 d8 83 e0 01 88 45 eb 0f 85 f1 00 00 00 89 da c6 45 f0 00 All code ======== 0: 7d f0 jge 0xfffffffffffffff2 2: 0f b6 4d f0 movzbl -0x10(%rbp),%ecx 6: 83 e1 01 and $0x1,%ecx 9: 80 f9 01 cmp $0x1,%cl c: 19 c9 sbb %ecx,%ecx e: 83 e1 f8 and $0xfffffff8,%ecx 11: 83 c1 18 add $0x18,%ecx 14: 09 c8 or %ecx,%eax 16: 89 c3 mov %eax,%ebx 18: 30 db xor %bl,%bl 1a: b9 03 00 00 00 mov $0x3,%ecx 1f: d3 ea shr %cl,%edx 21: 83 c8 04 or $0x4,%eax 24: 88 56 1d mov %dl,0x1d(%rsi) 27: 89 46 0c mov %eax,0xc(%rsi) 2a:* 8b 1b mov (%rbx),%ebx <-- trapping instruction 2c: 89 d8 mov %ebx,%eax 2e: 83 e0 01 and $0x1,%eax 31: 88 45 eb mov %al,-0x15(%rbp) 34: 0f 85 f1 00 00 00 jne 0x12b 3a: 89 da mov %ebx,%edx 3c: c6 45 f0 00 movb $0x0,-0x10(%rbp) Code starting with the faulting instruction =========================================== 0: 8b 1b mov (%rbx),%ebx 2: 89 d8 mov %ebx,%eax 4: 83 e0 01 and $0x1,%eax 7: 88 45 eb mov %al,-0x15(%rbp) a: 0f 85 f1 00 00 00 jne 0x101 10: 89 da mov %ebx,%edx 12: c6 45 f0 00 movb $0x0,-0x10(%rbp) [ 42.050537][ T3974] EAX: 00000004 EBX: 00000000 ECX: 00000002 EDX: 00000000 [ 42.055562][ T3974] ESI: f4e7bf48 EDI: f557cb44 EBP: f4e7bebc ESP: f4e7be90 [ 42.060657][ T3974] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 EFLAGS: 00010202 [ 42.065813][ T3974] CR0: 80050033 CR2: 00000000 CR3: 34624000 CR4: 000006f0 [ 42.071013][ T3974] Call Trace: [ 42.075378][ T3974] ? __cond_resched (kernel/sched/core.c:8192) [ 42.080080][ T3974] ? munlock_vma_pages_range (mm/mlock.c:427) [ 42.085038][ T3974] mas_next_node (lib/maple_tree.c:4462) [ 42.089827][ T3974] mas_find (lib/maple_tree.c:4726 lib/maple_tree.c:5906) [ 42.094269][ T3974] apply_mlockall_flags (mm/mlock.c:764) [ 42.098791][ T3974] __do_sys_munlockall (mm/mlock.c:813) [ 42.103039][ T3974] __do_fast_syscall_32 (arch/x86/entry/common.c:112 arch/x86/entry/common.c:178) [ 42.107533][ T3974] do_fast_syscall_32 (arch/x86/entry/common.c:203) [ 42.111680][ T3974] do_SYSENTER_32 (arch/x86/entry/common.c:247) [ 42.115815][ T3974] entry_SYSENTER_32 (arch/x86/entry/entry_32.S:869) [ 42.119950][ T3974] EIP: 0xb7ee1589 [ 42.123768][ T3974] Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d 76 00 58 b8 77 00 00 00 cd 80 90 8d 76 All code ======== ... 20: 00 51 52 add %dl,0x52(%rcx) 23: 55 push %rbp 24: 89 e5 mov %esp,%ebp 26: 0f 34 sysenter 28: cd 80 int $0x80 2a:* 5d pop %rbp <-- trapping instruction 2b: 5a pop %rdx 2c: 59 pop %rcx 2d: c3 retq 2e: 90 nop 2f: 90 nop 30: 90 nop 31: 90 nop 32: 8d 76 00 lea 0x0(%rsi),%esi 35: 58 pop %rax 36: b8 77 00 00 00 mov $0x77,%eax 3b: cd 80 int $0x80 3d: 90 nop 3e: 8d .byte 0x8d 3f: 76 .byte 0x76 Code starting with the faulting instruction =========================================== 0: 5d pop %rbp 1: 5a pop %rdx 2: 59 pop %rcx 3: c3 retq 4: 90 nop 5: 90 nop 6: 90 nop 7: 90 nop 8: 8d 76 00 lea 0x0(%rsi),%esi b: 58 pop %rax c: b8 77 00 00 00 mov $0x77,%eax 11: cd 80 int $0x80 13: 90 nop 14: 8d .byte 0x8d 15: 76 .byte 0x76 [ 42.134309][ T3974] EAX: ffffffda EBX: 00527000 ECX: 00002000 EDX: 00000000 [ 42.139323][ T3974] ESI: 00000000 EDI: 00001000 EBP: 02a66140 ESP: bfeed5ac [ 42.144232][ T3974] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b EFLAGS: 00000292 [ 42.149147][ T3974] Modules linked in: vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vmw_vsock_vmci_transport(E) vsock(E) vmw_vmci(E) mpls_router(E) ip_tunnel(E) af_key(E) af_alg(E) fcrypt(E) pcbc(E) rxrpc(E) crypto_user(E) scsi_transport_iscsi(E) xfrm_user(E) xfrm_algo(E) llc2(E) llc(E) sctp(E) ip6_udp_tunnel(E) udp_tunnel(E) libcrc32c(E) crc32c_generic(E) intel_rapl_msr(E) bochs(E) ata_generic(E) drm_vram_helper(E) drm_ttm_helper(E) intel_rapl_common(E) crc32c_intel(E) ppdev(E) rapl(E) ttm(E) drm_kms_helper(E) syscopyarea(E) sysfillrect(E) sysimgblt(E) fb_sys_fops(E) ata_piix(E) cec(E) evdev(E) psmouse(E) serio_raw(E) drm(E) libata(E) i2c_piix4(E) parport_pc(E) floppy(E) parport(E) qemu_fw_cfg(E) button(E) autofs4(E) [ 42.179534][ T3974] CR2: 0000000000000000 [ 42.183599][ T3974] ---[ end trace 0000000000000000 ]--- [ 42.187926][ T3974] EIP: mas_ascend (lib/maple_tree.c:339 lib/maple_tree.c:1081) [ 42.191922][ T3974] Code: 7d f0 0f b6 4d f0 83 e1 01 80 f9 01 19 c9 83 e1 f8 83 c1 18 09 c8 89 c3 30 db b9 03 00 00 00 d3 ea 83 c8 04 88 56 1d 89 46 0c <8b> 1b 89 d8 83 e0 01 88 45 eb 0f 85 f1 00 00 00 89 da c6 45 f0 00 All code ======== 0: 7d f0 jge 0xfffffffffffffff2 2: 0f b6 4d f0 movzbl -0x10(%rbp),%ecx 6: 83 e1 01 and $0x1,%ecx 9: 80 f9 01 cmp $0x1,%cl c: 19 c9 sbb %ecx,%ecx e: 83 e1 f8 and $0xfffffff8,%ecx 11: 83 c1 18 add $0x18,%ecx 14: 09 c8 or %ecx,%eax 16: 89 c3 mov %eax,%ebx 18: 30 db xor %bl,%bl 1a: b9 03 00 00 00 mov $0x3,%ecx 1f: d3 ea shr %cl,%edx 21: 83 c8 04 or $0x4,%eax 24: 88 56 1d mov %dl,0x1d(%rsi) 27: 89 46 0c mov %eax,0xc(%rsi) 2a:* 8b 1b mov (%rbx),%ebx <-- trapping instruction 2c: 89 d8 mov %ebx,%eax 2e: 83 e0 01 and $0x1,%eax 31: 88 45 eb mov %al,-0x15(%rbp) 34: 0f 85 f1 00 00 00 jne 0x12b 3a: 89 da mov %ebx,%edx 3c: c6 45 f0 00 movb $0x0,-0x10(%rbp) Code starting with the faulting instruction =========================================== 0: 8b 1b mov (%rbx),%ebx 2: 89 d8 mov %ebx,%eax 4: 83 e0 01 and $0x1,%eax 7: 88 45 eb mov %al,-0x15(%rbp) a: 0f 85 f1 00 00 00 jne 0x101 10: 89 da mov %ebx,%edx 12: c6 45 f0 00 movb $0x0,-0x10(%rbp) To reproduce: # build kernel cd linux cp config-5.17.0-rc4-00060-g489b8e8c9ac0 .config make HOSTCC=gcc-9 CC=gcc-9 ARCH=i386 olddefconfig prepare modules_prepare bzImage modules make HOSTCC=gcc-9 CC=gcc-9 ARCH=i386 INSTALL_MOD_PATH=<mod-install-dir> modules_install cd <mod-install-dir> find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz git clone https://github.com/intel/lkp-tests.git cd lkp-tests bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email # if come across any failure that blocks the test, # please remove ~/.lkp and /lkp dir to run from a clean state. --- 0DAY/LKP+ Test Infrastructure Open Source Technology Center https://lists.01.org/hyperkitty/list/lkp@lists.01.org Intel Corporation Thanks, Oliver Sang