Greeting, FYI, we noticed the following commit (built with clang-13): commit: 6966bb921def0a4ef1e069f806c086efae6782ea ("mtd_blkdevs: use blk_mq_alloc_disk") https://git.kernel.org/cgit/linux/kernel/git/axboe/linux-block.git for-5.14/block in testcase: trinity version: trinity-x86_64-03f10b67-1_20210616 with following parameters: number: 99999 group: group-01 test-description: Trinity is a linux system call fuzz tester. test-url: http://codemonkey.org.uk/projects/trinity/ on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace): +-----------------------------------------------------------+------------+------------+ | | 51ed5bd55e | 6966bb921d | +-----------------------------------------------------------+------------+------------+ | boot_successes | 21 | 0 | | BUG:KASAN:null-ptr-deref_in_blk_queue_flag_set | 0 | 61 | | BUG:kernel_NULL_pointer_dereference,address | 0 | 61 | | RIP:blk_queue_flag_set | 0 | 61 | +-----------------------------------------------------------+------------+------------+ If you fix the issue, kindly add following tag Reported-by: kernel test robot <oliver.sang(a)intel.com&gt; [ 30.271915] BUG: KASAN: null-ptr-deref in blk_queue_flag_set (kbuild/src/consumer/block/blk-core.c:83) [ 30.272645] Write of size 8 at addr 0000000000000068 by task swapper/0/1 [ 30.273447] [ 30.273649] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc3-00061-g6966bb921def #1 [ 30.274670] Call Trace: [ 30.274984] dump_stack (kbuild/src/consumer/include/linux/instrumented.h:86 kbuild/src/consumer/include/asm-generic/atomic-instrumented.h:45 kbuild/src/consumer/lib/dump_stack.c:123) [ 30.275413] ? blk_queue_flag_set (kbuild/src/consumer/block/blk-core.c:83) [ 30.275929] kasan_report (kbuild/src/consumer/mm/kasan/report.c:423 kbuild/src/consumer/mm/kasan/report.c:436) [ 30.275973] ? blk_queue_flag_set (kbuild/src/consumer/block/blk-core.c:83) [ 30.275973] kasan_check_range (kbuild/src/consumer/mm/kasan/generic.c:135 kbuild/src/consumer/mm/kasan/generic.c:186) [ 30.275973] blk_queue_flag_set (kbuild/src/consumer/block/blk-core.c:83) [ 30.275973] blk_queue_write_cache (kbuild/src/consumer/block/blk-settings.c:795) [ 30.275973] add_mtd_blktrans_dev (kbuild/src/consumer/drivers/mtd/mtd_blkdevs.c:411) [ 30.275973] mtdblock_add_mtd (kbuild/src/consumer/drivers/mtd/mtdblock.c:325) [ 30.275973] blktrans_notify_add (kbuild/src/consumer/drivers/mtd/mtd_blkdevs.c:508) [ 30.275973] add_mtd_device (kbuild/src/consumer/drivers/mtd/mtdcore.c:688) [ 30.275973] ? mtd_cls_resume (kbuild/src/consumer/drivers/mtd/mtdcore.c:520) [ 30.275973] mtd_device_parse_register (kbuild/src/consumer/drivers/mtd/mtdcore.c:818) [ 30.275973] mtdram_init_device (kbuild/src/consumer/drivers/mtd/devices/mtdram.c:146) [ 30.275973] init_mtdram (kbuild/src/consumer/drivers/mtd/devices/mtdram.c:172) [ 30.275973] do_one_initcall (kbuild/src/consumer/init/main.c:1249) [ 30.275973] ? init_phram (kbuild/src/consumer/drivers/mtd/devices/mtdram.c:153) [ 30.275973] do_initcall_level (kbuild/src/consumer/init/main.c:1321) [ 30.275973] ? kernel_init (kbuild/src/consumer/init/main.c:1449) [ 30.275973] do_initcalls (kbuild/src/consumer/init/main.c:1335) [ 30.275973] kernel_init_freeable (kbuild/src/consumer/init/main.c:1564) [ 30.275973] ? rest_init (kbuild/src/consumer/init/main.c:1444) [ 30.275973] kernel_init (kbuild/src/consumer/init/main.c:1449) [ 30.275973] ? rest_init (kbuild/src/consumer/init/main.c:1444) [ 30.275973] ret_from_fork (kbuild/src/consumer/arch/x86/entry/entry_64.S:300) [ 30.275973] ================================================================== [ 30.275973] Disabling lock debugging due to kernel taint [ 30.288063] BUG: kernel NULL pointer dereference, address: 0000000000000068 [ 30.288891] #PF: supervisor write access in kernel mode [ 30.289475] #PF: error_code(0x0002) - not-present page [ 30.290056] PGD 0 P4D 0 [ 30.290367] Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 30.290894] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G B 5.13.0-rc3-00061-g6966bb921def #1 [ 30.291980] RIP: 0010:blk_queue_flag_set (kbuild/src/consumer/arch/x86/include/asm/bitops.h:60 kbuild/src/consumer/include/asm-generic/bitops/instrumented-atomic.h:29 kbuild/src/consumer/block/blk-core.c:83) [ 30.292537] Code: 00 00 00 00 66 0f 1f 44 00 00 55 53 48 89 f3 89 fd 89 f8 c1 e8 06 48 8d 3c c6 48 83 c7 68 be 08 00 00 00 e8 c2 13 02 ff 89 e8 <f0> 48 0f ab 43 68 5b 5d c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 All code ======== 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1) a: 55 push %rbp b: 53 push %rbx c: 48 89 f3 mov %rsi,%rbx f: 89 fd mov %edi,%ebp 11: 89 f8 mov %edi,%eax 13: c1 e8 06 shr $0x6,%eax 16: 48 8d 3c c6 lea (%rsi,%rax,8),%rdi 1a: 48 83 c7 68 add $0x68,%rdi 1e: be 08 00 00 00 mov $0x8,%esi 23: e8 c2 13 02 ff callq 0xffffffffff0213ea 28: 89 e8 mov %ebp,%eax 2a:* f0 48 0f ab 43 68 lock bts %rax,0x68(%rbx) <-- trapping instruction 30: 5b pop %rbx 31: 5d pop %rbp 32: c3 retq 33: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1) 3a: 00 00 00 00 3e: 66 data16 3f: 66 data16 Code starting with the faulting instruction =========================================== 0: f0 48 0f ab 43 68 lock bts %rax,0x68(%rbx) 6: 5b pop %rbx 7: 5d pop %rbp 8: c3 retq 9: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1) 10: 00 00 00 00 14: 66 data16 15: 66 data16 [ 30.294477] RSP: 0000:ffff8881001f7a38 EFLAGS: 00010246 [ 30.295091] RAX: 0000000000000011 RBX: 0000000000000000 RCX: ffffffff957262bf [ 30.295903] RDX: aaaaaaaaaaaaaaaa RSI: 0000000000000004 RDI: ffffffff99a4cead [ 30.296511] RBP: 0000000000000011 R08: dffffc0000000000 R09: fffffbfff38883de [ 30.297177] R10: fffffbfff38883de R11: 1ffffffff38883dd R12: ffff88816e57e800 [ 30.297667] R13: 1ffff1102dcafd18 R14: 1ffffffff37bc9b6 R15: ffffffff9bde4db0 [ 30.297974] FS: 0000000000000000(0000) GS:ffff8883ae600000(0000) knlGS:0000000000000000 [ 30.297974] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 30.297974] CR2: 0000000000000068 CR3: 000000009e09c000 CR4: 00000000000406f0 [ 30.297974] Call Trace: [ 30.297974] blk_queue_write_cache (kbuild/src/consumer/block/blk-settings.c:795) [ 30.297974] add_mtd_blktrans_dev (kbuild/src/consumer/drivers/mtd/mtd_blkdevs.c:411) [ 30.297974] mtdblock_add_mtd (kbuild/src/consumer/drivers/mtd/mtdblock.c:325) [ 30.297974] blktrans_notify_add (kbuild/src/consumer/drivers/mtd/mtd_blkdevs.c:508) [ 30.297974] add_mtd_device (kbuild/src/consumer/drivers/mtd/mtdcore.c:688) [ 30.297974] ? mtd_cls_resume (kbuild/src/consumer/drivers/mtd/mtdcore.c:520) [ 30.297974] mtd_device_parse_register (kbuild/src/consumer/drivers/mtd/mtdcore.c:818) [ 30.297974] mtdram_init_device (kbuild/src/consumer/drivers/mtd/devices/mtdram.c:146) [ 30.297974] init_mtdram (kbuild/src/consumer/drivers/mtd/devices/mtdram.c:172) [ 30.297974] do_one_initcall (kbuild/src/consumer/init/main.c:1249) [ 30.297974] ? init_phram (kbuild/src/consumer/drivers/mtd/devices/mtdram.c:153) [ 30.297974] do_initcall_level (kbuild/src/consumer/init/main.c:1321) [ 30.297974] ? kernel_init (kbuild/src/consumer/init/main.c:1449) [ 30.297974] do_initcalls (kbuild/src/consumer/init/main.c:1335) [ 30.297974] kernel_init_freeable (kbuild/src/consumer/init/main.c:1564) [ 30.297974] ? rest_init (kbuild/src/consumer/init/main.c:1444) [ 30.297974] kernel_init (kbuild/src/consumer/init/main.c:1449) [ 30.297974] ? rest_init (kbuild/src/consumer/init/main.c:1444) [ 30.297974] ret_from_fork (kbuild/src/consumer/arch/x86/entry/entry_64.S:300) [ 30.297974] Modules linked in: [ 30.297974] CR2: 0000000000000068 [ 30.297974] ---[ end trace 44cc99e211d747b3 ]--- [ 30.297974] RIP: 0010:blk_queue_flag_set (kbuild/src/consumer/arch/x86/include/asm/bitops.h:60 kbuild/src/consumer/include/asm-generic/bitops/instrumented-atomic.h:29 kbuild/src/consumer/block/blk-core.c:83) [ 30.297974] Code: 00 00 00 00 66 0f 1f 44 00 00 55 53 48 89 f3 89 fd 89 f8 c1 e8 06 48 8d 3c c6 48 83 c7 68 be 08 00 00 00 e8 c2 13 02 ff 89 e8 <f0> 48 0f ab 43 68 5b 5d c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 All code ======== 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1) a: 55 push %rbp b: 53 push %rbx c: 48 89 f3 mov %rsi,%rbx f: 89 fd mov %edi,%ebp 11: 89 f8 mov %edi,%eax 13: c1 e8 06 shr $0x6,%eax 16: 48 8d 3c c6 lea (%rsi,%rax,8),%rdi 1a: 48 83 c7 68 add $0x68,%rdi 1e: be 08 00 00 00 mov $0x8,%esi 23: e8 c2 13 02 ff callq 0xffffffffff0213ea 28: 89 e8 mov %ebp,%eax 2a:* f0 48 0f ab 43 68 lock bts %rax,0x68(%rbx) <-- trapping instruction 30: 5b pop %rbx 31: 5d pop %rbp 32: c3 retq 33: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1) 3a: 00 00 00 00 3e: 66 data16 3f: 66 data16 Code starting with the faulting instruction =========================================== 0: f0 48 0f ab 43 68 lock bts %rax,0x68(%rbx) 6: 5b pop %rbx 7: 5d pop %rbp 8: c3 retq 9: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1) 10: 00 00 00 00 14: 66 data16 15: 66 data16 To reproduce: # build kernel cd linux cp config-5.13.0-rc3-00061-g6966bb921def .config make HOSTCC=clang-13 CC=clang-13 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage git clone https://github.com/intel/lkp-tests.git cd lkp-tests bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email --- 0DAY/LKP+ Test Infrastructure Open Source Technology Center https://lists.01.org/hyperkitty/list/lkp@lists.01.org Intel Corporation Thanks, Oliver Sang