Re: [bug report] BUG: kernel NULL pointer dereference, address: 0000000000000048

[Yu Kuai <yukuai1@huaweicloud.com>]

Hi,

在 2023/05/10 9:29, Yu Kuai 写道:
> Hi,
> 
> 在 2023/05/10 8:49, Guangwu Zhang 写道:
>> Hi,
>>
>> We found this kernel NULL pointer issue with latest
>> linux-block/for-next, please check it.
>>
>> Kernel repo: 
>> https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git
>>
>>
>> [  112.483804] BUG: kernel NULL pointer dereference, address: 
>> 0000000000000048

Base on this offset, 0x48 match bio->bi_blkg, so I guess this is because
bio is NULL, so the problem is that passthrough request insert into
elevator.

Can you try follwing patch?

diff --git a/block/blk-mq.c b/block/blk-mq.c
index f6dad0886a2f..fe3ed0a647e6 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2731,7 +2731,7 @@ static void blk_mq_dispatch_plug_list(struct 
blk_plug *plug, bool from_sched)
         trace_block_unplug(this_hctx->queue, depth, !from_sched);

         percpu_ref_get(&this_hctx->queue->q_usage_counter);
-       if (this_hctx->queue->elevator) {
+       if (this_hctx->queue->elevator && !blk_rq_is_passthrough(rq)) {
 
this_hctx->queue->elevator->type->ops.insert_requests(this_hctx,
                                 &list, 0);
                 blk_mq_run_hw_queue(this_hctx, from_sched);

Thanks,
Kuai
>> [  112.490809] #PF: supervisor read access in kernel mode
>> [  112.495976] #PF: error_code(0x0000) - not-present page
>> [  112.501141] PGD 800000044d20c067 P4D 800000044d20c067 PUD 4734d5067 
>> PMD 0
>> [  112.508057] Oops: 0000 [#1] PREEMPT SMP PTI
>> [  112.512265] CPU: 24 PID: 7767 Comm: user-data Kdump: loaded Not
>> tainted 6.4.0-rc1+ #1
>> [  112.520141] Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380
>> Gen10, BIOS U30 06/20/2018
>> [  112.528713] RIP: 0010:bfq_bio_bfqg+0x8/0x80
> 
> Can you show more details about addr2line result? It'll be much helpful.
> 
> Thanks,
> Kuai
>> [  112.532925] Code: 6b 70 48 89 43 60 5b 5d c3 cc cc cc cc 0f 1f 44
>> 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00
>> 41 54 53 <48> 8b 46 48 48 89 fb 48 89 f7 48 85 c0 74 26 48 63 15 72 40
>> 6b 01
>> [  112.551805] RSP: 0018:ffffaed687ef3b30 EFLAGS: 00010096
>> [  112.557058] RAX: ffff9a90f2600000 RBX: ffff9a90f2600000 RCX: 
>> 0000000000000001
>> [  112.564232] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 
>> ffff9a90f2600000
>> [  112.571408] RBP: ffff9a90c508d500 R08: ffff9a90e2b8a688 R09: 
>> ffff9a90e2b8a688
>> [  112.578581] R10: 0000000000000000 R11: 0000000000000000 R12: 
>> 0000000000000000
>> [  112.585756] R13: ffff9a90c508d500 R14: 0000000000000000 R15: 
>> 0000000000000000
>> [  112.592930] FS:  00007fe41b0f0880(0000) GS:ffff9a94afc00000(0000)
>> knlGS:0000000000000000
>> [  112.601065] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [  112.606842] CR2: 0000000000000048 CR3: 000000046346e005 CR4: 
>> 00000000007706e0
>> [  112.614016] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 
>> 0000000000000000
>> [  112.621189] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 
>> 0000000000000400
>> [  112.628362] PKRU: 55555554
>> [  112.631082] Call Trace:
>> [  112.633539]  <TASK>
>> [  112.635650]  bfq_bic_update_cgroup+0x2c/0x240
>> [  112.640033]  bfq_init_rq+0xdd/0x670
>> [  112.643545]  ? blk_rq_map_user_iov+0xc5/0x2f0
>> [  112.647931]  bfq_insert_request.isra.0+0x5d/0x250
>> [  112.652663]  bfq_insert_requests+0x59/0x80
>> [  112.656782]  blk_mq_flush_plug_list+0x172/0x570
>> [  112.661342]  blk_add_rq_to_plug+0x45/0x150
>> [  112.665462]  nvme_uring_cmd_io+0x242/0x390 [nvme_core]
>> [  112.670652]  io_uring_cmd+0x95/0x120
>> [  112.674250]  io_issue_sqe+0x199/0x3d0
>> [  112.677932]  io_submit_sqes+0x119/0x3d0
>> [  112.681788]  __do_sys_io_uring_enter+0x2c2/0x470
>> [  112.686433]  do_syscall_64+0x59/0x90
>> [  112.690031]  ? exc_page_fault+0x65/0x150
>> [  112.693977]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
>> [  112.699057] RIP: 0033:0x7fe41ae3ee5d
>> [  112.702651] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e
>> fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24
>> 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 93 af 1b 00 f7 d8 64 89
>> 01 48
>> [  112.721530] RSP: 002b:00007ffc6fdebc28 EFLAGS: 00000206 ORIG_RAX:
>> 00000000000001aa
>> [  112.729143] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 
>> 00007fe41ae3ee5d
>> [  112.736317] RDX: 0000000000000001 RSI: 0000000000000080 RDI: 
>> 0000000000000005
>> [  112.743492] RBP: 00007ffc6fdec730 R08: 0000000000000000 R09: 
>> 0000000000000080
>> [  112.750666] R10: 0000000000000001 R11: 0000000000000206 R12: 
>> 00007ffc6fdec848
>> [  112.757841] R13: 0000000000401346 R14: 0000000000403de8 R15: 
>> 00007fe41b32c000
>> [  112.765019]  </TASK>
>>
>> .
>>
> 
> .
>