On Thu, Mar 20, 2025 at 04:05:14PM +0530, Naresh Kamboju wrote:

Regressions on arm64 Fast model (FVP-aemva) boot failed with stable-rc 6.13.

First seen on the stable-rc 6.13.8-rc1 Good: v6.13.8 Bad: 6.13.8-rc1 (v6.13.7-242-g14de9a7d510f)

That "Good" tag doesn't look right. Is that meant to be v6.13.7?

AFAICT there is no v6.13.8 tag yet.

Regressions found on FVP:

• boot

Regression Analysis:

• New regression? Yes
• Reproducible? Yes

Can you bisect this?

Boot regression: Fast model boot fail Internal error Oops BTI Reported-by: Linux Kernel Functional Testing lkft@linaro.org

NOTE: LKFT is currently running FVP Fast Models version 11.24. Planned upgrade to the Fast Models version 11.28 in this sprint.

## Boot log [ 12.812790] Internal error: Oops - BTI: 0000000036000002 [#1] PREEMPT SMP [ 12.812886] Modules linked in: drm fuse backlight ip_tables x_tables [ 12.813120] CPU: 6 UID: 0 PID: 136 Comm: udevadm Not tainted 6.13.8-rc1 #1 [ 12.813245] Hardware name: FVP Base RevC (DT) [ 12.813317] pstate: 163402809 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=-c) [ 12.813450] pc : kernfs_iop_permission+0x4/0xe4 [ 12.813585] lr : inode_permission+0xb8/0x174

This is one instruction into kernfs_iop_permission(), which suggests that either the caller has branched to a corrupted address, or somehow the model has skipped the BTI.

[ 12.813728] sp : ffff800080d63bb0 [ 12.813796] x29: ffff800080d63bc0 x28: 0000000000002e2e x27: 00000000fffffff6 [ 12.813978] x26: 0000000000000030 x25: 2f2f2f2f2f2f2f2f x24: 61c8864680b583eb [ 12.814161] x23: 0000000000000000 x22: fefefefefefefeff x21: ffffa991682c84b8 [ 12.814344] x20: ffff0008006704d0 x19: 0000000000000001 x18: 00000000fffffffb [ 12.814525] x17: ffff000801bf8021 x16: e0acaabd2f000000 x15: ffffffffff000000 [ 12.814711] x14: 0000000000000002 x13: ffffffffffffffff x12: 0000002e00000000 [ 12.814893] x11: 0000002d00000000 x10: 0000002d00000000 x9 : ffff0008006704d0 [ 12.815076] x8 : ffffa991665f0ff8 x7 : 0000000000000000 x6 : 0000000000000000 [ 12.815253] x5 : 0000000000000000 x4 : 0000000000004050 x3 : 2f7375622f737973 [ 12.815432] x2 : 0000000000000001 x1 : ffff0008006704d0 x0 : ffffa991682c84b8 [ 12.815613] Call trace: [ 12.815670] kernfs_iop_permission+0x4/0xe4 (P) [ 12.815830] link_path_walk+0x2b8/0x388 [ 12.815962] path_lookupat+0x68/0x120 [ 12.816073] filename_lookup+0xe0/0x1e0 [ 12.816196] do_readlinkat+0x6c/0x1d8 [ 12.816337] __arm64_sys_readlinkat+0x20/0x30 [ 12.816481] invoke_syscall+0x40/0xf8 [ 12.816623] el0_svc_common+0xa8/0xd8 [ 12.816765] do_el0_svc+0x1c/0x28 [ 12.816904] el0_svc+0x38/0x68 [ 12.817050] el0t_64_sync_handler+0x78/0x108 [ 12.817203] el0t_64_sync+0x198/0x19c [ 12.817359] Code: a8c27bfd d50323bf d65f03c0 d503245f (373806c2)

^^^^^^^^ BTI C

As we can see here, there's a BTI C immediately beafore the instruction that triggers the BTI exception, so as above either the call has branch to a bogus address or the model has somehow skipepd the BTI.

Assuming there isn't a model bug, this is likely to be either a bug in inode_permission(), or some sort of memory corruption.

Mark.

[ 12.817444] ---[ end trace 0000000000000000 ]---

## Source

• Kernel version: 6.13.8-rc1
• Git tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
• Git sha: 14de9a7d510fcfb3bd35e275eda09724bda4d440
• Git describe: v6.13.7-242-g14de9a7d510f
• Project details:

https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.13.y/build/v6.13....

## Build

• Build log: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.13.y/build/v6.13....
• Build history:

https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.13.y/build/v6.13....

• Build details:

https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.13.y/build/v6.13....

• Build link: https://storage.tuxsuite.com/public/linaro/lkft/builds/2uXZoz8Lc7Ue3i4mVWAM8...
• Kernel config:

https://storage.tuxsuite.com/public/linaro/lkft/builds/2uXZoz8Lc7Ue3i4mVWAM8...

-- Linaro LKFT https://lkft.linaro.org