Hello.

While doing some tracing, observed this kernel panic on powerpc.

It is quite easy reproduce this.
- keep it preempt=full/lazy
- enable some bcc tools. for example: ./stackcount nohz_balance_exit_idle
- Run some workload such as "hackbench 10 process 1000 loops"

I remember seeing this across other bcc tools.



Seen this on tip/master:
commit 5d3b0106245d467fd5ba0bd9a373a13356684f6e (HEAD -> master, origin/master, 
origin/HEAD)
Merge: 93368366738f e21279b73ef6
Author: Ingo Molnar <[email protected]>
Date:   Tue Jan 6 09:04:47 2026 +0100

    Merge branch into tip/master: 'x86/sev'



Panic log:
 attempted to read user page (6b8) - exploit attempt? (uid: 0)
 BUG: Kernel NULL pointer dereference on read at 0x000006b8
 Faulting instruction address: 0xc00000000013cf10
 Oops: Kernel access of bad area, sig: 11 [#1]
 CPU: 38 UID: 0 PID: 2938 Comm: hackbench Kdump: loaded Not tainted 6.19.0-rc4+ 
#326 PREEMPT(full)
 NIP:  c00000000013cf10 LR: c00000000013ced0 CTR: c0000000004a7f08
 REGS: c0000000a7f96b60 TRAP: 0300   Not tainted  (6.19.0-rc4+)
 MSR:  8000000000001033 <SF,ME,IR,DR,RI,LE>  CR: 88022828  XER: 20040000
 CFAR: c00000000050490c DAR: 00000000000006b8 DSISR: 40000000 IRQMASK: 3
 GPR00: c00000000013ced0 c0000000a7f96e00 c000000001c38100 0000000000000000
 GPR04: 00007fffda01fea8 0000000000000008 0000000000000000 00007fff94f05e84
 GPR08: c0000000a7f90000 0000000000000000 00007fffda0205d0 0000000000004000
 GPR12: c000000002dbdddc c0000017fd891c80 c0000000001e08f4 0000000000000000
 GPR16: 0000000000000000 0000000000000000 0000000000000000 00000d9842ecbda0
 GPR20: c0000000c5c54a00 0000000000000026 0000000000000000 0000000000000000
 GPR24: 0000000000000001 fffffffffffffe00 c0000000c5c54a00 000ffffffffffff8
 GPR28: 00007fffffffffdf 0000000000000000 00007fffda01fea0 c0000000a7f96ef0
 NIP [c00000000013cf10] perf_callchain_user_64+0x1b0/0x4f0
 LR [c00000000013ced0] perf_callchain_user_64+0x170/0x4f0
 Call Trace:
 perf_callchain_user_64+0x170/0x4f0 (unreliable)
 perf_callchain_user+0x20/0x3c
 get_perf_callchain+0x1b0/0x3dc
 bpf_get_stackid+0x94/0xec
 bpf_prog_1ca8f9c0bc38eaa6_trace_count+0x70/0x1bc
 trace_call_bpf+0x124/0x3c4
 kprobe_perf_func+0x54/0x2f8
 kprobe_ftrace_handler+0x1dc/0x298
 ftrace_regs_call+0x4/0xa0
 nohz_balance_exit_idle+0x10/0x120
 nohz_balancer_kick+0x50/0x3e4
 sched_tick+0x140/0x334
 update_process_times+0xf0/0x144
 tick_nohz_handler+0xc4/0x274
 __hrtimer_run_queues+0x1c4/0x480
 hrtimer_interrupt+0x12c/0x30c
 timer_interrupt+0x140/0x394
 __replay_soft_interrupts+0xa0/0x154
 arch_local_irq_restore.part.0+0x1ac/0x224
 _raw_spin_unlock_irqrestore+0x50/0xa0
 try_to_wake_up+0x3e8/0xa58
 wake_up_q+0x88/0xe4
 rwsem_wake.isra.0+0x98/0xd8
 up_write+0xa8/0xb4
 unlink_file_vma_batch_process+0xc8/0xf0
 unlink_file_vma_batch_add+0x5c/0xa4
 free_pgtables+0x110/0x394
 exit_mmap+0x1a0/0x5a8
 __mmput+0x64/0x194
 exit_mm+0xe0/0x170
 do_exit+0x21c/0x5d0
 do_group_exit+0x4c/0xc0
 pid_child_should_wake+0x0/0x7c
 system_call_exception+0x128/0x390
 system_call_vectored_common+0x15c/0x2ec



Looks like venkat had reported similar one earlier.
https://lore.kernel.org/all/[email protected]/

Venkat, can you give above mentioned steps a try on linux-next latest?

Reply via email to