[fw_cfg] c8bf448ff3: kernel_BUG_at_arch/x86/mm/physaddr.c

FYI, we noticed the following commit (built with gcc-7):

commit: c8bf448ff3899860de51fbae61a43619c912ddf2 ("fw_cfg: do DMA read operation")
https://git.kernel.org/cgit/linux/kernel/git/mst/vhost.git vhost

in testcase: boot

on test machine: qemu-system-x86_64 -enable-kvm -m 420M

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


+------------------------------------------+------------+------------+
|                                          | b4b818b1f7 | c8bf448ff3 |
+------------------------------------------+------------+------------+
| boot_successes                           | 8          | 0          |
| boot_failures                            | 0          | 8          |
| kernel_BUG_at_arch/x86/mm/physaddr.c     | 0          | 8          |
| invalid_opcode:#[##]                     | 0          | 8          |
| RIP:__phys_addr                          | 0          | 8          |
| Kernel_panic-not_syncing:Fatal_exception | 0          | 8          |
+------------------------------------------+------------+------------+



[   19.254526] kernel BUG at arch/x86/mm/physaddr.c:27!
[   19.255580] invalid opcode: 0000 [#1]
[   19.256147] Modules linked in:
[   19.256561] CPU: 0 PID: 1 Comm: swapper Not tainted 4.15.0-00020-gc8bf448 #1
[   19.256561] RIP: 0010:__phys_addr+0x4f/0x90
[   19.256561] RSP: 0000:ffffc9000000bc50 EFLAGS: 00010287
[   19.256561] RAX: 0000780000000000 RBX: ffff880017c5ff20 RCX: ffff880017c5ff20
[   19.256561] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000
[   19.256561] RBP: ffffc9000000bc50 R08: ffff88000002e750 R09: 0000000000000000
[   19.256561] R10: ffff880017c5ff20 R11: 0000000000000000 R12: 0000000004000000
[   19.256561] R13: 0000000000000004 R14: 0000000000000000 R15: 0000000004000000
[   19.256561] FS:  0000000000000000(0000) GS:ffffffff82849000(0000) knlGS:0000000000000000
[   19.256561] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   19.256561] CR2: 0000000000000000 CR3: 000000000281b000 CR4: 00000000000006b0
[   19.256561] Call Trace:
[   19.256561]  fw_cfg_dma_transfer+0x5c/0x130
[   19.256561]  fw_cfg_read_blob+0x132/0x250
[   19.256561]  fw_cfg_sysfs_probe+0x43e/0xa40
[   19.256561]  ? mutex_unlock+0x1d/0x30
[   19.256561]  platform_drv_probe+0x5e/0x130
[   19.256561]  driver_probe_device+0x5c2/0x770
[   19.256561]  __driver_attach+0x14c/0x1d0
[   19.256561]  ? driver_probe_device+0x770/0x770
[   19.256561]  bus_for_each_dev+0xa7/0xf0
[   19.256561]  driver_attach+0x21/0x30
[   19.256561]  bus_add_driver+0x318/0x420
[   19.256561]  ? firmware_map_add_early+0x84/0x84
[   19.256561]  driver_register+0xa7/0x190
[   19.256561]  ? firmware_map_add_early+0x84/0x84
[   19.256561]  __platform_driver_register+0x39/0x50
[   19.256561]  fw_cfg_sysfs_init+0x4e/0x8e
[   19.256561]  ? firmware_map_add_early+0x84/0x84
[   19.256561]  do_one_initcall+0x53/0x285
[   19.256561]  kernel_init_freeable+0x1dc/0x2d8
[   19.256561]  ? rest_init+0x140/0x140
[   19.256561]  kernel_init+0x11/0x1d0
[   19.256561]  ret_from_fork+0x1f/0x30
[   19.256561] Code: 01 f8 48 39 c2 72 24 0f b6 0d 9a 17 e3 01 48 89 c2 48 83 05 e3 5e fc 01 01 48 d3 ea 48 85 d2 75 0a 48 83 05 db 5e fc 01 01 5d c3 <0f> 0b 48 83 05 d7 5e fc 01 01 48 8b 05 30 54 7c 01 48 83 05 98 
[   19.256561] RIP: __phys_addr+0x4f/0x90 RSP: ffffc9000000bc50
[   19.285532] ---[ end trace 4c809434fb988277 ]---


To reproduce:

        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script  # job-script is attached in this email



Thanks,
lkp