Kernel panic on UltraSPARC III with CONFIG_CGROUP_BPF enabled on systemd

[glaubitz]

Just trying to reinstall the openssh-server package can cause the kernel to panic on a Netra 240 (sun4u, UltraSPARC IIIi):

root@raverin:~# apt install --reinstall openssh-server
Summary:                        
  Upgrading: 0, Installing: 0, Reinstalling: 1, Removing: 0, Not Upgrading: 0
  Download size: 0 B / 485 kB
  Space needed: 0 B / 40.1 GB available

Preconfiguring packages ...
(Reading database ... 99333 files and directories currently installed.)
Preparing to unpack .../openssh-server_1%3a10.2p1-2_sparc64.deb ...
Unpacking openssh-server (1:10.2p1-2) over (1:10.2p1-2) ...
Setting up openssh-server (1:10.2p1-2) ...

The resulting backtrace is:

raverin login: [  116.815129] systemd-journald[196]: Time jumped backwards, rotating.
[  381.671904] systemd-sysv-generator[1250]: SysV service '/etc/init.d/buildd' lacks a native systemd unit file, automatically generating a unit file for compatibility.
[  381.866801] systemd-sysv-generator[1250]: Please update package to include a native systemd unit file.
[  381.990064] systemd-sysv-generator[1250]: ⚠ This compatibility logic is deprecated, expect removal soon. ⚠
[  385.113190] systemd-sysv-generator[1289]: SysV service '/etc/init.d/buildd' lacks a native systemd unit file, automatically generating a unit file for compatibility.
[  385.307931] systemd-sysv-generator[1289]: Please update package to include a native systemd unit file.
[  385.431140] systemd-sysv-generator[1289]: ⚠ This compatibility logic is deprecated, expect removal soon. ⚠
[  386.598296] Unable to handle kernel paging request at virtual address 5520000300000000
[  386.702502] tsk->{mm,active_mm}->context = 00000000000000ab
[  386.775743] tsk->{mm,active_mm}->pgd = fff0000008180000
[  386.844454]               \|/ ____ \|/
[  386.844454]               "@'/ .. \`@"
[  386.844454]               /_| \__/ |_\
[  386.844454]                  \__U_/
[  387.037781] systemd(1): Oops [#1]
[  387.081312] CPU: 0 UID: 0 PID: 1 Comm: systemd Not tainted 6.18.0-rc2 #1 NONE 
[  387.176256] TSTATE: 0000004411001601 TPC: 000000000064d910 TNPC: 000000000064d914 Y: 00000000    Not tainted
[  387.305595] TPC: <bpf_check+0x2010/0x3520>
[  387.359457] g0: 0000000000000000 g1: 0000000000fc1330 g2: 5520000300000002 g3: 000000000000ff00
[  387.473829] g4: fff0000000235800 g5: fff000023e318000 g6: fff0000000268000 g7: fff000023e318000
[  387.588204] o0: 0000000100868000 o1: fff0000008e08aa8 o2: 0000000000000000 o3: 000000000000003a
[  387.702586] o4: 0000000000000000 o5: 000000000000003a sp: fff000000026b011 ret_pc: 000000000064d8f4
[  387.821529] RPC: <bpf_check+0x1ff4/0x3520>
[  387.875282] l0: 0000000000000000 l1: 000007feffbdb260 l2: 0000000000000001 l3: 000007feffbdb25c
[  387.989660] l4: 00000100004bbe84 l5: 0000000000000000 l6: fff0000008e08000 l7: fff000000026b9a0
[  388.104036] i0: fff000000026ba98 i1: fff000000026bd28 i2: 0000000000000000 i3: 00000000000062d0
[  388.218414] i4: 0000000000000000 i5: 0000000000fc3368 i6: fff000000026b1e1 i7: 000000000061d61c
[  388.332786] I7: <bpf_prog_load+0x8fc/0xe00>
[  388.387789] Call Trace:
[  388.419811] [<000000000061d61c>] bpf_prog_load+0x8fc/0xe00
[  388.491868] [<000000000061f6d4>] __sys_bpf+0x1034/0x27e0
[  388.561635] [<0000000000621498>] sys_bpf+0x18/0x60
[  388.624542] [<0000000000406274>] linux_sparc_syscall+0x34/0x44
[  388.701176] Disabling lock debugging due to kernel taint
[  388.770941] Caller[000000000061d61c]: bpf_prog_load+0x8fc/0xe00
[  388.848715] Caller[000000000061f6d4]: __sys_bpf+0x1034/0x27e0
[  388.924217] Caller[0000000000621498]: sys_bpf+0x18/0x60
[  388.992937] Caller[0000000000406274]: linux_sparc_syscall+0x34/0x44
[  389.075284] Caller[fff000010089b74c]: 0xfff000010089b74c
[  389.145050] Instruction DUMP:
[  389.145053]  01000000 
[  389.183937]  d05da008 
[  389.214817]  c45a2050 
[  389.245696] <c408a09a>
[  389.276582]  80a0a000 
[  389.307461]  02480007 
[  389.338341]  01000000 
[  389.369222]  40010c98 
[  389.400103]  01000000 
[  389.430986] 
[  389.481313] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[  389.581967] Press Stop-A (L1-A) from sun keyboard or send break
[  389.581967] twice on console to return to the boot prom
[  389.728357] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 ]---

[glaubitz]

The issue can be reproduced with the attached kernel config:

config-6.18.0-rc2.txt

[glaubitz]

Extensive testing with the kernel configuration revealed no configuration that mitigated the problem.

Focus is now on the Cheetah-specific patching in arch/sparc/kernel/head_64.S:

/* Patch copy/page operations to cheetah optimized versions. */
call    cheetah_patch_copyops
 nop
call    cheetah_patch_copy_page
 nop
call    cheetah_patch_cachetlbops
 nop

It was verified that replacing cheetah_patch_copyops with generic_patch_copyops made no difference, so the previously fixed copy_{to,from}_user on UltraSPARC III (Cheetah) should be okay.

Thus, the focus should be on cheetah_patch_copy_page and cheetah_patch_cachetlbops.

[glaubitz]

The problem is not reproducible on a T5120 which is based on the UltraSPARC T2 CPU, so it seems the issue is specific to UltraSPARC III (Cheetah).

[glaubitz]

Not reproducible on QEMU when using the sun4u either which emulates an UltraSPARC IIi CPU.

[onitake]

Is this something on 6.18 only?
I tested 6.12 on a UltraSPARC IIi CPU, and the issue didn't appear.

[glaubitz]

Is this something on 6.18 only?

No, it also shows with older kernels.

I tested 6.12 on a UltraSPARC IIi CPU, and the issue didn't appear.

Thanks for the confirmation. My suspicion is that it's a bug in the optimized routines for UltraSPARC III (Cheetah).

[glaubitz]

Patching out the calls to cheetah_patch_copyops and cheetah_patch_copy_page in arch/sparc/kernel/head_64.S does not make any difference, so the bug is not located there.

Patching out the call to cheetah_patch_cachetlbops in the same source leads to an immediate crash when the kernel boots, patching this call out for testing isn't possible.

All three calls are specific to UltraSPARC III.

However, there is a chance the bug might reside in cheetah_patch_cachetlbops as this function got heavily rewritten in the past in sparc64: Handle extremely large kernel TLB range flushes more gracefully which already introduced another regression which was later fixed in sparc64: Fix regression in non-hypervisor TLB flush xcall.

Further investigation of cheetah_patch_cachetlbops is therefore advisable.

[glaubitz]

Reverting sparc64: Fix regression in non-hypervisor TLB flush xcall and sparc64: Handle extremely large kernel TLB range flushes more gracefully causes the system to lock up when systemd is being started, so a quick verification whether the bug was introduced here is not possible.

[glaubitz]

While trying to retrieve more debugging information, I observed a slightly different crash with an unaligned access now:

[  188.953462] systemd-sysv-generator[1192]: SysV service '/etc/init.d/buildd' lacks a native systemd unit file, automatically generating a unit file for compatibility.
[  189.148140] systemd-sysv-generator[1192]: Please update package to include a native systemd unit file.
[  189.270662] systemd-sysv-generator[1192]: ⚠ This compatibility logic is deprecated, expect removal soon. ⚠
[  190.448418] Unable to handle kernel paging request at virtual address 00cbf40004800000
[  190.552604] tsk->{mm,active_mm}->context = 00000000000000ac
[  190.625882] tsk->{mm,active_mm}->pgd = fff0000007c7c000
[  190.694585]               \|/ ____ \|/
[  190.694585]               "@'/ .. \`@"
[  190.694585]               /_| \__/ |_\
[  190.694585]                  \__U_/
[  190.887887] kworker/0:2(105): Oops [#1]
[  190.938213] CPU: 0 UID: 0 PID: 105 Comm: kworker/0:2 Not tainted 6.18.0-rc2+ #6 NONE 
[  191.041144] Workqueue: events bpf_prog_free_deferred
[  191.106436] TSTATE: 0000004411001607 TPC: 00000000006b8d08 TNPC: 00000000006b8d0c Y: 00000000    Not tainted
[  191.235685] TPC: <free_percpu+0xe8/0x600>
[  191.288301] g0: fff0000007d26c10 g1: 00cbf40004800000 g2: 0015540000800000 g3: 000c000000000000
[  191.402676] g4: fff0000007d26b80 g5: 0000000000657300 g6: fff00000081b8000 g7: fff000023fe14000
[  191.517055] o0: 0000000000000000 o1: 0000000000000ab8 o2: 0000000000000000 o3: 0000000000000ab7
[  191.631426] o4: 00000000ff000000 o5: 00ff000000000000 sp: fff00000081bb241 ret_pc: 0000ff0000000000
[  191.750376] RPC: <0xff0000000000>
[  191.793830] l0: 0000000000000000 l1: 0000000000000002 l2: 0000000000000001 l3: 0000000001373c00
[  191.908214] l4: 00000000010c4620 l5: 00000000010c4948 l6: 0000000001373c00 l7: fff000010117d110
[  192.022589] i0: 5540000200000001 i1: 554fffffc01ec001 i2: 0000000000ff0000 i3: 00000000005cfb10
[  192.136963] i4: 0000000000000000 i5: 0000000000000000 i6: fff00000081bb301 i7: 00000000005cfb18
[  192.251337] I7: <bpf_jit_free+0x38/0xe0>
[  192.302801] Call Trace:
[  192.334824] [<00000000005cfb18>] bpf_jit_free+0x38/0xe0
[  192.403459] [<00000000005d0c00>] bpf_prog_free_deferred+0x180/0x1c0
[  192.485805] [<00000000004951ec>] process_one_work+0x16c/0x400
[  192.561290] [<0000000000495fec>] worker_thread+0x20c/0x4a0
[  192.633346] [<000000000049dc00>] kthread+0xe0/0x260
[  192.697396] [<0000000000405fc8>] ret_from_fork+0x1c/0x2c
[  192.767162] [<0000000000000000>] 0x0
[  192.814061] Disabling lock debugging due to kernel taint
[  192.883825] Caller[00000000005cfb18]: bpf_jit_free+0x38/0xe0
[  192.958173] Caller[00000000005d0c00]: bpf_prog_free_deferred+0x180/0x1c0
[  193.046240] Caller[00000000004951ec]: process_one_work+0x16c/0x400
[  193.127447] Caller[0000000000495fec]: worker_thread+0x20c/0x4a0
[  193.205220] Caller[000000000049dc00]: kthread+0xe0/0x260
[  193.274990] Caller[0000000000405fc8]: ret_from_fork+0x1c/0x2c
[  193.350477] Caller[0000000000000000]: 0x0
[  193.403095] Instruction DUMP:
[  193.403098]  82008001 
[  193.441973]  83287003 
[  193.472855]  8200c001 
[  193.503735] <f8586028>
[  193.534619]  f25f2040 
[  193.565500]  b2260019 
[  193.596379]  f227a7f3 
[  193.627259]  85520000 
[  193.658143]  8210a00e 
[  193.689022] 
[  195.014400] systemd-journald[187]: Time jumped backwards, rotating. (Dropped 10 similar message(s))
[  195.852226] systemd-sysv-generator[1235]: SysV service '/etc/init.d/buildd' lacks a native systemd unit file, automatically generating a unit file for compatibility.
[  196.047264] systemd-sysv-generator[1235]: Please update package to include a native systemd unit file.
[  196.170611] systemd-sysv-generator[1235]: ⚠ This compatibility logic is deprecated, expect removal soon. ⚠
[  196.310151] systemd-journald[187]: Time jumped backwards, rotating.
[  197.474552] log_unaligned: 324 callbacks suppressed
[  197.474567] Kernel unaligned access at TPC[f181a0] arch_atomic64_sub_return+0x0/0x20
[  197.640612] Unable to handle kernel paging request in mna handler
[  197.640617]  at virtual address 5520000300000002
[  197.781371] current->{active_,}mm->context = 00000000000000ac
[  197.856869] current->{active_,}mm->pgd = fff0000007c7c000
[  197.927770]               \|/ ____ \|/
[  197.927770]               "@'/ .. \`@"
[  197.927770]               /_| \__/ |_\
[  197.927770]                  \__U_/
[  198.121092] systemd(1): Oops [#2]
[  198.164630] CPU: 0 UID: 0 PID: 1 Comm: systemd Tainted: G      D             6.18.0-rc2+ #6 NONE 
[  198.281306] Tainted: [D]=DIE
[  198.319033] TSTATE: 0000004411001604 TPC: 0000000000f181a0 TNPC: 0000000000f181a4 Y: 00000000    Tainted: G      D            
[  198.468877] TPC: <arch_atomic64_sub_return+0x0/0x20>
[  198.534060] g0: 0000000000000000 g1: 00000001000e6000 g2: fff0000002007030 g3: fff00000001812e8
[  198.648442] g4: fff00000001d35c0 g5: 00000000656d642d g6: fff0000000234000 g7: 0000000080000000
[  198.762816] o0: 0000000000000001 o1: 5520000300000002 o2: 0000000000000098 o3: 0000000000000000
[  198.877191] o4: 0000000000000000 o5: 000000000117ec00 sp: fff00000002373d1 ret_pc: 00000000005d56b8
[  198.996142] RPC: <bpf_prog_release+0x18/0xa0>
[  199.053329] l0: 0000010000206010 l1: fff0000101300e28 l2: 9e4b746d4cafaf27 l3: 0000000000000000
[  199.167705] l4: 0000000000000000 l5: 0000000000000000 l6: 0000000000000000 l7: fff0000100bff1d0
[  199.282079] i0: fff0000002007030 i1: fff0000004faa240 i2: 0000000000000098 i3: 0000000000000000
[  199.396454] i4: 0000000000000016 i5: 5520000300000002 i6: fff0000000237481 i7: 000000000076eadc
[  199.510834] I7: <__fput+0xdc/0x320>
[  199.556675] Call Trace:
[  199.588704] [<000000000076eadc>] __fput+0xdc/0x320
[  199.651609] [<000000000076f288>] fput_close_sync+0x28/0x80
[  199.723664] [<0000000000769f30>] sys_close+0x30/0x80
[  199.788860] [<0000000000406174>] linux_sparc_syscall+0x34/0x44
[  199.865494] Caller[000000000076eadc]: __fput+0xdc/0x320
[  199.934116] Caller[000000000076f288]: fput_close_sync+0x28/0x80
[  200.011891] Caller[0000000000769f30]: sys_close+0x30/0x80
[  200.082811] Caller[0000000000406174]: linux_sparc_syscall+0x34/0x44
[  200.165156] Caller[fff000010108f9e0]: 0xfff000010108f9e0
[  200.234922] Instruction DUMP:
[  200.234925]  01000000 
[  200.273806]  81c3e008 
[  200.304687]  01000000 
[  200.335567] <c25a4000>
[  200.366452]  8e204008 
[  200.397330]  cff25001 
[  200.428215]  80a04007 
[  200.459105]  1267fffc 
[  200.489979]  01000000 
[  200.520856] 
[  200.571183] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[  200.671837] Press Stop-A (L1-A) from sun keyboard or send break
[  200.671837] twice on console to return to the boot prom
[  200.818232] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 ]---

[glaubitz]

Disassembly of arch_atomic64_sub_return:

0000000000f181a0 <arch_atomic64_sub_return>:
  f181a0:       c2 5a 40 00     ldx  [ %o1 ], %g1
  f181a4:       8e 20 40 08     sub  %g1, %o0, %g7
  f181a8:       cf f2 50 01     casx  [ %o1 ], %g1, %g7
  f181ac:       80 a0 40 07     cmp  %g1, %g7
  f181b0:       12 67 ff fc     bne,pn   %xcc, f181a0 <arch_atomic64_sub_return>
  f181b4:       01 00 00 00     nop 
  f181b8:       81 c3 e0 08     retl 
  f181bc:       90 20 40 08     sub  %g1, %o0, %o0

Disassembly of free_percpu:

00000000006b8c20 <free_percpu>:
  6b8c20:       9d e3 bf 40     save  %sp, -192, %sp
  6b8c24:       40 21 83 97     call  f19a80 <_mcount>
  6b8c28:       01 00 00 00     nop 
  6b8c2c:       02 c6 00 f7     brz,pn   %i0, 6b9008 <free_percpu+0x3e8>
  6b8c30:       03 00 45 88     sethi  %hi(0x1162000), %g1
  6b8c34:       f8 58 62 10     ldx  [ %g1 + 0x210 ], %i4       ! 1162210 <pcpu_first_chunk>
  6b8c38:       02 c7 00 12     brz,pn   %i4, 6b8c80 <free_percpu+0x60>
  6b8c3c:       86 10 20 00     clr  %g3
  6b8c40:       c2 47 20 78     ldsw  [ %i4 + 0x78 ], %g1
  6b8c44:       84 10 20 00     clr  %g2
  6b8c48:       fa 47 20 68     ldsw  [ %i4 + 0x68 ], %i5
  6b8c4c:       ce 47 20 64     ldsw  [ %i4 + 0x64 ], %g7
  6b8c50:       83 28 70 0d     sllx  %g1, 0xd, %g1
  6b8c54:       f2 5f 20 40     ldx  [ %i4 + 0x40 ], %i1
  6b8c58:       82 20 40 1d     sub  %g1, %i5, %g1
  6b8c5c:       82 06 40 01     add  %i1, %g1, %g1
  6b8c60:       8e 06 40 07     add  %i1, %g7, %g7
  6b8c64:       80 a6 00 01     cmp  %i0, %g1
  6b8c68:       87 65 70 01     movcs  %xcc, 1, %g3
  6b8c6c:       80 a6 00 07     cmp  %i0, %g7
  6b8c70:       85 67 70 01     movcc  %xcc, 1, %g2
  6b8c74:       80 88 c0 02     btst  %g3, %g2
  6b8c78:       12 40 00 27     bne,pn   %icc, 6b8d14 <free_percpu+0xf4>
  6b8c7c:       b2 26 00 19     sub  %i0, %i1, %i1
  6b8c80:       03 00 45 88     sethi  %hi(0x1162000), %g1
  6b8c84:       f8 58 62 08     ldx  [ %g1 + 0x208 ], %i4       ! 1162208 <pcpu_reserved_chunk>
  6b8c88:       02 c7 00 12     brz,pn   %i4, 6b8cd0 <free_percpu+0xb0>
  6b8c8c:       86 10 20 00     clr  %g3
  6b8c90:       c2 47 20 78     ldsw  [ %i4 + 0x78 ], %g1
  6b8c94:       84 10 20 00     clr  %g2
  6b8c98:       fa 47 20 68     ldsw  [ %i4 + 0x68 ], %i5
  6b8c9c:       ce 47 20 64     ldsw  [ %i4 + 0x64 ], %g7
  6b8ca0:       83 28 70 0d     sllx  %g1, 0xd, %g1
  6b8ca4:       f2 5f 20 40     ldx  [ %i4 + 0x40 ], %i1
  6b8ca8:       82 20 40 1d     sub  %g1, %i5, %g1
  6b8cac:       82 06 40 01     add  %i1, %g1, %g1
  6b8cb0:       8e 06 40 07     add  %i1, %g7, %g7
  6b8cb4:       80 a6 00 01     cmp  %i0, %g1
  6b8cb8:       87 65 70 01     movcs  %xcc, 1, %g3
  6b8cbc:       80 a6 00 07     cmp  %i0, %g7
  6b8cc0:       85 67 70 01     movcc  %xcc, 1, %g2
  6b8cc4:       80 88 c0 02     btst  %g3, %g2
  6b8cc8:       12 40 00 13     bne,pn   %icc, 6b8d14 <free_percpu+0xf4>
  6b8ccc:       b2 26 00 19     sub  %i0, %i1, %i1
  6b8cd0:       03 00 45 88     sethi  %hi(0x1162000), %g1
  6b8cd4:       05 00 50 fe     sethi  %hi(0x143f800), %g2
  6b8cd8:       c2 58 62 20     ldx  [ %g1 + 0x220 ], %g1
  6b8cdc:       07 00 48 c4     sethi  %hi(0x1231000), %g3
  6b8ce0:       c4 58 a0 d8     ldx  [ %g2 + 0xd8 ], %g2
  6b8ce4:       c2 58 40 00     ldx  [ %g1 ], %g1
  6b8ce8:       c6 58 e2 58     ldx  [ %g3 + 0x258 ], %g3
  6b8cec:       82 06 00 01     add  %i0, %g1, %g1
  6b8cf0:       82 20 40 02     sub  %g1, %g2, %g1
  6b8cf4:       83 30 70 0d     srlx  %g1, 0xd, %g1
  6b8cf8:       85 28 70 03     sllx  %g1, 3, %g2
  6b8cfc:       82 00 80 01     add  %g2, %g1, %g1
  6b8d00:       83 28 70 03     sllx  %g1, 3, %g1
  6b8d04:       82 00 c0 01     add  %g3, %g1, %g1
  6b8d08:       f8 58 60 28     ldx  [ %g1 + 0x28 ], %i4
  6b8d0c:       f2 5f 20 40     ldx  [ %i4 + 0x40 ], %i1
  6b8d10:       b2 26 00 19     sub  %i0, %i1, %i1
  6b8d14:       f2 27 a7 f3     st  %i1, [ %fp + 0x7f3 ]
  6b8d18:       85 52 00 00     rdpr  %pil, %g2
  6b8d1c:       82 10 a0 0e     or  %g2, 0xe, %g1
  6b8d20:       91 90 60 00     wrpr  %g1, 0, %pil
  6b8d24:       c4 77 a7 f7     stx  %g2, [ %fp + 0x7f7 ]
  6b8d28:       c2 07 20 10     ld  [ %i4 + 0x10 ], %g1
  6b8d2c:       80 a0 60 03     cmp  %g1, 3
  6b8d30:       04 40 00 10     ble,pn   %icc, 6b8d70 <free_percpu+0x150>
  6b8d34:       a2 10 20 00     clr  %l1
  6b8d38:       e2 07 20 1c     ld  [ %i4 + 0x1c ], %l1
  6b8d3c:       80 a4 60 00     cmp  %l1, 0
  6b8d40:       02 40 00 0c     be,pn   %icc, 6b8d70 <free_percpu+0x150>
  6b8d44:       03 00 45 88     sethi  %hi(0x1162000), %g1
  6b8d48:       a3 2c 60 02     sll  %l1, 2, %l1
  6b8d4c:       c2 00 62 54     ld  [ %g1 + 0x254 ], %g1
  6b8d50:       80 a4 40 01     cmp  %l1, %g1
  6b8d54:       02 40 01 25     be,pn   %icc, 6b91e8 <free_percpu+0x5c8>
  6b8d58:       03 00 45 88     sethi  %hi(0x1162000), %g1
  6b8d5c:       40 21 82 c1     call  f19860 <fls>
  6b8d60:       91 34 60 00     srl  %l1, 0, %o0
  6b8d64:       a2 02 3f fd     add  %o0, -3, %l1
  6b8d68:       80 a4 60 00     cmp  %l1, 0
  6b8d6c:       a3 64 a0 01     movle  %icc, 1, %l1
  6b8d70:       80 a6 60 00     cmp  %i1, 0
  6b8d74:       82 06 60 03     add  %i1, 3, %g1
  6b8d78:       d2 47 20 78     ldsw  [ %i4 + 0x78 ], %o1
  6b8d7c:       b4 10 00 19     mov  %i1, %i2
  6b8d80:       b5 64 c0 01     movl  %icc, %g1, %i2
  6b8d84:       93 2a 70 0d     sllx  %o1, 0xd, %o1
  6b8d88:       d0 5f 20 38     ldx  [ %i4 + 0x38 ], %o0
  6b8d8c:       b5 3e a0 02     sra  %i2, 2, %i2
  6b8d90:       93 32 70 02     srlx  %o1, 2, %o1
  6b8d94:       94 06 a0 01     add  %i2, 1, %o2
  6b8d98:       93 3a 60 00     sra  %o1, 0, %o1
  6b8d9c:       95 3a a0 00     sra  %o2, 0, %o2
  6b8da0:       40 0c 1e 90     call  9c07e0 <_find_next_bit>
  6b8da4:       a5 3e a0 00     sra  %i2, 0, %l2
  6b8da8:       a8 0e a7 ff     and  %i2, 0x7ff, %l4
  6b8dac:       ab 3c b0 0b     srax  %l2, 0xb, %l5
  6b8db0:       b6 10 00 08     mov  %o0, %i3
  6b8db4:       d0 5f 20 48     ldx  [ %i4 + 0x48 ], %o0
  6b8db8:       93 36 a0 00     srl  %i2, 0, %o1
  6b8dbc:       a0 26 c0 1a     sub  %i3, %i2, %l0
  6b8dc0:       b6 06 ff ff     add  %i3, -1, %i3
  6b8dc4:       95 3c 20 00     sra  %l0, 0, %o2
  6b8dc8:       40 0b fd 7e     call  9b83c0 <__bitmap_clear>
  6b8dcc:       a1 2c 20 02     sll  %l0, 2, %l0
  6b8dd0:       a5 34 b0 0b     srlx  %l2, 0xb, %l2
  6b8dd4:       da 07 20 2c     ld  [ %i4 + 0x2c ], %o5
  6b8dd8:       83 2d 70 05     sllx  %l5, 5, %g1
  6b8ddc:       9f 3e e0 00     sra  %i3, 0, %o7
  6b8de0:       ce 07 20 10     ld  [ %i4 + 0x10 ], %g7
  6b8de4:       a7 3b f0 0b     srax  %o7, 0xb, %l3
  6b8de8:       b6 0e e7 ff     and  %i3, 0x7ff, %i3
  6b8dec:       80 a3 40 1a     cmp  %o5, %i2
  6b8df0:       ec 5f 20 50     ldx  [ %i4 + 0x50 ], %l6
  6b8df4:       b6 06 e0 01     inc  %i3
  6b8df8:       b5 64 80 0d     movle  %icc, %o5, %i2
  6b8dfc:       8e 01 c0 10     add  %g7, %l0, %g7
  6b8e00:       9b 2c f0 05     sllx  %l3, 5, %o5
  6b8e04:       ba 05 80 01     add  %l6, %g1, %i5
  6b8e08:       ce 27 20 10     st  %g7, [ %i4 + 0x10 ]
  6b8e0c:       ac 05 80 0d     add  %l6, %o5, %l6
  6b8e10:       f4 27 20 2c     st  %i2, [ %i4 + 0x2c ]
  6b8e14:       ee 07 60 0c     ld  [ %i5 + 0xc ], %l7
  6b8e18:       c2 07 60 08     ld  [ %i5 + 8 ], %g1
  6b8e1c:       82 05 c0 01     add  %l7, %g1, %g1
  6b8e20:       80 a5 00 01     cmp  %l4, %g1
  6b8e24:       02 40 00 0c     be,pn   %icc, 6b8e54 <free_percpu+0x234>
  6b8e28:       b5 33 f0 0b     srlx  %o7, 0xb, %i2
  6b8e2c:       d0 5f 20 48     ldx  [ %i4 + 0x48 ], %o0
  6b8e30:       83 2d 70 0b     sllx  %l5, 0xb, %g1
  6b8e34:       92 0d 27 ff     and  %l4, 0x7ff, %o1
  6b8e38:       83 30 70 03     srlx  %g1, 3, %g1
  6b8e3c:       ae 10 20 00     clr  %l7
  6b8e40:       40 0c 1f 48     call  9c0b60 <_find_last_bit>
  6b8e44:       90 02 00 01     add  %o0, %g1, %o0
  6b8e48:       82 02 20 01     add  %o0, 1, %g1
  6b8e4c:       80 a5 00 08     cmp  %l4, %o0
  6b8e50:       af 66 40 01     movne  %icc, %g1, %l7
  6b8e54:       c2 05 a0 0c     ld  [ %l6 + 0xc ], %g1
  6b8e58:       80 a6 c0 01     cmp  %i3, %g1
  6b8e5c:       12 40 00 6d     bne,pn   %icc, 6b9010 <free_percpu+0x3f0>
  6b8e60:       80 a4 80 1a     cmp  %l2, %i2
  6b8e64:       c2 05 a0 08     ld  [ %l6 + 8 ], %g1
  6b8e68:       02 40 00 74     be,pn   %icc, 6b9038 <free_percpu+0x418>
  6b8e6c:       b6 06 c0 01     add  %i3, %g1, %i3
  6b8e70:       80 a5 e0 00     cmp  %l7, 0
  6b8e74:       12 48 00 9d     bne  %icc, 6b90e8 <free_percpu+0x4c8>
  6b8e78:       94 10 28 00     mov  0x800, %o2
  6b8e7c:       92 10 20 00     clr  %o1
  6b8e80:       90 10 00 1d     mov  %i5, %o0
  6b8e84:       7f ff f6 0f     call  6b66c0 <pcpu_block_update>
  6b8e88:       a6 10 20 01     mov  1, %l3
  6b8e8c:       82 1e e8 00     xor  %i3, 0x800, %g1
  6b8e90:       95 3e e0 00     sra  %i3, 0, %o2
  6b8e94:       80 a0 00 01     cmp  %g0, %g1
  6b8e98:       92 10 20 00     clr  %o1
  6b8e9c:       a6 64 ff ff     subc  %l3, -1, %l3
  6b8ea0:       7f ff f6 08     call  6b66c0 <pcpu_block_update>
  6b8ea4:       90 10 00 16     mov  %l6, %o0
  6b8ea8:       86 26 80 12     sub  %i2, %l2, %g3
  6b8eac:       82 07 60 20     add  %i5, 0x20, %g1
  6b8eb0:       86 00 ff ff     add  %g3, -1, %g3
  6b8eb4:       84 10 28 00     mov  0x800, %g2
  6b8eb8:       80 a5 80 01     cmp  %l6, %g1
  6b8ebc:       08 60 00 0b     bleu,pn   %xcc, 6b8ee8 <free_percpu+0x2c8>
  6b8ec0:       86 00 c0 13     add  %g3, %l3, %g3
  6b8ec4:       c0 20 60 18     clr  [ %g1 + 0x18 ]
  6b8ec8:       82 00 60 20     add  %g1, 0x20, %g1
  6b8ecc:       c0 20 7f e0     clr  [ %g1 + -32 ]
  6b8ed0:       80 a5 80 01     cmp  %l6, %g1
  6b8ed4:       c0 20 7f ec     clr  [ %g1 + -20 ]
  6b8ed8:       c4 20 7f e8     st  %g2, [ %g1 + -24 ]
  6b8edc:       c4 20 7f f0     st  %g2, [ %g1 + -16 ]
  6b8ee0:       18 6f ff f9     bgu  %xcc, 6b8ec4 <free_percpu+0x2a4>
  6b8ee4:       c4 20 7f f4     st  %g2, [ %g1 + -12 ]
  6b8ee8:       80 a0 e0 00     cmp  %g3, 0
  6b8eec:       32 40 00 8a     bne,a,pn   %icc, 6b9114 <free_percpu+0x4f4>
  6b8ef0:       c2 07 20 80     ld  [ %i4 + 0x80 ], %g1
  6b8ef4:       92 10 20 01     mov  1, %o1
  6b8ef8:       7f ff f6 52     call  6b6840 <pcpu_chunk_refresh_hint>
  6b8efc:       90 10 00 1c     mov  %i4, %o0
  6b8f00:       93 3c 60 00     sra  %l1, 0, %o1
  6b8f04:       7f ff fa 5f     call  6b7880 <pcpu_chunk_relocate>
  6b8f08:       90 10 00 1c     mov  %i4, %o0
  6b8f0c:       c2 5f 20 70     ldx  [ %i4 + 0x70 ], %g1
  6b8f10:       02 c0 40 29     brz,pn   %g1, 6b8fb4 <free_percpu+0x394>
  6b8f14:       b3 3e 60 02     sra  %i1, 2, %i1
  6b8f18:       b3 2e 70 03     sllx  %i1, 3, %i1
  6b8f1c:       fa 58 40 19     ldx  [ %g1 + %i1 ], %i5
  6b8f20:       22 c7 40 26     brz,a,pn   %i5, 6b8fb8 <free_percpu+0x398>
  6b8f24:       f6 0f 20 61     ldub  [ %i4 + 0x61 ], %i3
  6b8f28:       c0 70 40 19     clrx  [ %g1 + %i1 ]
  6b8f2c:       40 02 37 6d     call  746ce0 <mem_cgroup_kmem_disabled>
  6b8f30:       a1 3c 20 00     sra  %l0, 0, %l0
  6b8f34:       83 2c 30 01     sllx  %l0, 1, %g1
  6b8f38:       80 a2 20 00     cmp  %o0, 0
  6b8f3c:       82 00 40 10     add  %g1, %l0, %g1
  6b8f40:       92 10 00 10     mov  %l0, %o1
  6b8f44:       93 64 40 01     move  %icc, %g1, %o1
  6b8f48:       40 02 47 76     call  74ad20 <obj_cgroup_uncharge>
  6b8f4c:       90 10 00 1d     mov  %i5, %o0
  6b8f50:       f6 5f 60 10     ldx  [ %i5 + 0x10 ], %i3
  6b8f54:       40 02 37 63     call  746ce0 <mem_cgroup_kmem_disabled>
  6b8f58:       01 00 00 00     nop 
  6b8f5c:       80 a2 20 00     cmp  %o0, 0
  6b8f60:       32 48 00 06     bne,a   %icc, 6b8f78 <free_percpu+0x358>
  6b8f64:       a0 20 00 10     neg  %l0
  6b8f68:       83 34 30 02     srlx  %l0, 2, %g1
  6b8f6c:       83 28 70 03     sllx  %g1, 3, %g1
  6b8f70:       a0 04 00 01     add  %l0, %g1, %l0
  6b8f74:       a0 20 00 10     neg  %l0
  6b8f78:       92 10 20 32     mov  0x32, %o1
  6b8f7c:       95 3c 20 00     sra  %l0, 0, %o2
  6b8f80:       40 02 38 20     call  747000 <mod_memcg_state>
  6b8f84:       90 10 00 1b     mov  %i3, %o0
  6b8f88:       c2 5f 40 00     ldx  [ %i5 ], %g1
  6b8f8c:       84 08 60 03     and  %g1, 3, %g2
  6b8f90:       2a c0 80 98     brnz,a,pn   %g2, 6b91f0 <free_percpu+0x5d0>
  6b8f94:       d2 5f 60 08     ldx  [ %i5 + 8 ], %o1
  6b8f98:       87 52 00 00     rdpr  %pil, %g3
  6b8f9c:       84 10 e0 0e     or  %g3, 0xe, %g2
  6b8fa0:       91 90 a0 00     wrpr  %g2, 0, %pil
  6b8fa4:       c4 58 40 00     ldx  [ %g1 ], %g2
  6b8fa8:       84 00 bf ff     add  %g2, -1, %g2
  6b8fac:       c4 70 40 00     stx  %g2, [ %g1 ]
  6b8fb0:       91 90 c0 00     wrpr  %g3, %pil
  6b8fb4:       f6 0f 20 61     ldub  [ %i4 + 0x61 ], %i3
  6b8fb8:       80 a6 e0 00     cmp  %i3, 0
  6b8fbc:       32 48 00 08     bne,a   %icc, 6b8fdc <free_percpu+0x3bc>
  6b8fc0:       b6 10 20 00     clr  %i3
  6b8fc4:       03 00 45 88     sethi  %hi(0x1162000), %g1
  6b8fc8:       c4 07 20 10     ld  [ %i4 + 0x10 ], %g2
  6b8fcc:       c2 00 62 54     ld  [ %g1 + 0x254 ], %g1
  6b8fd0:       80 a0 80 01     cmp  %g2, %g1
  6b8fd4:       02 40 00 6b     be,pn   %icc, 6b9180 <free_percpu+0x560>
  6b8fd8:       03 00 45 88     sethi  %hi(0x1162000), %g1
  6b8fdc:       01 00 00 00     nop 
  6b8fe0:       01 00 00 00     nop 
  6b8fe4:       c2 5f a7 f7     ldx  [ %fp + 0x7f7 ], %g1
  6b8fe8:       91 90 40 00     wrpr  %g1, %pil
  6b8fec:       80 a6 e0 00     cmp  %i3, 0
  6b8ff0:       02 48 00 06     be  %icc, 6b9008 <free_percpu+0x3e8>
  6b8ff4:       03 00 48 7f     sethi  %hi(0x121fc00), %g1
  6b8ff8:       c2 08 61 5b     ldub  [ %g1 + 0x15b ], %g1      ! 121fd5b <pcpu_async_enabled>
  6b8ffc:       80 a0 60 00     cmp  %g1, 0
  6b9000:       12 40 00 73     bne,pn   %icc, 6b91cc <free_percpu+0x5ac>
  6b9004:       03 00 45 88     sethi  %hi(0x1162000), %g1
  6b9008:       81 cf e0 08     return  %i7 + 8
  6b900c:       01 00 00 00     nop 
  6b9010:       d0 5f 20 48     ldx  [ %i4 + 0x48 ], %o0
  6b9014:       87 2c f0 0b     sllx  %l3, 0xb, %g3
  6b9018:       95 36 e0 00     srl  %i3, 0, %o2
  6b901c:       87 30 f0 03     srlx  %g3, 3, %g3
  6b9020:       92 10 28 00     mov  0x800, %o1
  6b9024:       40 0c 1d ef     call  9c07e0 <_find_next_bit>
  6b9028:       90 02 00 03     add  %o0, %g3, %o0
  6b902c:       80 a4 80 1a     cmp  %l2, %i2
  6b9030:       12 4f ff 90     bne  %icc, 6b8e70 <free_percpu+0x250>
  6b9034:       b6 10 00 08     mov  %o0, %i3
  6b9038:       80 a0 00 17     cmp  %g0, %l7
  6b903c:       82 1e e8 00     xor  %i3, 0x800, %g1
  6b9040:       84 60 3f ff     subc  %g0, -1, %g2
  6b9044:       80 a0 00 01     cmp  %g0, %g1
  6b9048:       82 60 3f ff     subc  %g0, -1, %g1
  6b904c:       80 88 80 01     btst  %g2, %g1
  6b9050:       12 48 00 2c     bne  %icc, 6b9100 <free_percpu+0x4e0>
  6b9054:       94 10 28 00     mov  0x800, %o2
  6b9058:       b5 3d e0 00     sra  %l7, 0, %i2
  6b905c:       a5 3e e0 00     sra  %i3, 0, %l2
  6b9060:       94 10 00 12     mov  %l2, %o2
  6b9064:       92 10 00 1a     mov  %i2, %o1
  6b9068:       90 10 00 1d     mov  %i5, %o0
  6b906c:       7f ff f5 95     call  6b66c0 <pcpu_block_update>
  6b9070:       ae 26 c0 17     sub  %i3, %l7, %l7
  6b9074:       80 a5 e7 ff     cmp  %l7, 0x7ff
  6b9078:       38 47 ff a0     bgu,a,pn   %icc, 6b8ef8 <free_percpu+0x2d8>
  6b907c:       92 10 20 01     mov  1, %o1
  6b9080:       ab 2d 70 0b     sllx  %l5, 0xb, %l5
  6b9084:       94 10 00 12     mov  %l2, %o2
  6b9088:       92 05 40 1a     add  %l5, %i2, %o1
  6b908c:       90 07 20 14     add  %i4, 0x14, %o0
  6b9090:       7f ff f5 8c     call  6b66c0 <pcpu_block_update>
  6b9094:       93 3a 60 00     sra  %o1, 0, %o1
  6b9098:       10 6f ff 9b     b  %xcc, 6b8f04 <free_percpu+0x2e4>
  6b909c:       93 3c 60 00     sra  %l1, 0, %o1
  6b90a0:       f8 5f 20 40     ldx  [ %i4 + 0x40 ], %i4
  6b90a4:       03 00 4d e0     sethi  %hi(0x1378000), %g1
  6b90a8:       e6 47 a7 f3     ldsw  [ %fp + 0x7f3 ], %l3
  6b90ac:       fa 58 63 c0     ldx  [ %g1 + 0x3c0 ], %i5
  6b90b0:       02 c7 40 0c     brz,pn   %i5, 6b90e0 <free_percpu+0x4c0>
  6b90b4:       01 00 00 00     nop 
  6b90b8:       c2 5f 40 00     ldx  [ %i5 ], %g1
  6b90bc:       96 10 00 18     mov  %i0, %o3
  6b90c0:       94 10 00 13     mov  %l3, %o2
  6b90c4:       d0 5f 60 08     ldx  [ %i5 + 8 ], %o0
  6b90c8:       92 10 00 1c     mov  %i4, %o1
  6b90cc:       9f c0 40 00     call  %g1
  6b90d0:       ba 07 60 18     add  %i5, 0x18, %i5
  6b90d4:       c2 5f 40 00     ldx  [ %i5 ], %g1
  6b90d8:       0a f8 7f f8     brnz  %g1, 6b90b8 <free_percpu+0x498>
  6b90dc:       01 00 00 00     nop 
  6b90e0:       10 6f ff c2     b  %xcc, 6b8fe8 <free_percpu+0x3c8>
  6b90e4:       c2 5f a7 f7     ldx  [ %fp + 0x7f7 ], %g1
  6b90e8:       93 3d e0 00     sra  %l7, 0, %o1
  6b90ec:       90 10 00 1d     mov  %i5, %o0
  6b90f0:       7f ff f5 74     call  6b66c0 <pcpu_block_update>
  6b90f4:       a6 10 20 00     clr  %l3
  6b90f8:       10 6f ff 66     b  %xcc, 6b8e90 <free_percpu+0x270>
  6b90fc:       82 1e e8 00     xor  %i3, 0x800, %g1
  6b9100:       92 10 20 00     clr  %o1
  6b9104:       7f ff f5 6f     call  6b66c0 <pcpu_block_update>
  6b9108:       90 10 00 1d     mov  %i5, %o0
  6b910c:       86 10 20 01     mov  1, %g3
  6b9110:       c2 07 20 80     ld  [ %i4 + 0x80 ], %g1
  6b9114:       05 00 45 88     sethi  %hi(0x1162000), %g2
  6b9118:       c4 58 a2 08     ldx  [ %g2 + 0x208 ], %g2       ! 1162208 <pcpu_reserved_chunk>
  6b911c:       82 00 40 03     add  %g1, %g3, %g1
  6b9120:       80 a7 00 02     cmp  %i4, %g2
  6b9124:       02 67 ff 74     be,pn   %xcc, 6b8ef4 <free_percpu+0x2d4>
  6b9128:       c2 27 20 80     st  %g1, [ %i4 + 0x80 ]
  6b912c:       c2 0f 20 61     ldub  [ %i4 + 0x61 ], %g1
  6b9130:       80 a0 60 00     cmp  %g1, 0
  6b9134:       12 48 00 07     bne  %icc, 6b9150 <free_percpu+0x530>
  6b9138:       84 26 c0 17     sub  %i3, %l7, %g2
  6b913c:       05 00 51 d3     sethi  %hi(0x1474c00), %g2
  6b9140:       c2 00 a2 a0     ld  [ %g2 + 0x2a0 ], %g1        ! 1474ea0 <pcpu_nr_empty_pop_pages>
  6b9144:       82 00 40 03     add  %g1, %g3, %g1
  6b9148:       c2 20 a2 a0     st  %g1, [ %g2 + 0x2a0 ]
  6b914c:       84 26 c0 17     sub  %i3, %l7, %g2
  6b9150:       82 10 20 00     clr  %g1
  6b9154:       80 a0 a7 ff     cmp  %g2, 0x7ff
  6b9158:       a4 1e 80 12     xor  %i2, %l2, %l2
  6b915c:       83 67 20 01     movgu  %icc, 1, %g1
  6b9160:       80 a0 00 12     cmp  %g0, %l2
  6b9164:       84 40 20 00     addc  %g0, 0, %g2
  6b9168:       80 90 40 02     orcc  %g1, %g2, %g0
  6b916c:       32 4f ff 63     bne,a   %icc, 6b8ef8 <free_percpu+0x2d8>
  6b9170:       92 10 20 01     mov  1, %o1
  6b9174:       a5 3e e0 00     sra  %i3, 0, %l2
  6b9178:       10 6f ff c2     b  %xcc, 6b9080 <free_percpu+0x460>
  6b917c:       b5 3d e0 00     sra  %l7, 0, %i2
  6b9180:       05 00 45 88     sethi  %hi(0x1162000), %g2
  6b9184:       c2 40 62 48     ldsw  [ %g1 + 0x248 ], %g1
  6b9188:       c4 58 a2 00     ldx  [ %g2 + 0x200 ], %g2
  6b918c:       83 28 70 04     sllx  %g1, 4, %g1
  6b9190:       c6 58 80 01     ldx  [ %g2 + %g1 ], %g3
  6b9194:       84 00 80 01     add  %g2, %g1, %g2
  6b9198:       80 a0 80 03     cmp  %g2, %g3
  6b919c:       02 67 ff 90     be,pn   %xcc, 6b8fdc <free_percpu+0x3bc>
  6b91a0:       80 a0 c0 1c     cmp  %g3, %i4
  6b91a4:       32 67 ff 8e     bne,a,pn   %xcc, 6b8fdc <free_percpu+0x3bc>
  6b91a8:       b6 10 20 01     mov  1, %i3
  6b91ac:       c2 5f 00 00     ldx  [ %i4 ], %g1
  6b91b0:       80 a0 80 01     cmp  %g2, %g1
  6b91b4:       02 67 ff 8a     be,pn   %xcc, 6b8fdc <free_percpu+0x3bc>
  6b91b8:       80 a0 40 1c     cmp  %g1, %i4
  6b91bc:       02 6f ff fe     be  %xcc, 6b91b4 <free_percpu+0x594>
  6b91c0:       80 a0 80 01     cmp  %g2, %g1
  6b91c4:       10 6f ff 86     b  %xcc, 6b8fdc <free_percpu+0x3bc>
  6b91c8:       b6 10 20 01     mov  1, %i3
  6b91cc:       15 00 4b b7     sethi  %hi(0x12edc00), %o2
  6b91d0:       d2 58 60 50     ldx  [ %g1 + 0x50 ], %o1
  6b91d4:       94 12 a2 d8     or  %o2, 0x2d8, %o2
  6b91d8:       7f f7 6c 9a     call  494440 <queue_work_on>
  6b91dc:       90 10 20 01     mov  1, %o0
  6b91e0:       81 cf e0 08     return  %i7 + 8
  6b91e4:       01 00 00 00     nop 
  6b91e8:       10 6f fe e2     b  %xcc, 6b8d70 <free_percpu+0x150>
  6b91ec:       e2 00 62 48     ld  [ %g1 + 0x248 ], %l1
  6b91f0:       40 21 7b ec     call  f181a0 <arch_atomic64_sub_return>
  6b91f4:       90 10 20 01     mov  1, %o0
  6b91f8:       0a fa 3f 6f     brnz  %o0, 6b8fb4 <free_percpu+0x394>
  6b91fc:       01 00 00 00     nop 
  6b9200:       c2 5f 60 08     ldx  [ %i5 + 8 ], %g1
  6b9204:       c2 58 60 08     ldx  [ %g1 + 8 ], %g1
  6b9208:       9f c0 40 00     call  %g1
  6b920c:       90 10 00 1d     mov  %i5, %o0
  6b9210:       10 6f ff 69     b  %xcc, 6b8fb4 <free_percpu+0x394>
  6b9214:       01 00 00 00     nop

[glaubitz]

Another triggered crash:

[  108.668786] systemd-journald[185]: Time jumped backwards, rotating.
[  109.856468] systemd-sysv-generator[1113]: SysV service '/etc/init.d/buildd' lacks a native systemd unit file, automatically generating a unit file for compatibility.
[  110.051293] systemd-sysv-generator[1113]: Please update package to include a native systemd unit file.
[  110.174500] systemd-sysv-generator[1113]: ⚠ This compatibility logic is deprecated, expect removal soon. ⚠
[  111.342556] log_unaligned: 324 callbacks suppressed
[  111.342571] Kernel unaligned access at TPC[5e3640] scc_visit_lookup.isra.0+0x20/0xa0
[  111.508621] Unable to handle kernel paging request in mna handler
[  111.508626]  at virtual address 6a8999f64242c7d5
[  111.649375] current->{active_,}mm->context = 00000000000000ab
[  111.724865] current->{active_,}mm->pgd = fff0000007c50000
[  111.795775]               \|/ ____ \|/
[  111.795775]               "@'/ .. \`@"
[  111.795775]               /_| \__/ |_\
[  111.795775]                  \__U_/
[  111.989087] systemd(1): Oops [#1]
[  112.032535] CPU: 0 UID: 0 PID: 1 Comm: systemd Not tainted 6.18.0-rc2+ #6 NONE 
[  112.128627] TSTATE: 0000000011001603 TPC: 00000000005e3640 TNPC: 00000000005e3644 Y: 00000000    Not tainted
[  112.257966] TPC: <scc_visit_lookup.isra.0+0x20/0xa0>
[  112.323154] g0: fff0000000c55b00 g1: 0000000000000028 g2: 0000000000000062 g3: 000000010003e1b0
[  112.437530] g4: fff00000001de1c0 g5: 0000000000657300 g6: fff0000000234000 g7: 0000000000000000
[  112.551909] o0: fff000000b02e720 o1: 0000000000000000 o2: 0000000000000000 o3: fff000000b02e720
[  112.666283] o4: 0000000000000000 o5: fff0000000c55b08 sp: fff0000000236dd1 ret_pc: 0000000000000000
[  112.785230] RPC: <0x0>
[  112.816102] l0: 0000000000000000 l1: fff00000084be000 l2: ffffffffffffffff l3: 00000000010e0098
[  112.930486] l4: 0000000100032000 l5: fff00000084be000 l6: fff00000084be000 l7: 0000000000000000
[  113.044869] i0: 6a8999f64242c7d5 i1: fff000000b02e720 i2: 6a8999f64242c7dd i3: 0000000000000000
[  113.159236] i4: 0000000000000000 i5: 0000000000000000 i6: fff0000000236e81 i7: 00000000006045ac
[  113.273610] I7: <do_check_common+0xb0c/0x36c0>
[  113.331937] Call Trace:
[  113.363962] [<00000000006045ac>] do_check_common+0xb0c/0x36c0
[  113.439449] [<000000000060aec4>] bpf_check+0x2f04/0x3520
[  113.509220] [<00000000005d9e7c>] bpf_prog_load+0x8fc/0xe20
[  113.581275] [<00000000005dbbb0>] __sys_bpf+0xd10/0x2700
[  113.649898] [<00000000005ddb78>] sys_bpf+0x18/0x60
[  113.712806] [<0000000000406174>] linux_sparc_syscall+0x34/0x44
[  113.789439] Disabling lock debugging due to kernel taint
[  113.859207] Caller[00000000006045ac]: do_check_common+0xb0c/0x36c0
[  113.940410] Caller[000000000060aec4]: bpf_check+0x2f04/0x3520
[  114.015901] Caller[00000000005d9e7c]: bpf_prog_load+0x8fc/0xe20
[  114.093674] Caller[00000000005dbbb0]: __sys_bpf+0xd10/0x2700
[  114.168018] Caller[00000000005ddb78]: sys_bpf+0x18/0x60
[  114.236643] Caller[0000000000406174]: linux_sparc_syscall+0x34/0x44
[  114.318996] Caller[fff000010089b74c]: 0xfff000010089b74c
[  114.388760] Instruction DUMP:
[  114.388763]  f05e0001 
[  114.427646]  02c6001a 
[  114.458528]  b4062008 
[  114.489408] <f6060000>
[  114.520290]  80a6e000 
[  114.551177]  02400015 
[  114.582053]  b810001a 
[  114.612935]  10680005 
[  114.643816]  ba102000 
[  114.674696] 
[  114.725022] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[  114.825678] Press Stop-A (L1-A) from sun keyboard or send break
[  114.825678] twice on console to return to the boot prom
[  114.972070] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 ]---

[glaubitz]

Another backtrace:

[  102.918380] systemd-journald[185]: Time jumped backwards, rotating.
[  120.117276] systemd-sysv-generator[1211]: SysV service '/etc/init.d/buildd' lacks a native systemd unit file, automatically generating a unit file for compatibility.
[  120.311873] systemd-sysv-generator[1211]: Please update package to include a native systemd unit file.
[  120.435192] systemd-sysv-generator[1211]: ⚠ This compatibility logic is deprecated, expect removal soon. ⚠
[  123.373042] systemd-sysv-generator[1250]: SysV service '/etc/init.d/buildd' lacks a native systemd unit file, automatically generating a unit file for compatibility.
[  123.568045] systemd-sysv-generator[1250]: Please update package to include a native systemd unit file.
[  123.691271] systemd-sysv-generator[1250]: ⚠ This compatibility logic is deprecated, expect removal soon. ⚠
[  127.244405] systemd-sysv-generator[1298]: SysV service '/etc/init.d/buildd' lacks a native systemd unit file, automatically generating a unit file for compatibility.
[  127.439031] systemd-sysv-generator[1298]: Please update package to include a native systemd unit file.
[  127.562133] systemd-sysv-generator[1298]: ⚠ This compatibility logic is deprecated, expect removal soon. ⚠
[  128.714839] Unable to handle kernel paging request at virtual address 00020000096c2000
[  128.819006] tsk->{mm,active_mm}->context = 00000000000000ab
[  128.892276] tsk->{mm,active_mm}->pgd = fff0000007e38000
[  128.960980]               \|/ ____ \|/
[  128.960980]               "@'/ .. \`@"
[  128.960980]               /_| \__/ |_\
[  128.960980]                  \__U_/
[  129.154290] systemd(1): Oops [#1]
[  129.197842] CPU: 0 UID: 0 PID: 1 Comm: systemd Not tainted 6.18.0-rc2+ #6 NONE 
[  129.293921] TSTATE: 0000004411001601 TPC: 00000000005d57a4 TNPC: 00000000005d57a8 Y: 00000000    Not tainted
[  129.423169] TPC: <bpf_prog_get_type_dev+0x64/0xc0>
[  129.486166] g0: fff00000001672f8 g1: 0000000000000008 g2: 0000000000f3d498 g3: fff000000930a800
[  129.600547] g4: fff00000001d0000 g5: 00000000656d642d g6: fff0000000234000 g7: 0000000000000000
[  129.714923] o0: fff0000004f9e540 o1: 00020000096c3800 o2: fff0000000237dbc o3: 0000000000000000
[  129.829302] o4: fff00000051c4d80 o5: fff0000000195680 sp: fff0000000237231 ret_pc: 00000000005d574c
[  129.948249] RPC: <bpf_prog_get_type_dev+0xc/0xc0>
[  130.010003] l0: 0000010000206010 l1: fff0000101300e28 l2: 9842e73d2142fa99 l3: 0000000000000000
[  130.124384] l4: 0000000000000000 l5: 0000000000000000 l6: 0000000000000000 l7: fff00001005ffb28
[  130.238760] i0: 00000001000e2000 i1: 0000000000000008 i2: 0000000000000000 i3: 0000000000000000
[  130.353132] i4: fff0000004f9e540 i5: fff0000004f9e540 i6: fff00000002372e1 i7: 0000000000653c08
[  130.467509] I7: <cgroup_bpf_prog_detach+0x28/0x160>
[  130.531554] Call Trace:
[  130.563577] [<0000000000653c08>] cgroup_bpf_prog_detach+0x28/0x160
[  130.644787] [<00000000005dca70>] __sys_bpf+0x1bd0/0x2700
[  130.714557] [<00000000005ddb78>] sys_bpf+0x18/0x60
[  130.777462] [<0000000000406174>] linux_sparc_syscall+0x34/0x44
[  130.854095] Disabling lock debugging due to kernel taint
[  130.923860] Caller[0000000000653c08]: cgroup_bpf_prog_detach+0x28/0x160
[  131.010787] Caller[00000000005dca70]: __sys_bpf+0x1bd0/0x2700
[  131.086273] Caller[00000000005ddb78]: sys_bpf+0x18/0x60
[  131.154898] Caller[0000000000406174]: linux_sparc_syscall+0x34/0x44
[  131.237249] Caller[fff000010079b74c]: 0xfff000010079b74c
[  131.307016] Instruction DUMP:
[  131.307020]  32480010 
[  131.345902]  ba0f6001 
[  131.376783]  d25e2050 
[  131.407662] <c20a6092>
[  131.438548]  82186001 
[  131.469428]  8210401a 
[  131.500306]  808860ff 
[  131.531189]  02400008 
[  131.562074]  90102001 
[  131.592952] 
[  131.643279] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[  131.743934] Press Stop-A (L1-A) from sun keyboard or send break
[  131.743934] twice on console to return to the boot prom
[  131.890325] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009 ]---