mm,x86: warning at arch/x86/mm/pat.c:781 untrack_pfn+0x65/0xb0()

Hi all,

While fuzzing with trinity inside a KVM tools guest running the latest -next kernel I've stumbled on the following:

[ 3431.738346] WARNING: CPU: 12 PID: 17371 at arch/x86/mm/pat.c:781 untrack_pfn+0x65/0xb0()
[ 3431.741153] Modules linked in:
[ 3431.742138] CPU: 12 PID: 17371 Comm: trinity-c361 Not tainted 3.14.0-next-20140410-sasha-00022-gb3d9015-dirty #390
[ 3431.745365]  0000000000000009 ffff8801b5635be8 ffffffffae51f40b 0000000000005b10
[ 3431.747699]  0000000000000000 ffff8801b5635c28 ffffffffab15a37c ffff8801b5635c38
[ 3431.750401]  ffff8802e8fd2e00 0000000000000000 ffff8801b5635d68 ffff8801b5635d68
[ 3431.752853] Call Trace:
[ 3431.753625] dump_stack (lib/dump_stack.c:52)
[ 3431.755244] warn_slowpath_common (kernel/panic.c:418)
[ 3431.757062] warn_slowpath_null (kernel/panic.c:453)
[ 3431.758828] untrack_pfn (arch/x86/mm/pat.c:781 (discriminator 3))
[ 3431.760785] unmap_single_vma (mm/memory.c:1316)
[ 3431.762703] ? sched_clock (arch/x86/include/asm/paravirt.h:192 arch/x86/kernel/tsc.c:305)
[ 3431.764366] ? sched_clock_local (kernel/sched/clock.c:214)
[ 3431.766253] ? move_page_tables (mm/mremap.c:156 mm/mremap.c:217)
[ 3431.768071] unmap_vmas (mm/memory.c:1366 (discriminator 1))
[ 3431.769686] unmap_region (mm/mmap.c:2361 (discriminator 3))
[ 3431.771776] ? validate_mm_rb (mm/mmap.c:401)
[ 3431.773606] ? vma_rb_erase (mm/mmap.c:446 include/linux/rbtree_augmented.h:219 include/linux/rbtree_augmented.h:227 mm/mmap.c:485)
[ 3431.775268] do_munmap (mm/mmap.c:3259 mm/mmap.c:2559)
[ 3431.777012] move_vma (mm/mremap.c:306)
[ 3431.778621] SyS_mremap (mm/mremap.c:439 mm/mremap.c:501 mm/mremap.c:470)
[ 3431.780576] tracesys (arch/x86/kernel/entry_64.S:749)

Thanks,
Sasha

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>

Ping? Still happening (rarely on -next):

[ 5818.038245] WARNING: CPU: 4 PID: 22726 at arch/x86/mm/pat.c:781 untrack_pfn+0x65/0xb0()
[ 5818.044203] Modules linked in:
[ 5818.045172] CPU: 4 PID: 22726 Comm: trinity-c239 Tainted: G        W     3.15.0-rc8-next-20140606-sasha-00021-ga9d3a0b-dirty #596
[ 5818.048317]  0000000000000009 ffff8800024d3be8 ffffffff9e50fe6b 0000000000000001
[ 5818.050516]  0000000000000000 ffff8800024d3c28 ffffffff9b15f96c ffff8800024d3c38
[ 5818.052567]  ffff88000203f400 0000000000000000 ffff8800024d3d68 ffff8800024d3d68
[ 5818.053785] Call Trace:
[ 5818.054483] dump_stack (lib/dump_stack.c:52)
[ 5818.055586] warn_slowpath_common (kernel/panic.c:430)
[ 5818.056763] warn_slowpath_null (kernel/panic.c:465)
[ 5818.057789] untrack_pfn (arch/x86/mm/pat.c:781 (discriminator 3))
[ 5818.059412] unmap_single_vma (mm/memory.c:1327)
[ 5818.061530] ? pagevec_lru_move_fn (include/linux/pagevec.h:44 mm/swap.c:435)
[ 5818.063412] unmap_vmas (mm/memory.c:1377 (discriminator 1))
[ 5818.064610] unmap_region (mm/mmap.c:2363 (discriminator 3))
[ 5818.065453] ? validate_mm_rb (mm/mmap.c:404)
[ 5818.066422] ? vma_rb_erase (mm/mmap.c:449 include/linux/rbtree_augmented.h:219 include/linux/rbtree_augmented.h:227 mm/mmap.c:488)
[ 5818.067316] do_munmap (mm/mmap.c:3359 mm/mmap.c:2561)
[ 5818.068126] move_vma (mm/mremap.c:313)
[ 5818.069000] SyS_mremap (mm/mremap.c:446 mm/mremap.c:508 mm/mremap.c:477)
[ 5818.069839] tracesys (arch/x86/kernel/entry_64.S:542)

Thanks,
Sasha

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>

I could easily be wrong, but I think of this one as another manifestation of the filemap.c:202 BUG_ON(page_mapped(page)) bug, whatever that is.

In each case, we have a BUG or WARNING at the point where we detect that there should have been a pte in a page table, but it somehow disappeared.

VM_PFNMAP in this case, an ordinary file mapping in the other case; and nothing to show in the anonymous case, there the page would just leak.

Hugh

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>