kernel 3.18.10: THP refcounting bug
A message that is not in the archive (sent off-list or not yet received): [email protected]
A message that is not in the archive (sent off-list or not yet received): [email protected]
Hi,
while using 3.18.9 i got several times the following stack trace:
kernel BUG at mm/filemap.c:203!
invalid opcode: 0000 [#1] SMP
Modules linked in: dm_mod netconsole usbhid sd_mod sg ata_generic virtio_net virtio_scsi uhci_hcd ehci_hcd usbcore virtio_pci usb_common virtio_ring ata_piix virtio floppy CPU: 3 PID: 1 Comm: busybox Tainted: G B 3.18.9 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014 task: ffff880137b98000 ti: ffff880137b94000 task.ti: ffff880137b94000 RIP: 0010:[<ffffffff81134495>] [<ffffffff81134495>] __delete_from_page_cache+0x2b5/0x2c0 RSP: 0018:ffff880137b97be8 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00000000ffffffd0 RDX: 0000000000000030 RSI: 000000000000000a RDI: ffff88013f9696c0 RBP: ffff880137b97c38 R08: 0000000000000000 R09: ffffea0002e927c0 R10: ffff8800bba92da0 R11: ffff880137b97c00 R12: ffffea0002e92480 R13: ffff8800bba8c4c8 R14: 0000000000000000 R15: ffff8800bba8c4d0 FS: 00007f5a79e0b700(0000) GS:ffff880139060000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000023c3138 CR3: 00000000b84ba000 CR4: 00000000000006e0 Stack: 000000000000000e ffff880137b97d48 ffff8800bba92da0 ffff8800bba92dc8 ffff880137b97c68 ffffea0002e92480 ffff8800bba8c4c8 0000000000000000 0000000000000000 0000000000000000 ffff880137b97c68 ffffffff81134604 Call Trace: [<ffffffff81134604>] delete_from_page_cache+0x44/0x70 [<ffffffff811413cb>] truncate_inode_page+0x5b/0x90 [<ffffffff811415a4>] truncate_inode_pages_range+0x1a4/0x6c0 [<ffffffff81141b45>] truncate_inode_pages+0x15/0x20 [<ffffffff81141c4c>] truncate_inode_pages_final+0x3c/0x50 [<ffffffff811bb83c>] evict+0x16c/0x180 [<ffffffff811bbed5>] iput+0x105/0x190 [<ffffffff811b0c19>] do_unlinkat+0x189/0x2b0 [<ffffffff811b1a46>] SyS_unlink+0x16/0x20 [<ffffffff815f6592>] system_call_fastpath+0x12/0x17 Code: 66 0f 1f 44 00 00 48 8b 75 c0 4c 89 ff e8 e4 5d 1f 00 84 c0 0f 85
5e fe ff ff e9 41 fe ff ff 0f 1f 80 00 00 00 00 e8 75 70 4b 00 <0f> 0b 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 83 e2 fd 48 RIP [<ffffffff81134495>] __delete_from_page_cache+0x2b5/0x2c0
RSP <ffff880137b97be8>
---[ end trace a4727cb71335dbd4 ]---
Is this a known bug?
Thanks!
--
Greets,
Stefan
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
Quoted 40 lines · Stefan Priebe - Profihost AG
Hi,
while using 3.18.9 i got several times the following stack trace:
kernel BUG at
mm/filemap.c:203!
invalid opcode: 0000 [#1] SMPModules linked in: dm_mod netconsole usbhid sd_mod sg ata_generic virtio_net virtio_scsi uhci_hcd ehci_hcd usbcore virtio_pci usb_common virtio_ring ata_piix virtio floppy CPU: 3 PID: 1 Comm: busybox Tainted: G B 3.18.9 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014 task: ffff880137b98000 ti: ffff880137b94000 task.ti: ffff880137b94000 RIP: 0010:[<ffffffff81134495>] [<ffffffff81134495>] __delete_from_page_cache+0x2b5/0x2c0 RSP: 0018:ffff880137b97be8 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00000000ffffffd0 RDX: 0000000000000030 RSI: 000000000000000a RDI: ffff88013f9696c0 RBP: ffff880137b97c38 R08: 0000000000000000 R09: ffffea0002e927c0 R10: ffff8800bba92da0 R11: ffff880137b97c00 R12: ffffea0002e92480 R13: ffff8800bba8c4c8 R14: 0000000000000000 R15: ffff8800bba8c4d0 FS: 00007f5a79e0b700(0000) GS:ffff880139060000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000023c3138 CR3: 00000000b84ba000 CR4: 00000000000006e0 Stack: 000000000000000e ffff880137b97d48 ffff8800bba92da0 ffff8800bba92dc8 ffff880137b97c68 ffffea0002e92480 ffff8800bba8c4c8 0000000000000000 0000000000000000 0000000000000000 ffff880137b97c68 ffffffff81134604 Call Trace: [<ffffffff81134604>] delete_from_page_cache+0x44/0x70 [<ffffffff811413cb>] truncate_inode_page+0x5b/0x90 [<ffffffff811415a4>] truncate_inode_pages_range+0x1a4/0x6c0 [<ffffffff81141b45>] truncate_inode_pages+0x15/0x20 [<ffffffff81141c4c>] truncate_inode_pages_final+0x3c/0x50 [<ffffffff811bb83c>] evict+0x16c/0x180 [<ffffffff811bbed5>] iput+0x105/0x190 [<ffffffff811b0c19>] do_unlinkat+0x189/0x2b0 [<ffffffff811b1a46>] SyS_unlink+0x16/0x20 [<ffffffff815f6592>] system_call_fastpath+0x12/0x17 Code: 66 0f 1f 44 00 00 48 8b 75 c0 4c 89 ff e8 e4 5d 1f 00 84 c0 0f 85
Quoted 7 lines
5e fe ff ff e9 41 fe ff ff 0f 1f 80 00 00 00 00 e8 75 70 4b 00 <0f> 0b 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 83 e2 fd 48 RIP [<
ffffffff81134495>]__delete_from_page_cache+0x2b5/0x2c0
RSP <ffff880137b97be8>---[ end trace a4727cb71335dbd4 ]---Is this a known bug?
+Hugh, Konstantin.
Nothing I recognize. Looks somewhat like[1], but not really.
Do you have a way to reproduce? What fs it was?
[1] lkml.kernel.org/g/[email protected]
Signature · 7 lines
Kirill A. Shutemov -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
Quoted 11 lines · Kirill A. Shutemov
Quoted 10 lines · Stefan Priebe - Profihost AG
Hi,
while using 3.18.9 i got several times the following stack trace:
kernel BUG at
mm/filemap.c:203!
invalid opcode: 0000 [#1] SMPModules linked in: dm_mod netconsole usbhid sd_mod sg ata_generic virtio_net virtio_scsi uhci_hcd ehci_hcd usbcore virtio_pci usb_common virtio_ring ata_piix virtio floppy CPU: 3 PID: 1 Comm: busybox Tainted: G B 3.18.9 #1
The "B" in that Tainted string means that earlier Stefan got a "Bad page" report. Please look for that in /var/log/messages, and post us what it said.
It's not at all surprising to hit a BUG_ON(page_mapped(page)) after we already know that the page refcounting is messed up; though of course it's possible that the two are unrelated (and perhaps weeks apart).
Quoted 38 lines
Quoted 30 lines
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014 task: ffff880137b98000 ti: ffff880137b94000 task.ti: ffff880137b94000 RIP: 0010:[<ffffffff81134495>] [<ffffffff81134495>] __delete_from_page_cache+0x2b5/0x2c0 RSP: 0018:ffff880137b97be8 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00000000ffffffd0 RDX: 0000000000000030 RSI: 000000000000000a RDI: ffff88013f9696c0 RBP: ffff880137b97c38 R08: 0000000000000000 R09: ffffea0002e927c0 R10: ffff8800bba92da0 R11: ffff880137b97c00 R12: ffffea0002e92480 R13: ffff8800bba8c4c8 R14: 0000000000000000 R15: ffff8800bba8c4d0 FS: 00007f5a79e0b700(0000) GS:ffff880139060000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000023c3138 CR3: 00000000b84ba000 CR4: 00000000000006e0 Stack: 000000000000000e ffff880137b97d48 ffff8800bba92da0 ffff8800bba92dc8 ffff880137b97c68 ffffea0002e92480 ffff8800bba8c4c8 0000000000000000 0000000000000000 0000000000000000 ffff880137b97c68 ffffffff81134604 Call Trace: [<ffffffff81134604>] delete_from_page_cache+0x44/0x70 [<ffffffff811413cb>] truncate_inode_page+0x5b/0x90 [<ffffffff811415a4>] truncate_inode_pages_range+0x1a4/0x6c0 [<ffffffff81141b45>] truncate_inode_pages+0x15/0x20 [<ffffffff81141c4c>] truncate_inode_pages_final+0x3c/0x50 [<ffffffff811bb83c>] evict+0x16c/0x180 [<ffffffff811bbed5>] iput+0x105/0x190 [<ffffffff811b0c19>] do_unlinkat+0x189/0x2b0 [<ffffffff811b1a46>] SyS_unlink+0x16/0x20 [<ffffffff815f6592>] system_call_fastpath+0x12/0x17 Code: 66 0f 1f 44 00 00 48 8b 75 c0 4c 89 ff e8 e4 5d 1f 00 84 c0 0f 85Quoted 7 lines
5e fe ff ff e9 41 fe ff ff 0f 1f 80 00 00 00 00 e8 75 70 4b 00 <0f> 0b 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 83 e2 fd 48 RIP [<
ffffffff81134495>]__delete_from_page_cache+0x2b5/0x2c0
RSP <ffff880137b97be8>---[ end trace a4727cb71335dbd4 ]---Is this a known bug?
Quoted 7 lines
+Hugh, Konstantin.
Nothing I recognize. Looks somewhat like[1], but not really.
Do you have a way to reproduce? What fs it was?
[1] lkml.kernel.org/g/[email protected]
I put a lot of thought into that one, but never found a convincing answer. Either it went away, or Dave grew tired of re-reporting it and getting no fix.
For an instant, I wondered if your recent discovery of page mapcount being used for two purposes on a compound tail could account for these; but I don't think so, Stefan's stacktrace shows we're dealing with an ordinary filesystem page, which should be neither compound nor tail.
Hugh
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
Quoted 11 lines · Kirill A. Shutemov
Quoted 10 lines · Stefan Priebe - Profihost AG
Hi,
while using 3.18.9 i got several times the following stack trace:
kernel BUG at
mm/filemap.c:203!
invalid opcode: 0000 [#1] SMPModules linked in: dm_mod netconsole usbhid sd_mod sg ata_generic virtio_net virtio_scsi uhci_hcd ehci_hcd usbcore virtio_pci usb_common virtio_ring ata_piix virtio floppy CPU: 3 PID: 1 Comm: busybox Tainted: G B 3.18.9 #1
As I see this isn't first oops -> kernel already tainted with 'B' Bad-page-state.
Please look at first splash where is no 'B' flag.
Quoted 40 lines
Quoted 30 lines
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014 task: ffff880137b98000 ti: ffff880137b94000 task.ti: ffff880137b94000 RIP: 0010:[<ffffffff81134495>] [<ffffffff81134495>] __delete_from_page_cache+0x2b5/0x2c0 RSP: 0018:ffff880137b97be8 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00000000ffffffd0 RDX: 0000000000000030 RSI: 000000000000000a RDI: ffff88013f9696c0 RBP: ffff880137b97c38 R08: 0000000000000000 R09: ffffea0002e927c0 R10: ffff8800bba92da0 R11: ffff880137b97c00 R12: ffffea0002e92480 R13: ffff8800bba8c4c8 R14: 0000000000000000 R15: ffff8800bba8c4d0 FS: 00007f5a79e0b700(0000) GS:ffff880139060000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000023c3138 CR3: 00000000b84ba000 CR4: 00000000000006e0 Stack: 000000000000000e ffff880137b97d48 ffff8800bba92da0 ffff8800bba92dc8 ffff880137b97c68 ffffea0002e92480 ffff8800bba8c4c8 0000000000000000 0000000000000000 0000000000000000 ffff880137b97c68 ffffffff81134604 Call Trace: [<ffffffff81134604>] delete_from_page_cache+0x44/0x70 [<ffffffff811413cb>] truncate_inode_page+0x5b/0x90 [<ffffffff811415a4>] truncate_inode_pages_range+0x1a4/0x6c0 [<ffffffff81141b45>] truncate_inode_pages+0x15/0x20 [<ffffffff81141c4c>] truncate_inode_pages_final+0x3c/0x50 [<ffffffff811bb83c>] evict+0x16c/0x180 [<ffffffff811bbed5>] iput+0x105/0x190 [<ffffffff811b0c19>] do_unlinkat+0x189/0x2b0 [<ffffffff811b1a46>] SyS_unlink+0x16/0x20 [<ffffffff815f6592>] system_call_fastpath+0x12/0x17 Code: 66 0f 1f 44 00 00 48 8b 75 c0 4c 89 ff e8 e4 5d 1f 00 84 c0 0f 85Quoted 7 lines
5e fe ff ff e9 41 fe ff ff 0f 1f 80 00 00 00 00 e8 75 70 4b 00 <0f> 0b 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 83 e2 fd 48 RIP [<
ffffffff81134495>]__delete_from_page_cache+0x2b5/0x2c0
RSP <ffff880137b97be8>---[ end trace a4727cb71335dbd4 ]---Is this a known bug?
+Hugh, Konstantin.
Quoted 8 lines
Nothing I recognize. Looks somewhat like[1], but not really.
Do you have a way to reproduce? What fs it was?
[1] lkml.kernel.org/g/[email protected]
--
Kirill A. Shutemov
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
A message that is not in the archive (sent off-list or not yet received): [email protected]
A message that is not in the archive (sent off-list or not yet received): [email protected]
A message that is not in the archive (sent off-list or not yet received): [email protected]
linux-mm@ was incorrect in the original mail so this ended up getting around just between us.
Below is Stefan's response to my question about the 'B' taint flag.
Quoted 78 lines · Stefan Priebe
Am 01.04.2015 um 17:46 schrieb Sasha Levin:
Quoted 12 lines · Stefan Priebe - Profihost AG
Quoted 10 lines
Hi,
while using 3.18.9 i got several times the following stack trace:
kernel BUG at
mm/filemap.c:203!
invalid opcode: 0000 [#1] SMPModules linked in: dm_mod netconsole usbhid sd_mod sg ata_generic virtio_net virtio_scsi uhci_hcd ehci_hcd usbcore virtio_pci usb_common virtio_ring ata_piix virtio floppy CPU: 3 PID: 1 Comm: busybox Tainted: G B 3.18.9 #1Quoted 2 lines
Looking at the taint flags, was there anything else before this that could set the 'B' flag?
oh i'm sorry you're correct before that one i see (happens on shutdown):
BUG: Bad page map in process udevd pte:ba4a2025 pmd:ba275067 page:ffffea0002e92880 count:1 mapcount:-1 mapping:ffff8800bba8c4c8 index:0x10 flags: 0x1fffff8000007c(referenced|uptodate|dirty|lru|active) page dumped because: bad pte addr:0000000000410000 vm_flags:00000875 anon_vma: (null) mapping:ffff8800bba8c4c8 index:10 vma->vm_ops->fault: filemap_fault+0x0/0x480 vma->vm_file->f_op->mmap: generic_file_mmap+0x0/0x60 CPU: 7 PID: 105 Comm: udevd Not tainted 3.18.9+14-ph #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014
ffff880136ca58c0ffff8800b9c8bc58ffffffff815f073200000000072b072b0000000000410000ffff8800b9c8bca8ffffffff8115b5b600000000ba4a20250000000000000010ffff8800b9c8bca80000000000424000ffff8800ba275080Call Trace: [<ffffffff815f0732>] dump_stack+0x46/0x58 [<ffffffff8115b5b6>] print_bad_pte+0x196/0x240 [<ffffffff8115d3c9>] unmap_single_vma+0x729/0x7f0 [<ffffffff8115d801>] unmap_vmas+0x51/0xa0 [<ffffffff811666c5>] exit_mmap+0xc5/0x170 [<ffffffff810713c5>] mmput+0x55/0x100 [<ffffffff8107631d>] do_exit+0x25d/0xa30 [<ffffffff8116552f>] ? do_munmap+0x30f/0x3b0 [<ffffffff81076b7f>] do_group_exit+0x3f/0xa0 [<ffffffff81076bf7>] SyS_exit_group+0x17/0x20 [<ffffffff815f6592>] system_call_fastpath+0x12/0x17 Disabling lock debugging due to kernel taint BUG: Bad page state in process udevd pfn:ba4a2 page:ffffea0002e92880 count:0 mapcount:-1 mapping:ffff8800bba8c4c8 index:0x10 flags: 0x1fffff8000001c(referenced|uptodate|dirty) page dumped because: non-NULL mapping Modules linked in: dm_mod netconsole usbhid sd_mod sg ata_generic virtio_net virtio_scsi uhci_hcd ehci_hcd usbcore virtio_pci usb_co mmon virtio_ring ata_piix virtio floppy CPU: 7 PID: 105 Comm: udevd Tainted: G B 3.18.9+14-ph #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014
ffffffff81805618ffff8800b9c8bba8ffffffff815f07320000000007700770ffffea0002e92880ffff8800b9c8bbd8ffffffff815eb8010000000000000000ffffea0002e928800000000000000000000fffff80000000ffff8800b9c8bc28Call Trace: [<ffffffff815f0732>] dump_stack+0x46/0x58 [<ffffffff815eb801>] bad_page+0xf7/0x115 [<ffffffff81137c22>] free_pages_prepare+0x152/0x180 [<ffffffff8113a130>] free_hot_cold_page+0x40/0x160 [<ffffffff8113a29e>] free_hot_cold_page_list+0x4e/0xa0 [<ffffffff8113fcd3>] release_pages+0x1f3/0x280 [<ffffffff8117142d>] free_pages_and_swap_cache+0x8d/0xa0 [<ffffffff8115b6c4>] tlb_flush_mmu_free+0x34/0x60 [<ffffffff8115bbe4>] tlb_flush_mmu+0x24/0x30 [<ffffffff8115bc04>] tlb_finish_mmu+0x14/0x40 [<ffffffff811666f4>] exit_mmap+0xf4/0x170 [<ffffffff810713c5>] mmput+0x55/0x100 [<ffffffff8107631d>] do_exit+0x25d/0xa30 [<ffffffff8116552f>] ? do_munmap+0x30f/0x3b0 [<ffffffff81076b7f>] do_group_exit+0x3f/0xa0 [<ffffffff81076bf7>] SyS_exit_group+0x17/0x20 [<ffffffff815f6592>] system_call_fastpath+0x12/0x17 ------------[ cut here ]------------
Quoted 7 lines
Stefan
Quoted 5 lines
Thanks,
Sasha
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>