Hi,
I open the Transparent huge page and run the system and hit the bug
in huge_memory.c:
static void __split_huge_page_refcount(struct page *page)
.
.
.
/* tail_page->_mapcount cannot change */
BUG_ON(page_mapcount(page_tail) < 0);
.
.
In my understanding, the THP's tail page's mapcount is initialized to
-1, page_mapcout(page_tail) should be 0.
Did anyone meet the same issue?
Thanks.
2016-09-28 02:12:08 [810422.485203] ------------[ cut here ]------------
2016-09-28 02:12:08 [810422.489974] kernel BUG at mm/huge_memory.c:1187!
2016-09-28 02:12:08 [810422.494742] invalid opcode: 0000 [#1] SMP
2016-09-28 02:12:08 [810422.499034] last sysfs file:
/sys/devices/system/cpu/online
2016-09-28 02:12:08 [810422.504757] CPU 31
2016-09-28 02:12:08 [810422.506775] Modules linked in: 8021q garp
bridge stp llc dell_rbu ipmi_devintf ipmi_si ipmi_msghandler bonding
ipv6 microcode dca power_meter ext4 mbcache jbd2 ahci wmi dm_mirror
dm_region_hash dm_log dm_mod
2016-09-28 02:12:08 [810422.571439]
2016-09-28 02:12:08 [810422.573088] Pid: 10729, comm: observer
Tainted: G W ---------------- 2.6.32-220.23.2.el6.x86_64
2016-09-28 02:12:08 [810422.586827] RIP: 0010:[] [] split_huge_page+0x7c4/0x800
2016-09-28 02:12:08 [810422.595498] RSP: 0018:ffff887661c9fcd8 EFLAGS: 00010086
2016-09-28 02:12:08 [810422.600956] RAX: 00000000ffffffff RBX:
ffffea011b4d4000 RCX: ffffc9003018b000
2016-09-28 02:12:08 [810422.608300] RDX: 0000000000000002 RSI:
ffff887f4fb3b400 RDI: 0000000000000004
2016-09-28 02:12:08 [810422.615644] RBP: ffff887661c9fd88 R08:
000000000000007d R09: ffff880000000000
2016-09-28 02:12:08 [810422.622983] R10: 0000000000000000 R11:
0000000000000287 R12: ffffea011b4cdfc0
2016-09-28 02:12:08 [810422.630325] R13: 0000000000000000 R14:
ffffea011b4cd000 R15: 00000007f3253047
2016-09-28 02:12:08 [810422.637664] FS: 00007f43aed23700(0000)
GS:ffff8802723e0000(0000) knlGS:0000000000000000
2016-09-28 02:12:08 [810422.645957] CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
2016-09-28 02:12:08 [810422.651855] CR2: 00002b73a80013b0 CR3:
000000557a658000 CR4: 00000000001406e0
2016-09-28 02:12:08 [810422.659198] DR0: 0000000000000000 DR1:
0000000000000000 DR2: 0000000000000000
2016-09-28 02:12:08 [810422.666543] DR3: 0000000000000000 DR6:
00000000fffe0ff0 DR7: 0000000000000400
2016-09-28 02:12:08 [810422.673882] Process observer (pid: 10729,
threadinfo ffff887661c9e000, task ffff88787fb94040)
2016-09-28 02:12:08 [810422.682611] Stack:
2016-09-28 02:12:08 [810422.684779] 000000000000000e 0000000000000006
ffff887f46f4e640 ffff887882be22e0
2016-09-28 02:12:08 [810422.692213] <0> ffff887f46f4e6c8
0000000100000000 ffff887882be22f8 0000006cd0dcb067
2016-09-28 02:12:08 [810422.700185] <0> ffff887882be22d8
0000000181146034 ffffea011b4cd038 ffff88000002c1c0
2016-09-28 02:12:08 [810422.708420] Call Trace:
2016-09-28 02:12:08 [810422.711026] [] __split_huge_page_pmd+0x81/0xc0
2016-09-28 02:12:08 [810422.717272] [] split_huge_page_address+0x9a/0xa0
2016-09-28 02:12:08 [810422.723686] [] __vma_adjust_trans_huge+0xd0/0xf0
2016-09-28 02:12:08 [810422.730102] [] vma_adjust+0x4fa/0x590
2016-09-28 02:12:08 [810422.735566] [] __split_vma+0x143/0x280
2016-09-28 02:12:08 [810422.741115] [] do_munmap+0x25a/0x3a0
2016-09-28 02:12:08 [810422.746489] [] sys_munmap+0x56/0x80
2016-09-28 02:12:08 [810422.751782] [] system_call_fastpath+0x16/0x1b
2016-09-28 02:12:08 [810422.757939] Code: b0 fc ff ff 0f 0b 90 eb fd
49 8b 46 10 e9 d4 fc ff ff 0f 0b 0f 1f 00 eb fb 49 8b 06 a9 00 00 00
02 0f 84 1c fa ff ff f3 90 eb ee <0f> 0b eb fe 0f 0b 66 0f 1f 44 00 00
eb f8 0f 0b eb fe 0f 0b 0f
2016-09-28 02:12:08 [810422.778682] RIP [] split_huge_page+0x7c4/0x800
2016-09-28 02:12:08 [810422.784947] RSP
2016-09-28 02:12:08 [810422.789074] ---[ end trace a7919e7f17c0a727 ]---
On Sun, Oct 09, 2016 at 03:24:27PM +0800, Wenwei Tao wrote:
> Hi,
>
> I open the Transparent huge page and run the system and hit the bug
> in huge_memory.c:
>
> static void __split_huge_page_refcount(struct page *page)
> .
> .
> .
>
> /* tail_page->_mapcount cannot change */
> BUG_ON(page_mapcount(page_tail) < 0);
> .
> .
>
> In my understanding, the THP's tail page's mapcount is initialized to
> -1, page_mapcout(page_tail) should be 0.
> Did anyone meet the same issue?
>
> Thanks.
>
> 2016-09-28 02:12:08 [810422.485203] ------------[ cut here ]------------
> 2016-09-28 02:12:08 [810422.489974] kernel BUG at mm/huge_memory.c:1187!
> 2016-09-28 02:12:08 [810422.494742] invalid opcode: 0000 [#1] SMP
> 2016-09-28 02:12:08 [810422.499034] last sysfs file:
> /sys/devices/system/cpu/online
> 2016-09-28 02:12:08 [810422.504757] CPU 31
> 2016-09-28 02:12:08 [810422.506775] Modules linked in: 8021q garp
> bridge stp llc dell_rbu ipmi_devintf ipmi_si ipmi_msghandler bonding
> ipv6 microcode dca power_meter ext4 mbcache jbd2 ahci wmi dm_mirror
> dm_region_hash dm_log dm_mod
> 2016-09-28 02:12:08 [810422.571439]
> 2016-09-28 02:12:08 [810422.573088] Pid: 10729, comm: observer
> Tainted: G W ---------------- 2.6.32-220.23.2.el6.x86_64
The kernel is already tianted with warning.
And that is way to old kernel -- from RHEL 6.2, almost 5 years old.
Contact your OS vendor.
--
Kirill A. Shutemov