Kernel BUG noticed on arm architecture on linux next 20200824 tag kernel
while running LTP CVE "thp01 -I 120" , LTP mm, LTP hugetlb test cases
and libhugetlbfs test suite.
metadata:
git branch: master
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
git commit: d8be0e12a522d53a45f85fb241ffd06108d40b03
git describe: next-20200824
make_kernelversion: 5.9.0-rc2
kernel-config:
https://builds.tuxbuild.com/ISOcMRs1P2wwVCv7Uhpe5A/kernel.config
steps to reproduce:
boot arm device or qemu_arm
# cd /opt/ltp/testcases/bin
# ./thp01 -I 120
output:
=========
thp01.c:98: PASS: system didn't crash.
thp01.c:98: PASS: system didn't crash.
[ 67.545247] BUG: Bad page state in process true pfn:a8fed
[ 67.550767] page:9640c0ab refcount:0 mapcount:-1024
mapping:00000000 index:0x0 pfn:0xa8fed
[ 67.559068] flags: 0x0()
[ 67.561616] raw: 00000000 00000000 00000100 00000122 00000000
00000000 00000000 00000000
[ 67.569742] raw: fffffbff 00000000 00000000 00000000
[ 67.574725] page dumped because: nonzero mapcount
[ 67.579446] Modules linked in: snd_soc_simple_card
snd_soc_simple_card_utils snd_soc_core ac97_bus snd_pcm_dmaengine
snd_pcm snd_timer snd soundcore
[ 67.592848] CPU: 0 PID: 670 Comm: true Not tainted 5.9.0-rc2-next-20200824 #1
[ 67.600012] Hardware name: Generic DRA74X (Flattened Device Tree)
[ 67.606131] Backtrace:
[ 67.608601] [<c040e860>] (dump_backtrace) from [<c040ebd4>]
(show_stack+0x20/0x24)
[ 67.616205] r7:c20ccad4 r6:00000000 r5:60010193 r4:c20ccad4
[ 67.621894] [<c040ebb4>] (show_stack) from [<c0940e58>]
(dump_stack+0xec/0x118)
[ 67.629239] [<c0940d6c>] (dump_stack) from [<c05db030>] (bad_page+0xf8/0x128)
[ 67.636405] r10:00000000 r9:0030f231 r8:0000001f r7:c19eb22c
r6:eebaec70 r5:c2003d00
[ 67.644267] r4:c2289b14 r3:4c6a9f02
[ 67.647857] [<c05daf38>] (bad_page) from [<c05db0ec>]
(check_free_page_bad+0x8c/0x90)
[ 67.655721] r7:efc2d130 r6:efc2d130 r5:0000001f r4:00000000
[ 67.661408] [<c05db060>] (check_free_page_bad) from [<c05dc41c>]
(free_pcppages_bulk+0x1d4/0x778)
[ 67.670316] r5:0000001f r4:efc2d13c
[ 67.673909] [<c05dc248>] (free_pcppages_bulk) from [<c05dcb98>]
(free_unref_page_commit+0xd4/0xf8)
[ 67.682907] r10:efc29f7c r9:d28a1c10 r8:20010113 r7:eeb96168
r6:c21fd900 r5:efc2d13c
[ 67.690767] r4:2dc68000
[ 67.693312] [<c05dcac4>] (free_unref_page_commit) from [<c05ddb80>]
(free_unref_page+0x7c/0x9c)
[ 67.702046] r7:00080000 r6:eeb96160 r5:20010113 r4:000a87b2
[ 67.707730] [<c05ddb04>] (free_unref_page) from [<c05ddbec>]
(__free_pages+0x4c/0x58)
[ 67.715593] r7:c220427c r6:e87b2014 r5:00000003 r4:00000000
[ 67.721280] [<c05ddba0>] (__free_pages) from [<c05ddcf4>]
(free_pages.part.0+0x34/0x38)
[ 67.729317] r5:00000003 r4:e87b2000
[ 67.732907] [<c05ddcc0>] (free_pages.part.0) from [<c05ddd18>]
(free_pages+0x20/0x24)
[ 67.740779] [<c05ddcf8>] (free_pages) from [<c05cdad8>]
(tlb_remove_table_rcu+0x50/0x54)
[ 67.748911] [<c05cda88>] (tlb_remove_table_rcu) from [<c04d31e4>]
(rcu_core+0x26c/0xa9c)
[ 67.757035] r7:c220427c r6:c2004f38 r5:e87b2000 r4:ffffe000
[ 67.762721] [<c04d2f78>] (rcu_core) from [<c04d3a2c>] (rcu_core_si+0x18/0x1c)
[ 67.769886] r10:d28a0000 r9:00000200 r8:00000100 r7:c2203ee4
r6:00000009 r5:0000000a
[ 67.777749] r4:c20030a4
[ 67.780297] [<c04d3a14>] (rcu_core_si) from [<c0401edc>]
(__do_softirq+0x1ac/0x480)
[ 67.787988] [<c0401d30>] (__do_softirq) from [<c0458e38>]
(irq_exit+0xdc/0x104)
[ 67.795327] r10:e8632dd0 r9:fa213000 r8:e98dc000 r7:00000000
r6:00000001 r5:00000000
[ 67.803189] r4:ffffe000
[ 67.805737] [<c0458d5c>] (irq_exit) from [<c04b9fb4>]
(__handle_domain_irq+0x70/0xc0)
[ 67.813599] r5:00000000 r4:c1fc0290
[ 67.817192] [<c04b9f44>] (__handle_domain_irq) from [<c040182c>]
(gic_handle_irq+0x68/0xac)
[ 67.825579] r9:fa213000 r8:fa21200c r7:d28a1d38 r6:c20cd210
r5:fa212000 r4:c2006a20
[ 67.833357] [<c04017c4>] (gic_handle_irq) from [<c0400bfc>]
(__irq_svc+0x5c/0x7c)
[ 67.840870] Exception stack(0xd28a1d38 to 0xd28a1d80)
[ 67.845940] 1d20:
00000000 e714b004
[ 67.854153] 1d40: e8632de0 be974000 e714b000 40048000 e8632a90
40036000 e8632c98 e714b004
[ 67.862364] 1d60: e8632dd0 d28a1dc4 e8632a90 d28a1d88 40048000
c05cb290 90010013 ffffffff
[ 67.870577] r9:d28a0000 r8:e8632c98 r7:d28a1d6c r6:ffffffff
r5:90010013 r4:c05cb290
[ 67.878355] [<c05caf50>] (__do_munmap) from [<c05cb424>]
(__vm_munmap+0x7c/0xc4)
[ 67.885782] r10:e714b000 r9:00000000 r8:e714b040 r7:00012000
r6:d28a1ddc r5:40036000
[ 67.893646] r4:d28a0000
[ 67.896193] [<c05cb3a8>] (__vm_munmap) from [<c05cb488>]
(vm_munmap+0x1c/0x20)
[ 67.903444] r10:00000000 r9:e84289c0 r8:00032000 r7:00000802
r6:00000000 r5:40016000
[ 67.911307] r4:00020000
[ 67.913853] [<c05cb46c>] (vm_munmap) from [<c069e984>] (elf_map+0x94/0xf8)
[ 67.920759] [<c069e8f0>] (elf_map) from [<c06a07f0>]
(load_elf_binary+0x9e0/0x13f0)
[ 67.928447] r8:d28a0000 r7:00000005 r6:00000000 r5:e72f60e0 r4:00000000
[ 67.935180] [<c069fe10>] (load_elf_binary) from [<c062e2c0>]
(bprm_execve+0x324/0x6f0)
[ 67.943129] r10:c207d280 r9:e87fc05c r8:fffffff8 r7:00000006
r6:c228de30 r5:c2082ac4
[ 67.950990] r4:e87fc000
[ 67.953532] [<c062df9c>] (bprm_execve) from [<c062e7e0>]
(do_execveat_common+0x154/0x178)
[ 67.961745] r10:0000000b r9:be97da44 r8:000383c8 r7:ffffff9c
r6:e856b000 r5:e87fc000
[ 67.969607] r4:00000000
[ 67.972152] [<c062e68c>] (do_execveat_common) from [<c062f524>]
(sys_execve+0x40/0x48)
[ 67.980103] r9:d28a0000 r8:c0400364 r7:0000000b r6:be97da44
r5:be97da44 r4:000383c8
[ 67.987880] [<c062f4e4>] (sys_execve) from [<c04001a0>]
(ret_fast_syscall+0x0/0x28)
[ 67.995566] Exception stack(0xd28a1fa8 to 0xd28a1ff0)
[ 68.000637] 1fa0: 00045320 000383c8 be97d760
000383c8 be97da44 65757274
[ 68.008849] 1fc0: 00045320 000383c8 be97da44 0000000b 00000005
0000009a be97d760 be97d834
[ 68.017061] 1fe0: be97d769 be97d75c b6ef5da0 b6ef56ac
[ 68.022131] r5:000383c8 r4:00045320
[ 68.025720] Disabling lock debugging due to kernel taint
[ 68.031053] BUG: Bad page state in process true pfn:a1c71
[ 68.036563] page:0f0cc66e refcount:0 mapcount:-1024
mapping:00000000 index:0x0 pfn:0xa1c71
[ 68.044861] flags: 0x0()
[ 68.047408] raw: 00000000 00000000 00000100 00000122 00000000
00000000 00000000 00000000
[ 68.055530] raw: fffffbff 00000000 00000000 00000000
[ 68.060514] page dumped because: nonzero mapcount
[ 68.065235] Modules linked in: snd_soc_simple_card
snd_soc_simple_card_utils snd_soc_core ac97_bus snd_pcm_dmaengine
snd_pcm snd_timer snd soundcore
[ 68.078631] CPU: 0 PID: 670 Comm: true Tainted: G B
5.9.0-rc2-next-20200824 #1
[ 68.087188] Hardware name: Generic DRA74X (Flattened Device Tree)
[ 68.093305] Backtrace:
[ 68.095767] [<c040e860>] (dump_backtrace) from [<c040ebd4>]
(show_stack+0x20/0x24)
[ 68.103369] r7:c20ccad4 r6:00000000 r5:60010193 r4:c20ccad4
[ 68.109054] [<c040ebb4>] (show_stack) from [<c0940e58>]
(dump_stack+0xec/0x118)
[ 68.116394] [<c0940d6c>] (dump_stack) from [<c05db030>] (bad_page+0xf8/0x128)
[ 68.123562] r10:00000001 r9:0030f231 r8:0000001d r7:c19eb22c
r6:eea54530 r5:0000001d
[ 68.131426] r4:c2289b14 r3:4c6a9f02
[ 68.135018] [<c05daf38>] (bad_page) from [<c05db0ec>]
(check_free_page_bad+0x8c/0x90)
[ 68.142880] r7:efc2d130 r6:efc2d130 r5:0000001d r4:00000000
[ 68.148565] [<c05db060>] (check_free_page_bad) from [<c05dc41c>]
(free_pcppages_bulk+0x1d4/0x778)
[ 68.157473] r5:0000001d r4:efc2d13c
[ 68.161063] [<c05dc248>] (free_pcppages_bulk) from [<c05dcb98>]
(free_unref_page_commit+0xd4/0xf8)
[ 68.170059] r10:efc29f7c r9:d28a1c10 r8:20010113 r7:eeb96168
r6:c21fd900 r5:efc2d13c
[ 68.177919] r4:2dc68000
[ 68.180464] [<c05dcac4>] (free_unref_page_commit) from [<c05ddb80>]
(free_unref_page+0x7c/0x9c)
[ 68.189199] r7:00080000 r6:eeb96160 r5:20010113 r4:000a87b2
[ 68.194884] [<c05ddb04>] (free_unref_page) from [<c05ddbec>]
(__free_pages+0x4c/0x58)
[ 68.202746] r7:c220427c r6:e87b2014 r5:00000003 r4:00000000
[ 68.208430] [<c05ddba0>] (__free_pages) from [<c05ddcf4>]
(free_pages.part.0+0x34/0x38)
[ 68.216464] r5:00000003 r4:e87b2000
[ 68.220057] [<c05ddcc0>] (free_pages.part.0) from [<c05ddd18>]
(free_pages+0x20/0x24)
[ 68.227922] [<c05ddcf8>] (free_pages) from [<c05cdad8>]
(tlb_remove_table_rcu+0x50/0x54)
[ 68.236050] [<c05cda88>] (tlb_remove_table_rcu) from [<c04d31e4>]
(rcu_core+0x26c/0xa9c)
[ 68.244173] r7:c220427c r6:c2004f38 r5:e87b2000 r4:ffffe000
[ 68.249859] [<c04d2f78>] (rcu_core) from [<c04d3a2c>] (rcu_core_si+0x18/0x1c)
[ 68.257026] r10:d28a0000 r9:00000200 r8:00000100 r7:c2203ee4
r6:00000009 r5:0000000a
[ 68.264886] r4:c20030a4
[ 68.267430] [<c04d3a14>] (rcu_core_si) from [<c0401edc>]
(__do_softirq+0x1ac/0x480)
[ 68.275120] [<c0401d30>] (__do_softirq) from [<c0458e38>]
(irq_exit+0xdc/0x104)
[ 68.282461] r10:e8632dd0 r9:fa213000 r8:e98dc000 r7:00000000
r6:00000001 r5:00000000
[ 68.290325] r4:ffffe000
[ 68.292870] [<c0458d5c>] (irq_exit) from [<c04b9fb4>]
(__handle_domain_irq+0x70/0xc0)
[ 68.300730] r5:00000000 r4:c1fc0290
[ 68.304321] [<c04b9f44>] (__handle_domain_irq) from [<c040182c>]
(gic_handle_irq+0x68/0xac)
[ 68.312707] r9:fa213000 r8:fa21200c r7:d28a1d38 r6:c20cd210
r5:fa212000 r4:c2006a20
[ 68.320483] [<c04017c4>] (gic_handle_irq) from [<c0400bfc>]
(__irq_svc+0x5c/0x7c)
[ 68.327995] Exception stack(0xd28a1d38 to 0xd28a1d80)
[ 68.333064] 1d20:
00000000 e714b004
[ 68.341278] 1d40: e8632de0 be974000 e714b000 40048000 e8632a90
40036000 e8632c98 e714b004
[ 68.349489] 1d60: e8632dd0 d28a1dc4 e8632a90 d28a1d88 40048000
c05cb290 90010013 ffffffff
[ 68.357702] r9:d28a0000 r8:e8632c98 r7:d28a1d6c r6:ffffffff
r5:90010013 r4:c05cb290
[ 68.365481] [<c05caf50>] (__do_munmap) from [<c05cb424>]
(__vm_munmap+0x7c/0xc4)
[ 68.372908] r10:e714b000 r9:00000000 r8:e714b040 r7:00012000
r6:d28a1ddc r5:40036000
[ 68.380768] r4:d28a0000
[ 68.383312] [<c05cb3a8>] (__vm_munmap) from [<c05cb488>]
(vm_munmap+0x1c/0x20)
[ 68.390568] r10:00000000 r9:e84289c0 r8:00032000 r7:00000802
r6:00000000 r5:40016000
[ 68.398430] r4:00020000
[ 68.400974] [<c05cb46c>] (vm_munmap) from [<c069e984>] (elf_map+0x94/0xf8)
[ 68.407877] [<c069e8f0>] (elf_map) from [<c06a07f0>]
(load_elf_binary+0x9e0/0x13f0)
[ 68.415568] r8:d28a0000 r7:00000005 r6:00000000 r5:e72f60e0 r4:00000000
[ 68.422298] [<c069fe10>] (load_elf_binary) from [<c062e2c0>]
(bprm_execve+0x324/0x6f0)
[ 68.430248] r10:c207d280 r9:e87fc05c r8:fffffff8 r7:00000006
r6:c228de30 r5:c2082ac4
[ 68.438110] r4:e87fc000
[ 68.440652] [<c062df9c>] (bprm_execve) from [<c062e7e0>]
(do_execveat_common+0x154/0x178)
[ 68.448867] r10:0000000b r9:be97da44 r8:000383c8 r7:ffffff9c
r6:e856b000 r5:e87fc000
[ 68.456728] r4:00000000
[ 68.459271] [<c062e68c>] (do_execveat_common) from [<c062f524>]
(sys_execve+0x40/0x48)
[ 68.467221] r9:d28a0000 r8:c0400364 r7:0000000b r6:be97da44
r5:be97da44 r4:000383c8
[ 68.474999] [<c062f4e4>] (sys_execve) from [<c04001a0>]
(ret_fast_syscall+0x0/0x28)
[ 68.482685] Exception stack(0xd28a1fa8 to 0xd28a1ff0)
[ 68.487755] 1fa0: 00045320 000383c8 be97d760
000383c8 be97da44 65757274
[ 68.495966] 1fc0: 00045320 000383c8 be97da44 0000000b 00000005
0000009a be97d760 be97d834
[ 68.504179] 1fe0: be97d769 be97d75c b6ef5da0 b6ef56ac
[ 68.509249] r5:000383c8 r4:00045320
[ 68.512836] BUG: Bad page state in process true pfn:a8feb
[ 68.518347] page:08571436 refcount:0 mapcount:-1024
mapping:00000000 index:0x0 pfn:0xa8feb
[ 68.526644] flags: 0x0()
[ 68.529187] raw: 00000000 00000000 00000100 00000122 00000000
00000000 00000000 00000000
[ 68.537311] raw: fffffbff 00000000 00000000 00000000
[ 68.542295] page dumped because: nonzero mapcount
[ 68.547016] Modules linked in: snd_soc_simple_card
snd_soc_simple_card_utils snd_soc_core ac97_bus snd_pcm_dmaengine
snd_pcm snd_timer snd soundcore
[ 68.560408] CPU: 0 PID: 670 Comm: true Tainted: G B
5.9.0-rc2-next-20200824 #1
[ 68.568967] Hardware name: Generic DRA74X (Flattened Device Tree)
[ 68.575084] Backtrace:
[ 68.577543] [<c040e860>] (dump_backtrace) from [<c040ebd4>]
(show_stack+0x20/0x24)
[ 68.585145] r7:c20ccad4 r6:00000000 r5:60010193 r4:c20ccad4
[ 68.590829] [<c040ebb4>] (show_stack) from [<c0940e58>]
(dump_stack+0xec/0x118)
[ 68.598170] [<c0940d6c>] (dump_stack) from [<c05db030>] (bad_page+0xf8/0x128)
[ 68.605335] r10:00000002 r9:0030f231 r8:0000001b r7:c19eb22c
r6:eebaec10 r5:0000001b
[ 68.613198] r4:c2289b14 r3:4c6a9f02
[ 68.616791] [<c05daf38>] (bad_page) from [<c05db0ec>]
(check_free_page_bad+0x8c/0x90)
[ 68.624654] r7:efc2d130 r6:efc2d130 r5:0000001b r4:00000000
[ 68.630340] [<c05db060>] (check_free_page_bad) from [<c05dc41c>]
(free_pcppages_bulk+0x1d4/0x778)
[ 68.639247] r5:0000001b r4:efc2d13c
[ 68.642838] [<c05dc248>] (free_pcppages_bulk) from [<c05dcb98>]
(free_unref_page_commit+0xd4/0xf8)
[ 68.651833] r10:efc29f7c r9:d28a1c10 r8:20010113 r7:eeb96168
r6:c21fd900 r5:efc2d13c
[ 68.659697] r4:2dc68000
[ 68.662243] [<c05dcac4>] (free_unref_page_commit) from [<c05ddb80>]
(free_unref_page+0x7c/0x9c)
[ 68.670976] r7:00080000 r6:eeb96160 r5:20010113 r4:000a87b2
[ 68.676659] [<c05ddb04>] (free_unref_page) from [<c05ddbec>]
(__free_pages+0x4c/0x58)
[ 68.684520] r7:c220427c r6:e87b2014 r5:00000003 r4:00000000
[ 68.690203] [<c05ddba0>] (__free_pages) from [<c05ddcf4>]
(free_pages.part.0+0x34/0x38)
[ 68.698239] r5:00000003 r4:e87b2000
[ 68.701831] [<c05ddcc0>] (free_pages.part.0) from [<c05ddd18>]
(free_pages+0x20/0x24)
[ 68.709699] [<c05ddcf8>] (free_pages) from [<c05cdad8>]
(tlb_remove_table_rcu+0x50/0x54)
[ 68.717827] [<c05cda88>] (tlb_remove_table_rcu) from [<c04d31e4>]
(rcu_core+0x26c/0xa9c)
[ 68.725950] r7:c220427c r6:c2004f38 r5:e87b2000 r4:ffffe000
[ 68.731634] [<c04d2f78>] (rcu_core) from [<c04d3a2c>] (rcu_core_si+0x18/0x1c)
[ 68.738801] r10:d28a0000 r9:00000200 r8:00000100 r7:c2203ee4
r6:00000009 r5:0000000a
[ 68.746661] r4:c20030a4
[ 68.749207] [<c04d3a14>] (rcu_core_si) from [<c0401edc>]
(__do_softirq+0x1ac/0x480)
[ 68.756898] [<c0401d30>] (__do_softirq) from [<c0458e38>]
(irq_exit+0xdc/0x104)
[ 68.764238] r10:e8632dd0 r9:fa213000 r8:e98dc000 r7:00000000
r6:00000001 r5:00000000
[ 68.772098] r4:ffffe000
[ 68.774644] [<c0458d5c>] (irq_exit) from [<c04b9fb4>]
(__handle_domain_irq+0x70/0xc0)
[ 68.782506] r5:00000000 r4:c1fc0290
[ 68.786097] [<c04b9f44>] (__handle_domain_irq) from [<c040182c>]
(gic_handle_irq+0x68/0xac)
[ 68.794483] r9:fa213000 r8:fa21200c r7:d28a1d38 r6:c20cd210
r5:fa212000 r4:c2006a20
[ 68.802258] [<c04017c4>] (gic_handle_irq) from [<c0400bfc>]
(__irq_svc+0x5c/0x7c)
[ 68.809772] Exception stack(0xd28a1d38 to 0xd28a1d80)
[ 68.814846] 1d20:
00000000 e714b004
[ 68.823057] 1d40: e8632de0 be974000 e714b000 40048000 e8632a90
40036000 e8632c98 e714b004
[ 68.831268] 1d60: e8632dd0 d28a1dc4 e8632a90 d28a1d88 40048000
c05cb290 90010013 ffffffff
[ 68.839483] r9:d28a0000 r8:e8632c98 r7:d28a1d6c r6:ffffffff
r5:90010013 r4:c05cb290
[ 68.847262] [<c05caf50>] (__do_munmap) from [<c05cb424>]
(__vm_munmap+0x7c/0xc4)
[ 68.854688] r10:e714b000 r9:00000000 r8:e714b040 r7:00012000
r6:d28a1ddc r5:40036000
[ 68.862547] r4:d28a0000
[ 68.865091] [<c05cb3a8>] (__vm_munmap) from [<c05cb488>]
(vm_munmap+0x1c/0x20)
[ 68.872347] r10:00000000 r9:e84289c0 r8:00032000 r7:00000802
r6:00000000 r5:40016000
[ 68.880209] r4:00020000
[ 68.882752] [<c05cb46c>] (vm_munmap) from [<c069e984>] (elf_map+0x94/0xf8)
[ 68.889655] [<c069e8f0>] (elf_map) from [<c06a07f0>]
(load_elf_binary+0x9e0/0x13f0)
[ 68.897347] r8:d28a0000 r7:00000005 r6:00000000 r5:e72f60e0 r4:00000000
[ 68.904077] [<c069fe10>] (load_elf_binary) from [<c062e2c0>]
(bprm_execve+0x324/0x6f0)
[ 68.912026] r10:c207d280 r9:e87fc05c r8:fffffff8 r7:00000006
r6:c228de30 r5:c2082ac4
[ 68.919889] r4:e87fc000
[ 68.922432] [<c062df9c>] (bprm_execve) from [<c062e7e0>]
(do_execveat_common+0x154/0x178)
[ 68.930646] r10:0000000b r9:be97da44 r8:000383c8 r7:ffffff9c
r6:e856b000 r5:e87fc000
[ 68.938508] r4:00000000
[ 68.941050] [<c062e68c>] (do_execveat_common) from [<c062f524>]
(sys_execve+0x40/0x48)
[ 68.949000] r9:d28a0000 r8:c0400364 r7:0000000b r6:be97da44
r5:be97da44 r4:000383c8
[ 68.956775] [<c062f4e4>] (sys_execve) from [<c04001a0>]
(ret_fast_syscall+0x0/0x28)
[ 68.964463] Exception stack(0xd28a1fa8 to 0xd28a1ff0)
[ 68.969534] 1fa0: 00045320 000383c8 be97d760
000383c8 be97da44 65757274
[ 68.977749] 1fc0: 00045320 000383c8 be97da44 0000000b 00000005
0000009a be97d760 be97d834
[ 68.985961] 1fe0: be97d769 be97d75c b6ef5da0 b6ef56ac
[ 68.991033] r5:000383c8 r4:00045320
[ 68.994621] BUG: Bad page state in process true pfn:a7176
[ 69.000131] page:70e75d1f refcount:0 mapcount:-1024
mapping:00000000 index:0x0 pfn:0xa7176
[ 69.008427] flags: 0x0()
[ 69.010973] raw: 00000000 00000000 00000100 00000122 00000000
00000000 00000000 00000000
[ 69.019096] raw: fffffbff 00000000 00000000 00000000
[ 69.024079] page dumped because: nonzero mapcount
[ 69.028798] Modules linked in: snd_soc_simple_card
snd_soc_simple_card_utils snd_soc_core ac97_bus snd_pcm_dmaengine
snd_pcm snd_timer snd soundcore
[ 69.042193] CPU: 0 PID: 670 Comm: true Tainted: G B
5.9.0-rc2-next-20200824 #1
[ 69.050752] Hardware name: Generic DRA74X (Flattened Device Tree)
[ 69.056866] Backtrace:
[ 69.059327] [<c040e860>] (dump_backtrace) from [<c040ebd4>]
(show_stack+0x20/0x24)
[ 69.066927] r7:c20ccad4 r6:00000000 r5:60010193 r4:c20ccad4
[ 69.072611] [<c040ebb4>] (show_stack) from [<c0940e58>]
(dump_stack+0xec/0x118)
[ 69.079956] [<c0940d6c>] (dump_stack) from [<c05db030>] (bad_page+0xf8/0x128)
[ 69.087121] r10:00000002 r9:0030f231 r8:0000001a r7:c19eb22c
r6:eeb53620 r5:0000001a
[ 69.094985] r4:c2289b14 r3:4c6a9f02
[ 69.098577] [<c05daf38>] (bad_page) from [<c05db0ec>]
(check_free_page_bad+0x8c/0x90)
[ 69.106440] r7:efc2d130 r6:efc2d130 r5:0000001a r4:00000000
[ 69.112123] [<c05db060>] (check_free_page_bad) from [<c05dc41c>]
(free_pcppages_bulk+0x1d4/0x778)
[ 69.121030] r5:0000001a r4:efc2d13c
[ 69.124621] [<c05dc248>] (free_pcppages_bulk) from [<c05dcb98>]
(free_unref_page_commit+0xd4/0xf8)
[ 69.133620] r10:efc29f7c r9:d28a1c10 r8:20010113 r7:eeb96168
r6:c21fd900 r5:efc2d13c
[ 69.141481] r4:2dc68000
[ 69.144026] [<c05dcac4>] (free_unref_page_commit) from [<c05ddb80>]
(free_unref_page+0x7c/0x9c)
[ 69.152760] r7:00080000 r6:eeb96160 r5:20010113 r4:000a87b2
[ 69.158445] [<c05ddb04>] (free_unref_page) from [<c05ddbec>]
(__free_pages+0x4c/0x58)
[ 69.166307] r7:c220427c r6:e87b2014 r5:00000003 r4:00000000
[ 69.171990] [<c05ddba0>] (__free_pages) from [<c05ddcf4>]
(free_pages.part.0+0x34/0x38)
[ 69.180026] r5:00000003 r4:e87b2000
[ 69.183618] [<c05ddcc0>] (free_pages.part.0) from [<c05ddd18>]
(free_pages+0x20/0x24)
[ 69.191484] [<c05ddcf8>] (free_pages) from [<c05cdad8>]
(tlb_remove_table_rcu+0x50/0x54)
[ 69.199613] [<c05cda88>] (tlb_remove_table_rcu) from [<c04d31e4>]
(rcu_core+0x26c/0xa9c)
[ 69.207737] r7:c220427c r6:c2004f38 r5:e87b2000 r4:ffffe000
[ 69.213421] [<c04d2f78>] (rcu_core) from [<c04d3a2c>] (rcu_core_si+0x18/0x1c)
[ 69.220586] r10:d28a0000 r9:00000200 r8:00000100 r7:c2203ee4
r6:00000009 r5:0000000a
[ 69.228447] r4:c20030a4
[ 69.230992] [<c04d3a14>] (rcu_core_si) from [<c0401edc>]
(__do_softirq+0x1ac/0x480)
[ 69.238681] [<c0401d30>] (__do_softirq) from [<c0458e38>]
(irq_exit+0xdc/0x104)
[ 69.246024] r10:e8632dd0 r9:fa213000 r8:e98dc000 r7:00000000
r6:00000001 r5:00000000
[ 69.253884] r4:ffffe000
[ 69.256429] [<c0458d5c>] (irq_exit) from [<c04b9fb4>]
(__handle_domain_irq+0x70/0xc0)
[ 69.264290] r5:00000000 r4:c1fc0290
[ 69.267880] [<c04b9f44>] (__handle_domain_irq) from [<c040182c>]
(gic_handle_irq+0x68/0xac)
[ 69.276265] r9:fa213000 r8:fa21200c r7:d28a1d38 r6:c20cd210
r5:fa212000 r4:c2006a20
[ 69.284041] [<c04017c4>] (gic_handle_irq) from [<c0400bfc>]
(__irq_svc+0x5c/0x7c)
[ 69.291552] Exception stack(0xd28a1d38 to 0xd28a1d80)
[ 69.296622] 1d20:
00000000 e714b004
[ 69.304837] 1d40: e8632de0 be974000 e714b000 40048000 e8632a90
40036000 e8632c98 e714b004
[ 69.313050] 1d60: e8632dd0 d28a1dc4 e8632a90 d28a1d88 40048000
c05cb290 90010013 ffffffff
[ 69.321263] r9:d28a0000 r8:e8632c98 r7:d28a1d6c r6:ffffffff
r5:90010013 r4:c05cb290
[ 69.329039] [<c05caf50>] (__do_munmap) from [<c05cb424>]
(__vm_munmap+0x7c/0xc4)
[ 69.336468] r10:e714b000 r9:00000000 r8:e714b040 r7:00012000
r6:d28a1ddc r5:40036000
[ 69.344331] r4:d28a0000
[ 69.346876] [<c05cb3a8>] (__vm_munmap) from [<c05cb488>]
(vm_munmap+0x1c/0x20)
[ 69.354130] r10:00000000 r9:e84289c0 r8:00032000 r7:00000802
r6:00000000 r5:40016000
[ 69.361992] r4:00020000
[ 69.364534] [<c05cb46c>] (vm_munmap) from [<c069e984>] (elf_map+0x94/0xf8)
[ 69.371437] [<c069e8f0>] (elf_map) from [<c06a07f0>]
(load_elf_binary+0x9e0/0x13f0)
[ 69.379127] r8:d28a0000 r7:00000005 r6:00000000 r5:e72f60e0 r4:00000000
[ 69.385856] [<c069fe10>] (load_elf_binary) from [<c062e2c0>]
(bprm_execve+0x324/0x6f0)
[ 69.393806] r10:c207d280 r9:e87fc05c r8:fffffff8 r7:00000006
r6:c228de30 r5:c2082ac4
[ 69.401669] r4:e87fc000
[ 69.404211] [<c062df9c>] (bprm_execve) from [<c062e7e0>]
(do_execveat_common+0x154/0x178)
[ 69.412424] r10:0000000b r9:be97da44 r8:000383c8 r7:ffffff9c
r6:e856b000 r5:e87fc000
[ 69.420286] r4:00000000
[ 69.422828] [<c062e68c>] (do_execveat_common) from [<c062f524>]
(sys_execve+0x40/0x48)
[ 69.430779] r9:d28a0000 r8:c0400364 r7:0000000b r6:be97da44
r5:be97da44 r4:000383c8
[ 69.438554] [<c062f4e4>] (sys_execve) from [<c04001a0>]
(ret_fast_syscall+0x0/0x28)
[ 69.446242] Exception stack(0xd28a1fa8 to 0xd28a1ff0)
[ 69.451315] 1fa0: 00045320 000383c8 be97d760
000383c8 be97da44 65757274
[ 69.459526] 1fc0: 00045320 000383c8 be97da44 0000000b 00000005
0000009a be97d760 be97d834
[ 69.467737] 1fe0: be97d769 be97d75c b6ef5da0 b6ef56ac
[ 69.472811] r5:000383c8 r4:00045320
[ 69.476401] BUG: Bad page state in process true pfn:a8fe9
[ 69.481907] page:2b6af1d0 refcount:0 mapcount:-1024
mapping:00000000 index:0x0 pfn:0xa8fe9
[ 69.490205] flags: 0x0()
[ 69.492750] raw: 00000000 00000000 00000100 00000122 00000000
00000000 00000000 00000000
[ 69.500876] raw: fffffbff 00000000 00000000 00000000
[ 69.505859] page dumped because: nonzero mapcount
[ 69.510577] Modules linked in: snd_soc_simple_card
snd_soc_simple_card_utils snd_soc_core ac97_bus snd_pcm_dmaengine
snd_pcm snd_timer snd soundcore
[ 69.523974] CPU: 0 PID: 670 Comm: true Tainted: G B
5.9.0-rc2-next-20200824 #1
[ 69.532533] Hardware name: Generic DRA74X (Flattened Device Tree)
[ 69.538648] Backtrace:
[ 69.541108] [<c040e860>] (dump_backtrace) from [<c040ebd4>]
(show_stack+0x20/0x24)
[ 69.548708] r7:c20ccad4 r6:00000000 r5:60010193 r4:c20ccad4
[ 69.554396] [<c040ebb4>] (show_stack) from [<c0940e58>]
(dump_stack+0xec/0x118)
[ 69.561738] [<c0940d6c>] (dump_stack) from [<c05db030>] (bad_page+0xf8/0x128)
[ 69.568903] r10:00000004 r9:0030f231 r8:00000017 r7:c19eb22c
r6:eebaebb0 r5:00000017
[ 69.576762] r4:c2289b14 r3:4c6a9f02
[ 69.580354] [<c05daf38>] (bad_page) from [<c05db0ec>]
(check_free_page_bad+0x8c/0x90)
[ 69.588215] r7:efc2d130 r6:efc2d130 r5:00000017 r4:00000000
[ 69.593900] [<c05db060>] (check_free_page_bad) from [<c05dc41c>]
(free_pcppages_bulk+0x1d4/0x778)
[ 69.602810] r5:00000017 r4:efc2d13c
[ 69.606402] [<c05dc248>] (free_pcppages_bulk) from [<c05dcb98>]
(free_unref_page_commit+0xd4/0xf8)
[ 69.615398] r10:efc29f7c r9:d28a1c10 r8:20010113 r7:eeb96168
r6:c21fd900 r5:efc2d13c
[ 69.623259] r4:2dc68000
[ 69.625805] [<c05dcac4>] (free_unref_page_commit) from [<c05ddb80>]
(free_unref_page+0x7c/0x9c)
[ 69.634538] r7:00080000 r6:eeb96160 r5:20010113 r4:000a87b2
[ 69.640223] [<c05ddb04>] (free_unref_page) from [<c05ddbec>]
(__free_pages+0x4c/0x58)
[ 69.648084] r7:c220427c r6:e87b2014 r5:00000003 r4:00000000
[ 69.653767] [<c05ddba0>] (__free_pages) from [<c05ddcf4>]
(free_pages.part.0+0x34/0x38)
[ 69.661803] r5:00000003 r4:e87b2000
[ 69.665395] [<c05ddcc0>] (free_pages.part.0) from [<c05ddd18>]
(free_pages+0x20/0x24)
[ 69.673260] [<c05ddcf8>] (free_pages) from [<c05cdad8>]
(tlb_remove_table_rcu+0x50/0x54)
[ 69.681388] [<c05cda88>] (tlb_remove_table_rcu) from [<c04d31e4>]
(rcu_core+0x26c/0xa9c)
[ 69.689510] r7:c220427c r6:c2004f38 r5:e87b2000 r4:ffffe000
[ 69.695196] [<c04d2f78>] (rcu_core) from [<c04d3a2c>] (rcu_core_si+0x18/0x1c)
[ 69.702362] r10:d28a0000 r9:00000200 r8:00000100 r7:c2203ee4
r6:00000009 r5:0000000a
[ 69.710224] r4:c20030a4
[ 69.712768] [<c04d3a14>] (rcu_core_si) from [<c0401edc>]
(__do_softirq+0x1ac/0x480)
[ 69.720461] [<c0401d30>] (__do_softirq) from [<c0458e38>]
(irq_exit+0xdc/0x104)
[ 69.727800] r10:e8632dd0 r9:fa213000 r8:e98dc000 r7:00000000
r6:00000001 r5:00000000
[ 69.735663] r4:ffffe000
[ 69.738209] [<c0458d5c>] (irq_exit) from [<c04b9fb4>]
(__handle_domain_irq+0x70/0xc0)
[ 69.746069] r5:00000000 r4:c1fc0290
[ 69.749658] [<c04b9f44>] (__handle_domain_irq) from [<c040182c>]
(gic_handle_irq+0x68/0xac)
[ 69.758043] r9:fa213000 r8:fa21200c r7:d28a1d38 r6:c20cd210
r5:fa212000 r4:c2006a20
[ 69.765820] [<c04017c4>] (gic_handle_irq) from [<c0400bfc>]
(__irq_svc+0x5c/0x7c)
[ 69.773332] Exception stack(0xd28a1d38 to 0xd28a1d80)
[ 69.778404] 1d20:
00000000 e714b004
[ 69.786618] 1d40: e8632de0 be974000 e714b000 40048000 e8632a90
40036000 e8632c98 e714b004
[ 69.794831] 1d60: e8632dd0 d28a1dc4 e8632a90 d28a1d88 40048000
c05cb290 90010013 ffffffff
[ 69.803042] r9:d28a0000 r8:e8632c98 r7:d28a1d6c r6:ffffffff
r5:90010013 r4:c05cb290
[ 69.810821] [<c05caf50>] (__do_munmap) from [<c05cb424>]
(__vm_munmap+0x7c/0xc4)
[ 69.818250] r10:e714b000 r9:00000000 r8:e714b040 r7:00012000
r6:d28a1ddc r5:40036000
[ 69.826113] r4:d28a0000
[ 69.828657] [<c05cb3a8>] (__vm_munmap) from [<c05cb488>]
(vm_munmap+0x1c/0x20)
[ 69.835912] r10:00000000 r9:e84289c0 r8:00032000 r7:00000802
r6:00000000 r5:40016000
[ 69.843774] r4:00020000
[ 69.846317] [<c05cb46c>] (vm_munmap) from [<c069e984>] (elf_map+0x94/0xf8)
[ 69.853220] [<c069e8f0>] (elf_map) from [<c06a07f0>]
(load_elf_binary+0x9e0/0x13f0)
[ 69.860909] r8:d28a0000 r7:00000005 r6:00000000 r5:e72f60e0 r4:00000000
[ 69.867637] [<c069fe10>] (load_elf_binary) from [<c062e2c0>]
(bprm_execve+0x324/0x6f0)
[ 69.875590] r10:c207d280 r9:e87fc05c r8:fffffff8 r7:00000006
r6:c228de30 r5:c2082ac4
[ 69.883450] r4:e87fc000
[ 69.885992] [<c062df9c>] (bprm_execve) from [<c062e7e0>]
(do_execveat_common+0x154/0x178)
[ 69.894207] r10:0000000b r9:be97da44 r8:000383c8 r7:ffffff9c
r6:e856b000 r5:e87fc000
[ 69.902069] r4:00000000
[ 69.904612] [<c062e68c>] (do_execveat_common) from [<c062f524>]
(sys_execve+0x40/0x48)
[ 69.912561] r9:d28a0000 r8:c0400364 r7:0000000b r6:be97da44
r5:be97da44 r4:000383c8
[ 69.920337] [<c062f4e4>] (sys_execve) from [<c04001a0>]
(ret_fast_syscall+0x0/0x28)
[ 69.928027] Exception stack(0xd28a1fa8 to 0xd28a1ff0)
[ 69.933100] 1fa0: 00045320 000383c8 be97d760
000383c8 be97da44 65757274
[ 69.941311] 1fc0: 00045320 000383c8 be97da44 0000000b 00000005
0000009a be97d760 be97d834
[ 69.949524] 1fe0: be97d769 be97d75c b6ef5da0 b6ef56ac
[ 69.954597] r5:000383c8 r4:00045320
[ 69.958184] BUG: Bad page state in process true pfn:a72bb
[ 69.963691] page:035a253e refcount:0 mapcount:-1024
mapping:00000000 index:0x0 pfn:0xa72bb
[ 69.971987] flags: 0x0()
[ 69.974532] raw: 00000000 00000000 00000100 00000122 00000000
00000000 00000000 00000000
[ 69.982658] raw: fffffbff 00000000 00000000 00000000
[ 69.987641] page dumped because: nonzero mapcount
[ 69.992359] Modules linked in: snd_soc_simple_card
snd_soc_simple_card_utils snd_soc_core ac97_bus snd_pcm_dmaengine
snd_pcm snd_timer snd soundcore
[ 70.005752] CPU: 0 PID: 670 Comm: true Tainted: G B
5.9.0-rc2-next-20200824 #1
Fulll test log,
https://lkft.validation.linaro.org/scheduler/job/1701626#L2841
https://qa-reports.linaro.org/lkft/linux-next-oe/build/next-20200824/testrun/3109125/suite/linux-log-parser/test/check-kernel-bug-1701604/log
https://qa-reports.linaro.org/lkft/linux-next-oe/build/next-20200824/testrun/3110121/suite/linux-log-parser/test/check-kernel-bug-1701607/log
--
Linaro LKFT
https://lkft.linaro.org
On Mon, 24 Aug 2020 at 15:14, Naresh Kamboju <[email protected]> wrote:
>
> Kernel BUG noticed on arm architecture on linux next 20200824 tag kernel
> while running LTP CVE "thp01 -I 120" , LTP mm, LTP hugetlb test cases
> and libhugetlbfs test suite.
BAD: next-20200820
GOOD: next-20200819
We are trying to bisect this problem and get back to you shortly.
- Naresh
On Mon, Aug 24, 2020 at 03:14:55PM +0530, Naresh Kamboju wrote:
> [ 67.545247] BUG: Bad page state in process true pfn:a8fed
> [ 67.550767] page:9640c0ab refcount:0 mapcount:-1024
Somebody freed a page table without calling __ClearPageTable() on it.
On Mon, 24 Aug 2020 at 16:36, Matthew Wilcox <[email protected]> wrote:
>
> On Mon, Aug 24, 2020 at 03:14:55PM +0530, Naresh Kamboju wrote:
> > [ 67.545247] BUG: Bad page state in process true pfn:a8fed
> > [ 67.550767] page:9640c0ab refcount:0 mapcount:-1024
>
> Somebody freed a page table without calling __ClearPageTable() on it.
After running git bisect on this problem,
The first suspecting of this problem on arm architecture this patch.
424efe723f7717430bec7c93b4d28bba73e31cf6
("mm: account PMD tables like PTE tables ")
Reported-by: Naresh Kamboju <[email protected]>
Reported-by: Anders Roxell <[email protected]>
Additional information:
We have tested linux next by reverting this patch and confirmed
that the reported BUG is not reproduced.
These configs enabled on the running device,
CONFIG_TRANSPARENT_HUGEPAGE=y
CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y
-- Suspecting patch --
commit 424efe723f7717430bec7c93b4d28bba73e31cf6
Author: Matthew Wilcox <[email protected]>
Date: Thu Aug 20 10:01:30 2020 +1000
mm: account PMD tables like PTE tables
We account the PTE level of the page tables to the process in order to
make smarter OOM decisions and help diagnose why memory is fragmented.
For these same reasons, we should account pages allocated for PMDs. With
larger process address spaces and ASLR, the number of PMDs in use is
higher than it used to be so the inaccuracy is starting to matter.
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Matthew Wilcox (Oracle) <[email protected]>
Reviewed-by: Mike Rapoport <[email protected]>
Cc: Abdul Haleem <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Arnd Bergmann <[email protected]>
Cc: Christophe Leroy <[email protected]>
Cc: Joerg Roedel <[email protected]>
Cc: Max Filippov <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Satheesh Rajendran <[email protected]>
Cc: Stafford Horne <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Stephen Rothwell <[email protected]>
diff --git a/include/linux/mm.h b/include/linux/mm.h
index b0a15ee77b8a..a4e5b806347c 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -2239,7 +2239,7 @@ static inline spinlock_t *pmd_lockptr(struct
mm_struct *mm, pmd_t *pmd)
return ptlock_ptr(pmd_to_page(pmd));
}
-static inline bool pgtable_pmd_page_ctor(struct page *page)
+static inline bool pmd_ptlock_init(struct page *page)
{
#ifdef CONFIG_TRANSPARENT_HUGEPAGE
page->pmd_huge_pte = NULL;
@@ -2247,7 +2247,7 @@ static inline bool pgtable_pmd_page_ctor(struct
page *page)
return ptlock_init(page);
}
-static inline void pgtable_pmd_page_dtor(struct page *page)
+static inline void pmd_ptlock_free(struct page *page)
{
#ifdef CONFIG_TRANSPARENT_HUGEPAGE
VM_BUG_ON_PAGE(page->pmd_huge_pte, page);
@@ -2264,8 +2264,8 @@ static inline spinlock_t *pmd_lockptr(struct
mm_struct *mm, pmd_t *pmd)
return &mm->page_table_lock;
}
-static inline bool pgtable_pmd_page_ctor(struct page *page) { return true; }
-static inline void pgtable_pmd_page_dtor(struct page *page) {}
+static inline bool pmd_ptlock_init(struct page *page) { return true; }
+static inline void pmd_ptlock_free(struct page *page) {}
#define pmd_huge_pte(mm, pmd) ((mm)->pmd_huge_pte)
@@ -2278,6 +2278,22 @@ static inline spinlock_t *pmd_lock(struct
mm_struct *mm, pmd_t *pmd)
return ptl;
}
+static inline bool pgtable_pmd_page_ctor(struct page *page)
+{
+ if (!pmd_ptlock_init(page))
+ return false;
+ __SetPageTable(page);
+ inc_zone_page_state(page, NR_PAGETABLE);
+ return true;
+}
+
+static inline void pgtable_pmd_page_dtor(struct page *page)
+{
+ pmd_ptlock_free(page);
+ __ClearPageTable(page);
+ dec_zone_page_state(page, NR_PAGETABLE);
+}
+
/*
* No scalability reason to split PUD locks yet, but follow the same pattern
* as the PMD locks to make it easier if we decide to. The VM should not be
- Naresh
Hi all,
On Tue, 25 Aug 2020 13:03:53 +0530 Naresh Kamboju <[email protected]> wrote:
>
> On Mon, 24 Aug 2020 at 16:36, Matthew Wilcox <[email protected]> wrote:
> >
> > On Mon, Aug 24, 2020 at 03:14:55PM +0530, Naresh Kamboju wrote:
> > > [ 67.545247] BUG: Bad page state in process true pfn:a8fed
> > > [ 67.550767] page:9640c0ab refcount:0 mapcount:-1024
> >
> > Somebody freed a page table without calling __ClearPageTable() on it.
>
> After running git bisect on this problem,
> The first suspecting of this problem on arm architecture this patch.
> 424efe723f7717430bec7c93b4d28bba73e31cf6
> ("mm: account PMD tables like PTE tables ")
>
> Reported-by: Naresh Kamboju <[email protected]>
> Reported-by: Anders Roxell <[email protected]>
>
> Additional information:
> We have tested linux next by reverting this patch and confirmed
> that the reported BUG is not reproduced.
>
> These configs enabled on the running device,
>
> CONFIG_TRANSPARENT_HUGEPAGE=y
> CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y
>
>
> -- Suspecting patch --
> commit 424efe723f7717430bec7c93b4d28bba73e31cf6
> Author: Matthew Wilcox <[email protected]>
> Date: Thu Aug 20 10:01:30 2020 +1000
>
> mm: account PMD tables like PTE tables
OK, I have reverted that patch from todays' linux-next.
--
Cheers,
Stephen Rothwell
On Tue, Aug 25, 2020 at 01:03:53PM +0530, Naresh Kamboju wrote:
> On Mon, 24 Aug 2020 at 16:36, Matthew Wilcox <[email protected]> wrote:
> >
> > On Mon, Aug 24, 2020 at 03:14:55PM +0530, Naresh Kamboju wrote:
> > > [ 67.545247] BUG: Bad page state in process true pfn:a8fed
> > > [ 67.550767] page:9640c0ab refcount:0 mapcount:-1024
> >
> > Somebody freed a page table without calling __ClearPageTable() on it.
>
> After running git bisect on this problem,
> The first suspecting of this problem on arm architecture this patch.
> 424efe723f7717430bec7c93b4d28bba73e31cf6
> ("mm: account PMD tables like PTE tables ")
>
> Reported-by: Naresh Kamboju <[email protected]>
> Reported-by: Anders Roxell <[email protected]>
Can you please check if this fix helps?
diff --git a/arch/arm/include/asm/tlb.h b/arch/arm/include/asm/tlb.h
index 9415222b49ad..b8cbe03ad260 100644
--- a/arch/arm/include/asm/tlb.h
+++ b/arch/arm/include/asm/tlb.h
@@ -59,6 +59,7 @@ __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp, unsigned long addr)
#ifdef CONFIG_ARM_LPAE
struct page *page = virt_to_page(pmdp);
+ pgtable_pmd_page_dtor(page);
tlb_remove_table(tlb, page);
#endif
}
> Additional information:
> We have tested linux next by reverting this patch and confirmed
> that the reported BUG is not reproduced.
>
> These configs enabled on the running device,
>
> CONFIG_TRANSPARENT_HUGEPAGE=y
> CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y
>
>
> -- Suspecting patch --
> commit 424efe723f7717430bec7c93b4d28bba73e31cf6
> Author: Matthew Wilcox <[email protected]>
> Date: Thu Aug 20 10:01:30 2020 +1000
>
> mm: account PMD tables like PTE tables
>
> We account the PTE level of the page tables to the process in order to
> make smarter OOM decisions and help diagnose why memory is fragmented.
> For these same reasons, we should account pages allocated for PMDs. With
> larger process address spaces and ASLR, the number of PMDs in use is
> higher than it used to be so the inaccuracy is starting to matter.
>
> Link: http://lkml.kernel.org/r/[email protected]
> Signed-off-by: Matthew Wilcox (Oracle) <[email protected]>
> Reviewed-by: Mike Rapoport <[email protected]>
> Cc: Abdul Haleem <[email protected]>
> Cc: Andy Lutomirski <[email protected]>
> Cc: Arnd Bergmann <[email protected]>
> Cc: Christophe Leroy <[email protected]>
> Cc: Joerg Roedel <[email protected]>
> Cc: Max Filippov <[email protected]>
> Cc: Peter Zijlstra <[email protected]>
> Cc: Satheesh Rajendran <[email protected]>
> Cc: Stafford Horne <[email protected]>
> Signed-off-by: Andrew Morton <[email protected]>
> Signed-off-by: Stephen Rothwell <[email protected]>
>
> diff --git a/include/linux/mm.h b/include/linux/mm.h
> index b0a15ee77b8a..a4e5b806347c 100644
> --- a/include/linux/mm.h
> +++ b/include/linux/mm.h
> @@ -2239,7 +2239,7 @@ static inline spinlock_t *pmd_lockptr(struct
> mm_struct *mm, pmd_t *pmd)
> return ptlock_ptr(pmd_to_page(pmd));
> }
>
> -static inline bool pgtable_pmd_page_ctor(struct page *page)
> +static inline bool pmd_ptlock_init(struct page *page)
> {
> #ifdef CONFIG_TRANSPARENT_HUGEPAGE
> page->pmd_huge_pte = NULL;
> @@ -2247,7 +2247,7 @@ static inline bool pgtable_pmd_page_ctor(struct
> page *page)
> return ptlock_init(page);
> }
>
> -static inline void pgtable_pmd_page_dtor(struct page *page)
> +static inline void pmd_ptlock_free(struct page *page)
> {
> #ifdef CONFIG_TRANSPARENT_HUGEPAGE
> VM_BUG_ON_PAGE(page->pmd_huge_pte, page);
> @@ -2264,8 +2264,8 @@ static inline spinlock_t *pmd_lockptr(struct
> mm_struct *mm, pmd_t *pmd)
> return &mm->page_table_lock;
> }
>
> -static inline bool pgtable_pmd_page_ctor(struct page *page) { return true; }
> -static inline void pgtable_pmd_page_dtor(struct page *page) {}
> +static inline bool pmd_ptlock_init(struct page *page) { return true; }
> +static inline void pmd_ptlock_free(struct page *page) {}
>
> #define pmd_huge_pte(mm, pmd) ((mm)->pmd_huge_pte)
>
> @@ -2278,6 +2278,22 @@ static inline spinlock_t *pmd_lock(struct
> mm_struct *mm, pmd_t *pmd)
> return ptl;
> }
>
> +static inline bool pgtable_pmd_page_ctor(struct page *page)
> +{
> + if (!pmd_ptlock_init(page))
> + return false;
> + __SetPageTable(page);
> + inc_zone_page_state(page, NR_PAGETABLE);
> + return true;
> +}
> +
> +static inline void pgtable_pmd_page_dtor(struct page *page)
> +{
> + pmd_ptlock_free(page);
> + __ClearPageTable(page);
> + dec_zone_page_state(page, NR_PAGETABLE);
> +}
> +
> /*
> * No scalability reason to split PUD locks yet, but follow the same pattern
> * as the PMD locks to make it easier if we decide to. The VM should not be
>
>
>
>
> - Naresh
--
Sincerely yours,
Mike.
On Tue, 25 Aug 2020 at 10:32, Mike Rapoport <[email protected]> wrote:
>
> On Tue, Aug 25, 2020 at 01:03:53PM +0530, Naresh Kamboju wrote:
> > On Mon, 24 Aug 2020 at 16:36, Matthew Wilcox <[email protected]> wrote:
> > >
> > > On Mon, Aug 24, 2020 at 03:14:55PM +0530, Naresh Kamboju wrote:
> > > > [ 67.545247] BUG: Bad page state in process true pfn:a8fed
> > > > [ 67.550767] page:9640c0ab refcount:0 mapcount:-1024
> > >
> > > Somebody freed a page table without calling __ClearPageTable() on it.
> >
> > After running git bisect on this problem,
> > The first suspecting of this problem on arm architecture this patch.
> > 424efe723f7717430bec7c93b4d28bba73e31cf6
> > ("mm: account PMD tables like PTE tables ")
> >
> > Reported-by: Naresh Kamboju <[email protected]>
> > Reported-by: Anders Roxell <[email protected]>
>
> Can you please check if this fix helps?
That fixed the problem.
Cheers,
Anders
>
> diff --git a/arch/arm/include/asm/tlb.h b/arch/arm/include/asm/tlb.h
> index 9415222b49ad..b8cbe03ad260 100644
> --- a/arch/arm/include/asm/tlb.h
> +++ b/arch/arm/include/asm/tlb.h
> @@ -59,6 +59,7 @@ __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp, unsigned long addr)
> #ifdef CONFIG_ARM_LPAE
> struct page *page = virt_to_page(pmdp);
>
> + pgtable_pmd_page_dtor(page);
> tlb_remove_table(tlb, page);
> #endif
> }
>
> > Additional information:
> > We have tested linux next by reverting this patch and confirmed
> > that the reported BUG is not reproduced.
> >
> > These configs enabled on the running device,
> >
> > CONFIG_TRANSPARENT_HUGEPAGE=y
> > CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y
> >
> >
> > -- Suspecting patch --
> > commit 424efe723f7717430bec7c93b4d28bba73e31cf6
> > Author: Matthew Wilcox <[email protected]>
> > Date: Thu Aug 20 10:01:30 2020 +1000
> >
> > mm: account PMD tables like PTE tables
> >
> > We account the PTE level of the page tables to the process in order to
> > make smarter OOM decisions and help diagnose why memory is fragmented.
> > For these same reasons, we should account pages allocated for PMDs. With
> > larger process address spaces and ASLR, the number of PMDs in use is
> > higher than it used to be so the inaccuracy is starting to matter.
> >
> > Link: http://lkml.kernel.org/r/[email protected]
> > Signed-off-by: Matthew Wilcox (Oracle) <[email protected]>
> > Reviewed-by: Mike Rapoport <[email protected]>
> > Cc: Abdul Haleem <[email protected]>
> > Cc: Andy Lutomirski <[email protected]>
> > Cc: Arnd Bergmann <[email protected]>
> > Cc: Christophe Leroy <[email protected]>
> > Cc: Joerg Roedel <[email protected]>
> > Cc: Max Filippov <[email protected]>
> > Cc: Peter Zijlstra <[email protected]>
> > Cc: Satheesh Rajendran <[email protected]>
> > Cc: Stafford Horne <[email protected]>
> > Signed-off-by: Andrew Morton <[email protected]>
> > Signed-off-by: Stephen Rothwell <[email protected]>
> >
> > diff --git a/include/linux/mm.h b/include/linux/mm.h
> > index b0a15ee77b8a..a4e5b806347c 100644
> > --- a/include/linux/mm.h
> > +++ b/include/linux/mm.h
> > @@ -2239,7 +2239,7 @@ static inline spinlock_t *pmd_lockptr(struct
> > mm_struct *mm, pmd_t *pmd)
> > return ptlock_ptr(pmd_to_page(pmd));
> > }
> >
> > -static inline bool pgtable_pmd_page_ctor(struct page *page)
> > +static inline bool pmd_ptlock_init(struct page *page)
> > {
> > #ifdef CONFIG_TRANSPARENT_HUGEPAGE
> > page->pmd_huge_pte = NULL;
> > @@ -2247,7 +2247,7 @@ static inline bool pgtable_pmd_page_ctor(struct
> > page *page)
> > return ptlock_init(page);
> > }
> >
> > -static inline void pgtable_pmd_page_dtor(struct page *page)
> > +static inline void pmd_ptlock_free(struct page *page)
> > {
> > #ifdef CONFIG_TRANSPARENT_HUGEPAGE
> > VM_BUG_ON_PAGE(page->pmd_huge_pte, page);
> > @@ -2264,8 +2264,8 @@ static inline spinlock_t *pmd_lockptr(struct
> > mm_struct *mm, pmd_t *pmd)
> > return &mm->page_table_lock;
> > }
> >
> > -static inline bool pgtable_pmd_page_ctor(struct page *page) { return true; }
> > -static inline void pgtable_pmd_page_dtor(struct page *page) {}
> > +static inline bool pmd_ptlock_init(struct page *page) { return true; }
> > +static inline void pmd_ptlock_free(struct page *page) {}
> >
> > #define pmd_huge_pte(mm, pmd) ((mm)->pmd_huge_pte)
> >
> > @@ -2278,6 +2278,22 @@ static inline spinlock_t *pmd_lock(struct
> > mm_struct *mm, pmd_t *pmd)
> > return ptl;
> > }
> >
> > +static inline bool pgtable_pmd_page_ctor(struct page *page)
> > +{
> > + if (!pmd_ptlock_init(page))
> > + return false;
> > + __SetPageTable(page);
> > + inc_zone_page_state(page, NR_PAGETABLE);
> > + return true;
> > +}
> > +
> > +static inline void pgtable_pmd_page_dtor(struct page *page)
> > +{
> > + pmd_ptlock_free(page);
> > + __ClearPageTable(page);
> > + dec_zone_page_state(page, NR_PAGETABLE);
> > +}
> > +
> > /*
> > * No scalability reason to split PUD locks yet, but follow the same pattern
> > * as the PMD locks to make it easier if we decide to. The VM should not be
> >
> >
> >
> >
> > - Naresh
>
> --
> Sincerely yours,
> Mike.