Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752815AbaAWBIP (ORCPT ); Wed, 22 Jan 2014 20:08:15 -0500 Received: from aserp1040.oracle.com ([141.146.126.69]:47871 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751276AbaAWBIO (ORCPT ); Wed, 22 Jan 2014 20:08:14 -0500 Message-ID: <52E06B6F.90808@oracle.com> Date: Wed, 22 Jan 2014 20:07:59 -0500 From: Sasha Levin User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: khlebnikov@openvz.org, Andrew Morton CC: "linux-mm@kvack.org" , LKML Subject: mm: BUG: Bad rss-counter state Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Source-IP: ucsinet22.oracle.com [156.151.31.94] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi all, While fuzzing with trinity running inside a KVM tools guest using latest -next kernel, I've stumbled on a "mm: BUG: Bad rss-counter state" error which was pretty non-obvious in the mix of the kernel spew (why?). I've added a small BUG() after the printk() in check_mm(), and here's the full output: [ 318.334905] BUG: Bad rss-counter state mm:ffff8801e6dec000 idx:0 val:1 [ 318.335955] ------------[ cut here ]------------ [ 318.336507] kernel BUG at kernel/fork.c:562! [ 318.336930] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC [ 318.337826] Dumping ftrace buffer: [ 318.338431] (ftrace buffer empty) [ 318.338951] Modules linked in: [ 318.339287] CPU: 45 PID: 10022 Comm: trinity-c190 Tainted: G W 3.13.0-next -20140122-sasha-00011-gcc8342a-dirty #4 [ 318.340120] task: ffff8801e6a9b000 ti: ffff8801e6aee000 task.ti: ffff8801e6aee000 [ 318.340120] RIP: 0010:[] [] __mmdrop+0x9a/0xc0 [ 318.340120] RSP: 0000:ffff8801e6aefe68 EFLAGS: 00010292 [ 318.340120] RAX: 000000000000003a RBX: ffff8801e6dec000 RCX: 0000000000000001 [ 318.340120] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000286 [ 318.340120] RBP: ffff8801e6aefe78 R08: 0000000000000001 R09: 0000000000000000 [ 318.340120] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8801e6dec138 [ 318.340120] R13: ffff8801e6dec000 R14: ffff8801e6dec0a8 R15: 00000000000000a3 [ 318.340120] FS: 00007f6bc5915700(0000) GS:ffff88007b400000(0000) knlGS:000000000000 0000 [ 318.340120] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 318.340120] CR2: 00007fffd3d62588 CR3: 0000000005e26000 CR4: 00000000000006e0 [ 318.340120] Stack: [ 318.340120] ffff8801e6dec138 ffff8801e6dec000 ffff8801e6aefe98 ffffffff8113cb3b [ 318.340120] ffff8801e6a9bbb0 ffff8801e6a9b000 ffff8801e6aefef8 ffffffff81140ced [ 318.340120] ffff8801e6c4db00 ffff8801e6c4db00 ffff8801e6aefef8 ffffffff811f3ea5 [ 318.340120] Call Trace: [ 318.340120] [] mmput+0xcb/0xe0 [ 318.340120] [] exit_mm+0x18d/0x1a0 [ 318.340120] [] ? acct_collect+0x175/0x1b0 [ 318.340120] [] do_exit+0x26f/0x520 [ 318.355754] [] do_group_exit+0xa9/0xe0 [ 318.355754] [] SyS_exit_group+0x17/0x20 [ 318.355754] [] tracesys+0xdd/0xe2 [ 318.355754] Code: 00 00 eb 16 0f 1f 44 00 00 48 8b 8b 68 03 00 00 48 85 c9 74 24 ba 02 00 00 00 48 89 de 48 c7 c7 10 16 68 85 31 c0 e8 a2 d2 2f 03 <0f> 0b 0f 1f 40 00 eb fe 66 0f 1f 44 00 00 48 89 de 48 8b 3d 1e [ 318.355754] RIP [] __mmdrop+0x9a/0xc0 [ 318.355754] RSP [ 318.363991] ---[ end trace 7d85aceb881be62b ]--- Thanks, Sasha -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/