Re: [-next 20190118] "kernel BUG at mm/page_alloc.c:3112!"

[Michal Hocko <mhocko@kernel.org>]

This sounds familiar. Cc Mel and Vlastimil.

On Mon 21-01-19 16:43:12, Heiko Carstens wrote:
> Hello,
> 
> when running with linux-next from 20190118 we saw the BUG_ON at
> mm/page_alloc.c:3112 being hit (see below). This happened on s390
> when using the ltp test suite with the 'oom1' test case.
> So out-of-memory is certainly expected, a BUG_ON being hit however not.
> 
> (note to avoid confusion: the kernel version in the log below contains
>  the build date, not the linux-next version; however 9673b4aa71ca is
>  the corresponding linux-next git commit id).
> 
> [ 3161.555718] sshd: page allocation failure: order:0, mode:0x400000(GFP_NOWAIT), nodemask=(null),cpuset=/,mems_allowed=0
> [ 3161.555721] CPU: 12 PID: 106602 Comm: sshd Not tainted 5.0.0-20190121.rc2.git0.9673b4aa71ca.300.fc29.s390x+next #1
> [ 3161.555723] Hardware name: IBM 2964 NC9 712 (LPAR)
> [ 3161.555724] Call Trace:
> [ 3161.555727] ([<0000000000112e68>] show_stack+0x58/0x70)
> [ 3161.555729]  [<0000000000a6c4a2>] dump_stack+0x7a/0xa8 
> [ 3161.555731]  [<00000000002c0d5a>] warn_alloc+0xe2/0x178 
> [ 3161.555734]  [<00000000002c1eac>] __alloc_pages_nodemask+0x1024/0x1060 
> [ 3161.555736]  [<000000000033755e>] new_slab+0x476/0x618 
> [ 3161.555738]  [<0000000000339d1e>] ___slab_alloc+0x45e/0x590 
> [ 3161.555741]  [<0000000000339e7c>] __slab_alloc+0x2c/0x48 
> [ 3161.555743]  [<000000000033a07c>] kmem_cache_alloc+0x1e4/0x240 
> [ 3161.555745]  [<0000000000647712>] avc_alloc_node+0x32/0x1c0 
> [ 3161.555748]  [<0000000000647bc2>] avc_compute_av+0x7a/0x208 
> [ 3161.555750]  [<00000000006488f4>] avc_has_perm_noaudit+0xa4/0xf8 
> [ 3161.555753]  [<0000000000665c1a>] security_get_user_sids+0x39a/0x578 
> [ 3161.555754]  [<00000000006551dc>] sel_write_user+0x144/0x250 
> [ 3161.555757]  [<0000000000654e2e>] selinux_transaction_write+0x6e/0xa8 
> [ 3161.555759]  [<0000000000364d10>] __vfs_write+0x38/0x1c0 
> [ 3161.555761]  [<0000000000365068>] vfs_write+0xa0/0x1b0 
> [ 3161.555762]  [<0000000000365322>] ksys_write+0x5a/0xc8 
> [ 3161.555765]  [<0000000000a8c438>] system_call+0xdc/0x2c8 
> [ 3161.555767] SLUB: Unable to allocate memory on node -1, gfp=0x408000(GFP_NOWAIT|__GFP_ZERO)
> [ 3161.555769]   cache: avc_node, object size: 72, buffer size: 72, default order: 0, min order: 0
> [ 3161.555771]   node 0: slabs: 276, objs: 15456, free: 0
> [ 3215.347399] ------------[ cut here ]------------
> [ 3215.347407] kernel BUG at mm/page_alloc.c:3112!
> [ 3215.347507] illegal operation: 0001 ilc:1 [#1] SMP 
> [ 3215.347511] Modules linked in: loop kvm xt_tcpudp ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack ip6table_nat nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat_ipv4 nf_nat iptable_mangle iptable_raw iptable_security nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nfnetlink ip6table_filter ip6_tables iptable_filter ip_tables x_tables pkey zcrypt rng_core ghash_s390 prng aes_s390 des_s390 des_generic sha512_s390 sha1_s390 eadm_sch sch_fq_codel sha256_s390 sha_common autofs4
> [ 3215.347552] CPU: 6 PID: 98 Comm: kcompactd0 Not tainted 5.0.0-20190121.rc2.git0.9673b4aa71ca.300.fc29.s390x+next #1
> [ 3215.347554] Hardware name: IBM 2964 NC9 712 (LPAR)
> [ 3215.347557] Krnl PSW : 0404d00180000000 00000000002bf182 (__isolate_free_page+0x212/0x218)
> [ 3215.347567]            R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3
> [ 3215.347570] Krnl GPRS: 00000000001b8d00 0000000100000080 00000001ffffec38 00000000f0000000
> [ 3215.347573]            00000001ffffec40 0000000000176500 0000000000000007 00000001ffffec38
> [ 3215.347576]            0000000000000007 00000001ffffe8c0 000003d000000040 000003d000000007
> [ 3215.347579]            000003e0038b7dc0 fffffff0c5ffff00 000003e0038b7ae0 000003e0038b7a80
> [ 3215.347590] Krnl Code: 00000000002bf172: eb6ff0a80004	lmg	%r6,%r15,168(%r15)
>                           00000000002bf178: c0f4003e73ec	brcl	15,a8d950
>                          #00000000002bf17e: a7f40001		brc	15,2bf180
>                          >00000000002bf182: 0707		bcr	0,%r7
>                           00000000002bf184: 0707		bcr	0,%r7
>                           00000000002bf186: 0707		bcr	0,%r7
>                           00000000002bf188: c00400000000	brcl	0,2bf188
>                           00000000002bf18e: eb6ff0480024	stmg	%r6,%r15,72(%r15)
> [ 3215.347638] Call Trace:
> [ 3215.347641] ([<000003d085d96000>] 0x3d085d96000)
> [ 3215.347645]  [<00000000002f0b74>] compaction_alloc+0x394/0x9c8 
> [ 3215.347649]  [<0000000000342d52>] migrate_pages+0x1d2/0xaf0 
> [ 3215.347652]  [<00000000002f29a0>] compact_zone+0x620/0xf20 
> [ 3215.347654]  [<00000000002f3600>] kcompactd_do_work+0x130/0x268 
> [ 3215.347656]  [<00000000002f37d0>] kcompactd+0x98/0x1d0 
> [ 3215.347661]  [<000000000016920c>] kthread+0x144/0x160 
> [ 3215.347665]  [<0000000000a8c652>] kernel_thread_starter+0xa/0x10 
> [ 3215.347667]  [<0000000000a8c648>] kernel_thread_starter+0x0/0x10 
> [ 3215.347669] Last Breaking-Event-Address:
> [ 3215.347671]  [<00000000002bf17e>] __isolate_free_page+0x20e/0x218
> [ 3215.347674] Kernel panic - not syncing: Fatal exception: panic_on_oops
> 
> FWIW, if it helps: the address of the struct page in question is in
> register 2 and the memory dump (using 'crash') of it looks like this:
> 
> > struct page -x 1ffffec38
> struct page {
>   flags = 0x3d0832bb008, 
>   {
>     {
>       lru = {
>         next = 0x3d084e79008, 
>         prev = 0x1ffffeca8
>       }, 
>       mapping = 0x1ffffec50, 
>       index = 0x1ffffec50, 
>       private = 0x3d0855e3008
>     }, 
>     {
>       {
>         slab_list = {
>           next = 0x3d084e79008, 
>           prev = 0x1ffffeca8
>         }, 
>         {
>           next = 0x3d084e79008, 
>           pages = 0x1, 
>           pobjects = 0xffffeca8
>         }
>       }, 
>       slab_cache = 0x1ffffec50, 
>       freelist = 0x1ffffec50, 
>       {
>         s_mem = 0x3d0855e3008, 
>         counters = 0x3d0855e3008, 
>         {
>           inuse = 0x0, 
>           objects = 0x1e8, 
>           frozen = 0x0
>         }
>       }
>     }, 
>     {
>       compound_head = 0x3d084e79008, 
>       compound_dtor = 0x0, 
>       compound_order = 0x0, 
>       compound_mapcount = {
>         counter = 0xffffeca8
>       }
>     }, 
>     {
>       _compound_pad_1 = 0x3d084e79008, 
>       _compound_pad_2 = 0x1ffffeca8, 
>       deferred_list = {
>         next = 0x1ffffec50, 
>         prev = 0x1ffffec50
>       }
>     }, 
>     {
>       _pt_pad_1 = 0x3d084e79008, 
>       pmd_huge_pte = 0x1ffffeca8, 
>       _pt_pad_2 = 0x1ffffec50, 
>       {
>         pt_mm = 0x1ffffec50, 
>         pt_frag_refcount = {
>           counter = 0x1
>         }
>       }, 
>       ptl = {
>         {
>           rlock = {
>             raw_lock = {
>               lock = 0x3d0
>             }
>           }
>         }
>       }
>     }, 
>     {
>       pgmap = 0x3d084e79008, 
>       hmm_data = 0x1ffffeca8, 
>       _zd_pad_1 = 0x1ffffec50
>     }, 
>     callback_head = {
>       next = 0x3d084e79008, 
>       func = 0x1ffffeca8
>     }
>   }, 
>   {
>     _mapcount = {
>       counter = 0x3d0
>     }, 
>     page_type = 0x3d0, 
>     active = 0x3d0, 
>     units = 0x3d0
>   }, 
>   _refcount = {
>     counter = 0x855e3008
>   }, 
>   mem_cgroup = 0x1ffffec70
> }

-- 
Michal Hocko
SUSE Labs