Re: kernel BUG at include/linux/mm.h:699

[Michal Hocko <mhocko@kernel.org>]

On Mon 20-04-20 12:15:33, Hillf Danton wrote:
> 
> Sun, 19 Apr 2020 08:28:14 -0700
> > syzbot found the following crash on:
> > 
> > HEAD commit:    8632e9b5 Merge tag 'hyperv-fixes-signed' of git://git.kern..
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=11ac6be0100000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=5d351a1019ed81a2
> > dashboard link: https://syzkaller.appspot.com/bug?extid=a923008018a2d298247b
> > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> > 
> > Unfortunately, I don't have any reproducer for this crash yet.
> > 
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+a923008018a2d298247b@syzkaller.appspotmail.com
> > 
> > raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
> > page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)

This looks like a page reference count underflow. If there is a
reproducer then page_owner might help to tell who was the last owner.
[...]
 
> Flush TLB every chance before we get every thing done.
> 
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -1080,8 +1080,8 @@ again:
>  			page_remove_rmap(page, false);
>  			if (unlikely(page_mapcount(page) < 0))
>  				print_bad_pte(vma, addr, ptent, page);
> +			force_flush = 1;
>  			if (unlikely(__tlb_remove_page(tlb, page))) {
> -				force_flush = 1;
>  				addr += PAGE_SIZE;
>  				break;
>  			}
> @@ -1146,10 +1146,9 @@ again:
>  		tlb_flush_mmu(tlb);
>  	}
>  
> -	if (addr != end) {
> -		cond_resched();
> +	cond_resched();
> +	if (addr != end)
>  		goto again;
> -	}
>  
>  	return addr;
>  }
 
This patch doesn't make any sense to me wrt to the above report. What
are you trying to achieve?

-- 
Michal Hocko
SUSE Labs