From: zhong jiang <zhongjiang@huawei.com>
To: Michal Hocko <mhocko@suse.com>,
Johannes Weiner <hannes@cmpxchg.org>,
vdavydov.dev@gmail.com,
"mgorman@techsingularity.net" <mgorman@techsingularity.net>,
Vlastimil Babka <vbabka@suse.cz>
Cc: Linux Memory Management List <linux-mm@kvack.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: NULL pointer dereference in the kernel 3.10
Date: Sat, 8 Apr 2017 21:39:42 +0800 [thread overview]
Message-ID: <58E8E81E.6090304@huawei.com> (raw)
when runing the stabile docker cases in the vm. The following issue will come up.
#40 [ffff8801b57ffb30] async_page_fault at ffffffff8165c9f8
[exception RIP: down_read_trylock+5]
RIP: ffffffff810aca65 RSP: ffff8801b57ffbe8 RFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff88018ae858c1 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008
RBP: ffff8801b57ffc10 R8: ffffea0006903de0 R9: ffff8800b3c61810
R10: 00000000000022cb R11: 0000000000000000 R12: ffff88018ae858c0
R13: ffffea0006903dc0 R14: 0000000000000008 R15: ffffea0006903dc0
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0000
#41 [ffff8801b57ffbe8] page_lock_anon_vma_read at ffffffff811b241c
#42 [ffff8801b57ffc18] page_referenced at ffffffff811b26a7
#43 [ffff8801b57ffc90] shrink_active_list at ffffffff8118d634
#44 [ffff8801b57ffd48] balance_pgdat at ffffffff8118f088
#45 [ffff8801b57ffe20] kswapd at ffffffff8118f633
#46 [ffff8801b57ffec8] kthread at ffffffff810a795f
#47 [ffff8801b57fff50] ret_from_fork at ffffffff81665398
crash> struct page.mapping ffffea0006903dc0
mapping = 0xffff88018ae858c1
crash> struct anon_vma 0xffff88018ae858c0
struct anon_vma {
root = 0x0,
rwsem = {
count = 0,
wait_lock = {
raw_lock = {
{
head_tail = 1,
tickets = {
head = 1,
tail = 0
}
}
}
},
wait_list = {
next = 0x0,
prev = 0x0
}
},
refcount = {
counter = 0
},
rb_root = {
rb_node = 0x0
}
}
This maks me wonder, the anon_vma do not come from slab structure.
and the content is abnormal. IMO, At least anon_vma->root will not NULL.
The issue can be reproduced every other week.
Any comments will be appreciated.
Thanks
zhongjiang
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
WARNING: multiple messages have this Message-ID (diff)
From: zhong jiang <zhongjiang@huawei.com>
To: Michal Hocko <mhocko@suse.com>,
Johannes Weiner <hannes@cmpxchg.org>, <vdavydov.dev@gmail.com>,
"mgorman@techsingularity.net" <mgorman@techsingularity.net>,
Vlastimil Babka <vbabka@suse.cz>
Cc: Linux Memory Management List <linux-mm@kvack.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: NULL pointer dereference in the kernel 3.10
Date: Sat, 8 Apr 2017 21:39:42 +0800 [thread overview]
Message-ID: <58E8E81E.6090304@huawei.com> (raw)
when runing the stabile docker cases in the vm. The following issue will come up.
#40 [ffff8801b57ffb30] async_page_fault at ffffffff8165c9f8
[exception RIP: down_read_trylock+5]
RIP: ffffffff810aca65 RSP: ffff8801b57ffbe8 RFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff88018ae858c1 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008
RBP: ffff8801b57ffc10 R8: ffffea0006903de0 R9: ffff8800b3c61810
R10: 00000000000022cb R11: 0000000000000000 R12: ffff88018ae858c0
R13: ffffea0006903dc0 R14: 0000000000000008 R15: ffffea0006903dc0
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0000
#41 [ffff8801b57ffbe8] page_lock_anon_vma_read at ffffffff811b241c
#42 [ffff8801b57ffc18] page_referenced at ffffffff811b26a7
#43 [ffff8801b57ffc90] shrink_active_list at ffffffff8118d634
#44 [ffff8801b57ffd48] balance_pgdat at ffffffff8118f088
#45 [ffff8801b57ffe20] kswapd at ffffffff8118f633
#46 [ffff8801b57ffec8] kthread at ffffffff810a795f
#47 [ffff8801b57fff50] ret_from_fork at ffffffff81665398
crash> struct page.mapping ffffea0006903dc0
mapping = 0xffff88018ae858c1
crash> struct anon_vma 0xffff88018ae858c0
struct anon_vma {
root = 0x0,
rwsem = {
count = 0,
wait_lock = {
raw_lock = {
{
head_tail = 1,
tickets = {
head = 1,
tail = 0
}
}
}
},
wait_list = {
next = 0x0,
prev = 0x0
}
},
refcount = {
counter = 0
},
rb_root = {
rb_node = 0x0
}
}
This maks me wonder, the anon_vma do not come from slab structure.
and the content is abnormal. IMO, At least anon_vma->root will not NULL.
The issue can be reproduced every other week.
Any comments will be appreciated.
Thanks
zhongjiang
next reply other threads:[~2017-04-08 13:40 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-08 13:39 zhong jiang [this message]
2017-04-08 13:39 ` NULL pointer dereference in the kernel 3.10 zhong jiang
2017-04-10 6:42 ` Hillf Danton
2017-04-10 6:42 ` Hillf Danton
2017-04-10 8:56 ` Xishi Qiu
2017-04-10 8:56 ` Xishi Qiu
2017-04-10 9:37 ` Hillf Danton
2017-04-10 9:37 ` Hillf Danton
2017-04-10 9:53 ` Xishi Qiu
2017-04-10 9:53 ` Xishi Qiu
2017-04-10 10:08 ` Hillf Danton
2017-04-10 10:08 ` Hillf Danton
2017-04-10 8:56 ` Mel Gorman
2017-04-10 8:56 ` Mel Gorman
2017-04-10 12:10 ` zhong jiang
2017-04-10 12:10 ` zhong jiang
2017-04-10 12:48 ` Michal Hocko
2017-04-10 12:48 ` Michal Hocko
2017-04-10 14:06 ` zhong jiang
2017-04-10 14:06 ` zhong jiang
2017-04-10 14:13 ` Willy Tarreau
2017-04-10 14:13 ` Willy Tarreau
2017-04-10 14:33 ` zhong jiang
2017-04-10 14:33 ` zhong jiang
2017-04-10 14:43 ` Willy Tarreau
2017-04-10 14:43 ` Willy Tarreau
2017-04-10 14:06 ` Mel Gorman
2017-04-10 14:06 ` Mel Gorman
2017-04-10 14:11 ` zhong jiang
2017-04-10 14:11 ` zhong jiang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=58E8E81E.6090304@huawei.com \
--to=zhongjiang@huawei.com \
--cc=hannes@cmpxchg.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mgorman@techsingularity.net \
--cc=mhocko@suse.com \
--cc=vbabka@suse.cz \
--cc=vdavydov.dev@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.