* Re: linux-v3.9-rc3: BUG: Bad page map in process trinity-child6 pte:002f9045 pmd:29e421e1 [not found] <514C94C4.4050008@gmx.de> @ 2013-03-25 22:53 ` Andrew Morton 2013-03-26 16:44 ` Toralf Förster 0 siblings, 1 reply; 4+ messages in thread From: Andrew Morton @ 2013-03-25 22:53 UTC (permalink / raw) To: Toralf Förster; +Cc: user-mode-linux-user, Linux Kernel, linux-mm On Fri, 22 Mar 2013 18:28:36 +0100 Toralf F__rster <toralf.foerster@gmx.de> wrote: > Using trinity I often trigger under a user mode linux image with host kernel 3.8.4 > and guest kernel linux-v3.9-rc3-244-g9217cbb the following : > (The UML guest is a 32bit stable Gentoo Linux) I assume 3.8 is OK? > > 2013-03-22T18:03:01.232+01:00 trinity kernel: BUG: Bad page map in process trinity-child6 pte:002f9045 pmd:29e421e1 > 2013-03-22T18:03:01.232+01:00 trinity kernel: page:0920df20 count:1 mapcount:-1 mapping: (null) index:0x0 mapcount=-1. > 2013-03-22T18:03:01.232+01:00 trinity kernel: page flags: 0x400(reserved) > 2013-03-22T18:03:01.232+01:00 trinity kernel: addr:00100000 vm_flags:00060055 anon_vma: (null) mapping: (null) index:100 > 2013-03-22T18:03:01.232+01:00 trinity kernel: vma->vm_ops->fault: special_mapping_fault+0x0/0x80 > 2013-03-22T18:03:01.232+01:00 trinity kernel: 31e87d1c: [<0833b8b8>] dump_stack+0x22/0x24 > 2013-03-22T18:03:01.232+01:00 trinity kernel: 31e87d34: [<0833cc71>] print_bad_pte+0x17b/0x197 > 2013-03-22T18:03:01.232+01:00 trinity kernel: 31e87d78: [<080e1138>] unmap_single_vma+0x268/0x430 > 2013-03-22T18:03:01.232+01:00 trinity kernel: 31e87dd8: [<080e1837>] unmap_vmas+0x37/0x50 > 2013-03-22T18:03:01.232+01:00 trinity kernel: 31e87df4: [<080e4970>] unmap_region+0x80/0xe0 > 2013-03-22T18:03:01.233+01:00 trinity kernel: 31e87e30: [<080e6661>] do_munmap+0x231/0x2a0 > 2013-03-22T18:03:01.233+01:00 trinity kernel: 31e87e68: [<080e8ae8>] sys_mremap+0x248/0x480 > 2013-03-22T18:03:01.233+01:00 trinity kernel: 31e87eac: [<08062a82>] handle_syscall+0x82/0xb0 > 2013-03-22T18:03:01.233+01:00 trinity kernel: 31e87ef4: [<08074dfd>] userspace+0x46d/0x590 > 2013-03-22T18:03:01.233+01:00 trinity kernel: 31e87fec: [<0805f7bc>] fork_handler+0x6c/0x70 > 2013-03-22T18:03:01.233+01:00 trinity kernel: 31e87ffc: [<00000000>] 0x0 > 2013-03-22T18:03:01.233+01:00 trinity kernel: 2013-03-22T18:03:01.233+01:00 trinity kernel: Disabling lock debugging due to kernel taint > 2013-03-22T18:03:01.233+01:00 trinity kernel: BUG: Bad page state in process trinity-child6 pfn:002f9 > 2013-03-22T18:03:01.233+01:00 trinity kernel: page:0920df20 count:0 mapcount:-1 mapping: (null) index:0x0 > 2013-03-22T18:03:01.235+01:00 trinity kernel: page flags: 0x400(reserved) > 2013-03-22T18:03:01.235+01:00 trinity kernel: 31e87cd4: [<0833b8b8>] dump_stack+0x22/0x24 > 2013-03-22T18:03:01.235+01:00 trinity kernel: 31e87cec: [<080cd755>] bad_page+0xb5/0xe0 > 2013-03-22T18:03:01.235+01:00 trinity kernel: 31e87d08: [<080cd7f3>] free_pages_prepare+0x73/0xb0 > 2013-03-22T18:03:01.235+01:00 trinity kernel: 31e87d24: [<080cec1d>] free_hot_cold_page+0x1d/0x100 > 2013-03-22T18:03:01.235+01:00 trinity kernel: 31e87d4c: [<080d15ae>] __put_single_page+0x1e/0x30 > 2013-03-22T18:03:01.235+01:00 trinity kernel: 31e87d60: [<080d16d7>] put_page+0x27/0x30 > 2013-03-22T18:03:01.235+01:00 trinity kernel: 31e87d68: [<080ee6ec>] free_page_and_swap_cache+0x3c/0x50 > 2013-03-22T18:03:01.235+01:00 trinity kernel: 31e87d78: [<080e1155>] unmap_single_vma+0x285/0x430 > 2013-03-22T18:03:01.235+01:00 trinity kernel: 31e87dd8: [<080e1837>] unmap_vmas+0x37/0x50 > 2013-03-22T18:03:01.236+01:00 trinity kernel: 31e87df4: [<080e4970>] unmap_region+0x80/0xe0 > 2013-03-22T18:03:01.236+01:00 trinity kernel: 31e87e30: [<080e6661>] do_munmap+0x231/0x2a0 > 2013-03-22T18:03:01.236+01:00 trinity kernel: 31e87e68: [<080e8ae8>] sys_mremap+0x248/0x480 > 2013-03-22T18:03:01.236+01:00 trinity kernel: 31e87eac: [<08062a82>] handle_syscall+0x82/0xb0 > 2013-03-22T18:03:01.236+01:00 trinity kernel: 31e87ef4: [<08074dfd>] userspace+0x46d/0x590 > 2013-03-22T18:03:01.236+01:00 trinity kernel: 31e87fec: [<0805f7bc>] fork_handler+0x6c/0x70 > 2013-03-22T18:03:01.236+01:00 trinity kernel: 31e87ffc: [<00000000>] 0x0 > 2013-03-22T18:03:01.236+01:00 trinity kernel: 2013-03-22T18:03:01.236+01:00 trinity kernel: BUG: Bad page map in process trinity-child6 pte:29e38045 pmd:29e421e1 > 2013-03-22T18:03:01.236+01:00 trinity kernel: page:09744700 count:1 mapcount:-1 mapping: (null) index:0x0 > 2013-03-22T18:03:01.237+01:00 trinity kernel: page flags: 0x0() > 2013-03-22T18:03:01.237+01:00 trinity kernel: addr:00101000 vm_flags:00060055 anon_vma: (null) mapping: (null) index:101 > 2013-03-22T18:03:01.237+01:00 trinity kernel: vma->vm_ops->fault: special_mapping_fault+0x0/0x80 > 2013-03-22T18:03:01.237+01:00 trinity kernel: 31e87d1c: [<0833b8b8>] dump_stack+0x22/0x24 > 2013-03-22T18:03:01.237+01:00 trinity kernel: 31e87d34: [<0833cc71>] print_bad_pte+0x17b/0x197 > 2013-03-22T18:03:01.237+01:00 trinity kernel: 31e87d78: [<080e1138>] unmap_single_vma+0x268/0x430 > 2013-03-22T18:03:01.237+01:00 trinity kernel: 31e87dd8: [<080e1837>] unmap_vmas+0x37/0x50 > 2013-03-22T18:03:01.237+01:00 trinity kernel: 31e87df4: [<080e4970>] unmap_region+0x80/0xe0 > 2013-03-22T18:03:01.237+01:00 trinity kernel: 31e87e30: [<080e6661>] do_munmap+0x231/0x2a0 > 2013-03-22T18:03:01.237+01:00 trinity kernel: 31e87e68: [<080e8ae8>] sys_mremap+0x248/0x480 > 2013-03-22T18:03:01.238+01:00 trinity kernel: 31e87eac: [<08062a82>] handle_syscall+0x82/0xb0 > 2013-03-22T18:03:01.238+01:00 trinity kernel: 31e87ef4: [<08074dfd>] userspace+0x46d/0x590 > 2013-03-22T18:03:01.238+01:00 trinity kernel: 31e87fec: [<0805f7bc>] fork_handler+0x6c/0x70 > 2013-03-22T18:03:01.238+01:00 trinity kernel: 31e87ffc: [<00000000>] 0x0 > 2013-03-22T18:03:01.238+01:00 trinity kernel: 2013-03-22T18:03:01.238+01:00 trinity kernel: BUG: Bad page state in process trinity-child6 pfn:29e38 > 2013-03-22T18:03:01.238+01:00 trinity kernel: page:09744700 count:0 mapcount:-1 mapping: (null) index:0x0 > 2013-03-22T18:03:01.238+01:00 trinity kernel: page flags: 0x0() > 2013-03-22T18:03:01.238+01:00 trinity kernel: 31e87cd4: [<0833b8b8>] dump_stack+0x22/0x24 > 2013-03-22T18:03:01.238+01:00 trinity kernel: 31e87cec: [<080cd755>] bad_page+0xb5/0xe0 > 2013-03-22T18:03:01.239+01:00 trinity kernel: 31e87d08: [<080cd7f3>] free_pages_prepare+0x73/0xb0 > 2013-03-22T18:03:01.239+01:00 trinity kernel: 31e87d24: [<080cec1d>] free_hot_cold_page+0x1d/0x100 > 2013-03-22T18:03:01.239+01:00 trinity kernel: 31e87d4c: [<080d15ae>] __put_single_page+0x1e/0x30 > 2013-03-22T18:03:01.239+01:00 trinity kernel: 31e87d60: [<080d16d7>] put_page+0x27/0x30 > 2013-03-22T18:03:01.239+01:00 trinity kernel: 31e87d68: [<080ee6ec>] free_page_and_swap_cache+0x3c/0x50 > 2013-03-22T18:03:01.239+01:00 trinity kernel: 31e87d78: [<080e1155>] unmap_single_vma+0x285/0x430 > 2013-03-22T18:03:01.239+01:00 trinity kernel: 31e87dd8: [<080e1837>] unmap_vmas+0x37/0x50 > 2013-03-22T18:03:01.239+01:00 trinity kernel: 31e87df4: [<080e4970>] unmap_region+0x80/0xe0 > 2013-03-22T18:03:01.239+01:00 trinity kernel: 31e87e30: [<080e6661>] do_munmap+0x231/0x2a0 > 2013-03-22T18:03:01.239+01:00 trinity kernel: 31e87e68: [<080e8ae8>] sys_mremap+0x248/0x480 > 2013-03-22T18:03:01.240+01:00 trinity kernel: 31e87eac: [<08062a82>] handle_syscall+0x82/0xb0 > 2013-03-22T18:03:01.240+01:00 trinity kernel: 31e87ef4: [<08074dfd>] userspace+0x46d/0x590 > 2013-03-22T18:03:01.240+01:00 trinity kernel: 31e87fec: [<0805f7bc>] fork_handler+0x6c/0x70 > 2013-03-22T18:03:01.240+01:00 trinity kernel: 31e87ffc: [<00000000>] 0x0 > 2013-03-22T18:03:01.240+01:00 trinity kernel: 2013-03-22T18:03:01.240+01:00 trinity kernel: Stub registers - > 2013-03-22T18:03:01.240+01:00 trinity kernel: 0 - 100000 > 2013-03-22T18:03:01.240+01:00 trinity kernel: 1 - 300000 > 2013-03-22T18:03:01.240+01:00 trinity kernel: 2 - 0 > 2013-03-22T18:03:01.240+01:00 trinity kernel: 3 - 0 > 2013-03-22T18:03:01.243+01:00 trinity kernel: 4 - 0 > 2013-03-22T18:03:01.243+01:00 trinity kernel: 5 - 0 > 2013-03-22T18:03:01.243+01:00 trinity kernel: 6 - 0 > 2013-03-22T18:03:01.243+01:00 trinity kernel: 7 - 7b > 2013-03-22T18:03:01.243+01:00 trinity kernel: 8 - 7b > 2013-03-22T18:03:01.243+01:00 trinity kernel: 9 - 0 > 2013-03-22T18:03:01.243+01:00 trinity kernel: 10 - 33 > 2013-03-22T18:03:01.243+01:00 trinity kernel: 11 - ffffffff > 2013-03-22T18:03:01.243+01:00 trinity kernel: 12 - 1000c3 > 2013-03-22T18:03:01.243+01:00 trinity kernel: 13 - 73 > 2013-03-22T18:03:01.244+01:00 trinity kernel: 14 - 10206 > 2013-03-22T18:03:01.244+01:00 trinity kernel: 15 - 101028 > 2013-03-22T18:03:01.244+01:00 trinity kernel: 16 - 7b > 2013-03-22T18:03:01.244+01:00 trinity kernel: wait_stub_done : failed to wait for SIGTRAP, pid = 3143, n = 3143, errno = 0, status = 0xb7f > > > -- > MfG/Sincerely > Toralf F__rster > pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3 > -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: linux-v3.9-rc3: BUG: Bad page map in process trinity-child6 pte:002f9045 pmd:29e421e1 2013-03-25 22:53 ` linux-v3.9-rc3: BUG: Bad page map in process trinity-child6 pte:002f9045 pmd:29e421e1 Andrew Morton @ 2013-03-26 16:44 ` Toralf Förster 2013-03-26 23:03 ` Hugh Dickins 0 siblings, 1 reply; 4+ messages in thread From: Toralf Förster @ 2013-03-26 16:44 UTC (permalink / raw) To: Andrew Morton; +Cc: user-mode-linux-user, Linux Kernel, linux-mm On 03/25/2013 11:53 PM, Andrew Morton wrote: > On Fri, 22 Mar 2013 18:28:36 +0100 Toralf F__rster <toralf.foerster@gmx.de> wrote: > >> > Using trinity I often trigger under a user mode linux image with host kernel 3.8.4 >> > and guest kernel linux-v3.9-rc3-244-g9217cbb the following : >> > (The UML guest is a 32bit stable Gentoo Linux) > I assume 3.8 is OK? > With UML kernel 3.7.10 (host kernel still 3.8.4) I can trigger this issue too. Just to clarify it - here the bug appears in the UML kernel - the host kernel is ok (I can of course crash a host kernel too by trinity'ing an UML guest, but that's another thread - see [1]) FWIW he trinity command is just a test of 1 syscall: $> trinity --children 1 --victims /mnt/nfs/n22/victims -c mremap [1] https://lkml.org/lkml/2013/3/24/174 -- MfG/Sincerely Toralf FA?rster pgp finger print: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 7DB6 9DA3 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: linux-v3.9-rc3: BUG: Bad page map in process trinity-child6 pte:002f9045 pmd:29e421e1 2013-03-26 16:44 ` Toralf Förster @ 2013-03-26 23:03 ` Hugh Dickins 2013-03-27 19:55 ` richard -rw- weinberger 0 siblings, 1 reply; 4+ messages in thread From: Hugh Dickins @ 2013-03-26 23:03 UTC (permalink / raw) To: Toralf Foerster Cc: richard -rw- weinberger, Andrew Morton, user-mode-linux-user, Linux Kernel, linux-mm On Tue, 26 Mar 2013, Toralf Foerster wrote: > On 03/25/2013 11:53 PM, Andrew Morton wrote: > > On Fri, 22 Mar 2013 18:28:36 +0100 Toralf Foerster <toralf.foerster@gmx.de> wrote: > > > >> > Using trinity I often trigger under a user mode linux image with host kernel 3.8.4 > >> > and guest kernel linux-v3.9-rc3-244-g9217cbb the following : > >> > (The UML guest is a 32bit stable Gentoo Linux) > > I assume 3.8 is OK? > > > With UML kernel 3.7.10 (host kernel still 3.8.4) I can trigger this > issue too. > Just to clarify it - here the bug appears in the UML kernel - the host > kernel is ok (I can of course crash a host kernel too by trinity'ing an > UML guest, but that's another thread - see [1]) > > > FWIW he trinity command is just a test of 1 syscall: > > $> trinity --children 1 --victims /mnt/nfs/n22/victims -c mremap > > > > [1] https://lkml.org/lkml/2013/3/24/174 I should think it's been like this for five years, or even more: maybe you are the first person to try unmapping user address 0x100000 on UML; though it's odd that you find it using mremap than the more common munmap. uml_setup_stubs() sets up the special vma with install_special_mapping(), but instead of then faulting in the two pages concerned, it has preset the ptes with init_stub_pte(), which did not increment page mapcount. munmap() that area (or set up another mapping in that place), and zap_pte_range() will decrement page mapcount negative, hence the "Bad page" errors. Whereas UML uses an arch_exit_mmap() hook to clear the ptes at exit time, to avoid encountering such errors. I think that adding VM_PFNMAP to those install_special_mapping() flags would be enough to fix it (and avoid the need for the arch_exit_mmap(), and let vm_insert_pfn() do the work of init_stub_pte()); but I'm not certain that would be the approved way, and I may have missed problems doing it like this (which would disallow get_user_pages(), e.g. ptrace, on that area: which might or might not be a good thing, I don't know). I'm saying this just by examination, I've not tried any of it at all. Over to Richard. Hugh -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: linux-v3.9-rc3: BUG: Bad page map in process trinity-child6 pte:002f9045 pmd:29e421e1 2013-03-26 23:03 ` Hugh Dickins @ 2013-03-27 19:55 ` richard -rw- weinberger 0 siblings, 0 replies; 4+ messages in thread From: richard -rw- weinberger @ 2013-03-27 19:55 UTC (permalink / raw) To: Hugh Dickins Cc: Toralf Foerster, Andrew Morton, user-mode-linux-user, Linux Kernel, linux-mm On Wed, Mar 27, 2013 at 12:03 AM, Hugh Dickins <hughd@google.com> wrote: > On Tue, 26 Mar 2013, Toralf Foerster wrote: >> On 03/25/2013 11:53 PM, Andrew Morton wrote: >> > On Fri, 22 Mar 2013 18:28:36 +0100 Toralf Foerster <toralf.foerster@gmx.de> wrote: >> > >> >> > Using trinity I often trigger under a user mode linux image with host kernel 3.8.4 >> >> > and guest kernel linux-v3.9-rc3-244-g9217cbb the following : >> >> > (The UML guest is a 32bit stable Gentoo Linux) >> > I assume 3.8 is OK? >> > >> With UML kernel 3.7.10 (host kernel still 3.8.4) I can trigger this >> issue too. >> Just to clarify it - here the bug appears in the UML kernel - the host >> kernel is ok (I can of course crash a host kernel too by trinity'ing an >> UML guest, but that's another thread - see [1]) >> >> >> FWIW he trinity command is just a test of 1 syscall: >> >> $> trinity --children 1 --victims /mnt/nfs/n22/victims -c mremap >> >> >> >> [1] https://lkml.org/lkml/2013/3/24/174 > > I should think it's been like this for five years, or even more: maybe > you are the first person to try unmapping user address 0x100000 on UML; > though it's odd that you find it using mremap than the more common munmap. Sounds sane. I fear trinity will find more "you are the first person to try"-bugs in UML. I'll look at it. > uml_setup_stubs() sets up the special vma with install_special_mapping(), > but instead of then faulting in the two pages concerned, it has preset > the ptes with init_stub_pte(), which did not increment page mapcount. > > munmap() that area (or set up another mapping in that place), and > zap_pte_range() will decrement page mapcount negative, hence the > "Bad page" errors. Whereas UML uses an arch_exit_mmap() hook to > clear the ptes at exit time, to avoid encountering such errors. > > I think that adding VM_PFNMAP to those install_special_mapping() flags > would be enough to fix it (and avoid the need for the arch_exit_mmap(), > and let vm_insert_pfn() do the work of init_stub_pte()); but I'm not > certain that would be the approved way, and I may have missed problems > doing it like this (which would disallow get_user_pages(), e.g. ptrace, > on that area: which might or might not be a good thing, I don't know). > > I'm saying this just by examination, I've not tried any of it at all. > Over to Richard. :-) -- Thanks, //richard -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-03-27 19:55 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <514C94C4.4050008@gmx.de>
2013-03-25 22:53 ` linux-v3.9-rc3: BUG: Bad page map in process trinity-child6 pte:002f9045 pmd:29e421e1 Andrew Morton
2013-03-26 16:44 ` Toralf Förster
2013-03-26 23:03 ` Hugh Dickins
2013-03-27 19:55 ` richard -rw- weinberger
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).