From: Matthew Wilcox <willy@infradead.org>
To: Hugh Dickins <hughd@google.com>
Cc: syzbot <syzbot+b8e0dfee3fd8c9012771@syzkaller.appspotmail.com>,
"Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
Andrew Morton <akpm@linux-foundation.org>,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
syzkaller-bugs@googlegroups.com
Subject: Re: kernel BUG at mm/shmem.c:LINE!
Date: Mon, 23 Jul 2018 07:01:50 -0700 [thread overview]
Message-ID: <20180723140150.GA31843@bombadil.infradead.org> (raw)
In-Reply-To: <alpine.LSU.2.11.1807221856350.5536@eggly.anvils>
On Sun, Jul 22, 2018 at 07:28:01PM -0700, Hugh Dickins wrote:
> Whether or not that fixed syzbot's kernel BUG at mm/shmem.c:815!
> I don't know, but I'm afraid it has not fixed linux-next breakage of
> huge tmpfs: I get a similar page_to_pgoff BUG at mm/filemap.c:1466!
>
> Please try something like
> mount -o remount,huge=always /dev/shm
> cp /dev/zero /dev/shm
>
> Writing soon crashes in find_lock_entry(), looking up offset 0x201
> but getting the page for offset 0x3c1 instead.
Hmm. I don't see a crash while running that command, but I do see an RCU
stall in find_get_entries() called from shmem_undo_range() when running
'cp' the second time -- ie while truncating the /dev/shm/zero file.
Maybe I'm seeing the same bug as you, and maybe I'm seeing a different
one. Do we have a shmem test suite somewhere?
> I've spent a while on it, but better turn over to you, Matthew:
> my guess is that xas_create_range() does not create the layout
> you expect from it.
I've dumped the XArray tree on my machine and it actually looks fine
*except* that the pages pointed to are free! That indicates to me I
screwed up somebody's reference count somewhere.
next prev parent reply other threads:[~2018-07-23 14:01 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-07 1:19 kernel BUG at mm/shmem.c:LINE! syzbot
2018-07-07 2:57 ` Matthew Wilcox
2018-07-09 14:36 ` Matthew Wilcox
2018-07-23 2:28 ` Hugh Dickins
2018-07-23 14:01 ` Matthew Wilcox [this message]
2018-07-23 19:14 ` Hugh Dickins
2018-07-23 20:36 ` Matthew Wilcox
2018-07-23 22:42 ` Hugh Dickins
2018-07-23 22:54 ` Matthew Wilcox
2018-07-24 9:12 ` Hugh Dickins
2018-07-26 6:53 ` Hugh Dickins
2018-07-26 14:33 ` Matthew Wilcox
2018-07-26 16:40 ` Hugh Dickins
2018-07-26 19:32 ` Matthew Wilcox
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180723140150.GA31843@bombadil.infradead.org \
--to=willy@infradead.org \
--cc=akpm@linux-foundation.org \
--cc=hughd@google.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=syzbot+b8e0dfee3fd8c9012771@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).