[BUG 2.6.30] Bad page map in process

Guennadi Liakhovetski
2009-07-08T11:07:32Z

Hi

with a 2.6.30 kernel with only platform-specific modifications and this
avr32 patch:

http://git.kernel.org/?p=linux/kernel/git/sfr/linux-next.git;a=commitdiff;h=bb6e647051a59dca5a72b3deef1e061d7c1c34da

we're seeing kernel BUGs following an application segfault. Here's an
example:

[60254.432000] application[465]: segfault at 4377f876 pc 2aaabbde sp 7faa77f0 ecr 24
[60255.396000] BUG: Bad page map in process application pte:13f26ed4 pmd:92fdd000
[60255.404000] page:902c44c0 flags:0000002c count:1 mapcount:-1 mapping:9345765c index:5
[60255.412000] addr:2ae4f000 vm_flags:08000075 anon_vma:(null) mapping:93454dd4 index:0
[60255.420000] vma->vm_ops->fault: filemap_fault+0x0/0x26c
[60255.424000] vma->vm_file->f_op->mmap: generic_file_readonly_mmap+0x0/0x18
[60255.432000] Call trace:
[60255.432000] [<90027b7c>] dump_stack+0x18/0x20
[60255.432000] [<9005f2e8>] print_bad_pte+0x120/0x13c
[60255.432000] [<90060964>] unmap_vmas+0x230/0x3e4
[60255.432000] [<90061ed2>] exit_mmap+0x5e/0xd0
[60255.432000] [<9002d380>] mmput+0x24/0x7c
[60255.432000] [<9002fd70>] exit_mm+0xb4/0xb8
[60255.432000] [<90030ede>] do_exit+0xde/0x3d8
[60255.432000] [<90031222>] do_group_exit+0x4a/0x64
[60255.432000] [<9003688e>] get_signal_to_deliver+0x22a/0x24c
[60255.432000] [<900272ce>] do_signal+0x52/0x3f0
[60255.432000] [<90027698>] do_notify_resume+0x2c/0xfc
[60255.432000] [<900233d2>] fault_exit_work+0x24/0x36
[60255.432000]
[60255.432000] Disabling lock debugging due to kernel taint
[60255.432000] BUG: Bad page state in process application pfn:13f26
[60255.440000] page:902c44c0 flags:0000000c count:0 mapcount:-1 mapping:9345765c index:5
[60255.448000] Call trace:
[60255.448000] [<90027b7c>] dump_stack+0x18/0x20
[60255.448000] [<90054c76>] bad_page+0xa6/0xd0
[60255.448000] [<900557e6>] free_hot_cold_page+0xa2/0x160
[60255.448000] [<900558dc>] free_hot_page+0x8/0xc
[60255.448000] [<90057bae>] put_page+0xca/0xe8
[60255.448000] [<900662a4>] free_page_and_swap_cache+0x38/0x3c
[60255.448000] [<90060972>] unmap_vmas+0x23e/0x3e4
[60255.448000] [<90061ed2>] exit_mmap+0x5e/0xd0
[60255.448000] [<9002d380>] mmput+0x24/0x7c
[60255.448000] [<9002fd70>] exit_mm+0xb4/0xb8
[60255.448000] [<90030ede>] do_exit+0xde/0x3d8
[60255.448000] [<90031222>] do_group_exit+0x4a/0x64
[60255.448000] [<9003688e>] get_signal_to_deliver+0x22a/0x24c
[60255.448000] [<900272ce>] do_signal+0x52/0x3f0
[60255.448000] [<90027698>] do_notify_resume+0x2c/0xfc
[60255.448000] [<900233d2>] fault_exit_work+0x24/0x36
[60255.448000]

Questions: can this BUG be caused by the segfault (it better not)? If not,
what can be the reason? The problem occurs sporadically, I've only had one
such case since yesterday. Yet one more application segfault last night
didn't produce a BUG. This is with a kernel configured with SLAB. With
SLUB we also observed similar BUGs on application exit but without signal
handling path in the backtrace. But, I think, I've had other problems with
SLUB before, so, we switched back to SLAB for now...