From: Sean Christopherson <sean.j.christopherson@intel.com>
To: Mike Galbraith <efault@gmx.de>
Cc: Adam Borowski <kilobyte@angband.pl>, kvm <kvm@vger.kernel.org>,
lkml <linux-kernel@vger.kernel.org>
Subject: Re: 5.0-rc1 KVM inspired "BUG: Bad page state in process" spew
Date: Wed, 9 Jan 2019 11:26:37 -0800 [thread overview]
Message-ID: <20190109192637.GA1697@linux.intel.com> (raw)
In-Reply-To: <1547046196.31155.1.camel@gmx.de>
On Wed, Jan 09, 2019 at 04:03:16PM +0100, Mike Galbraith wrote:
> On Wed, 2019-01-09 at 15:42 +0100, Adam Borowski wrote:
> > On Wed, Jan 09, 2019 at 06:38:58AM +0100, Mike Galbraith wrote:
> > > KVM seems to be busted in master ATM. All I have to do to have host
> > > start screaming and maybe exploding (if the guest doesn't do so first)
> > > is to try to install a (obese in this case) kernel over nfs mount of
> > > the host in a guest.
> > >
> > > Kernel producing the spew below is 3bd6e94, config attached.
> >
> > I get same, except that the BUGs were preceded by a bunch of warnings,
>
> Yeah, I was in too much of a rush...
>
> > > homer: # grep BUG: /netconsole.log
> > > [ 1531.909703] BUG: Bad page state in process X pfn:100491
> > > [ 1531.958141] BUG: Bad page state in process systemd-journal pfn:100412
> > > [ 1532.662359] BUG: Bad page state in process X pfn:10043f
> > > [ 1532.664033] BUG: Bad page state in process X pfn:10044d
> > > [ 1532.686433] BUG: Bad page state in process systemd-journal pfn:1027b0
> >
> > the first one being:
> >
> > Jan 9 00:41:22 umbar kernel: [74122.790461] WARNING: CPU: 2 PID: 26769 at arch/x86/kvm/mmu.c:830 mmu_spte_clear_track_bits+0x7e/0x100
>
> ...I also get oodles of those.
There's also a bugzilla bug that's probably the same thing:
https://bugzilla.kernel.org/show_bug.cgi?id=202189.
I'm 99.9% confident this is only manifests when reclaiming from the guest,
i.e. host is swapping out a VM's memory. The WARNING is complaining that
KVM is trying to reclaim a page before it has been removed from KVM's MMU,
i.e. a use-after-free scenario is imminent, and the stack trace shows the
kernel is reclaming. The bug also listed host swapping as a possible
requirement, and last but not least, I was only able to reproduce this by
forcing reclaim.
I'll try to bisect.
next prev parent reply other threads:[~2019-01-09 19:26 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-09 5:38 5.0-rc1 KVM inspired "BUG: Bad page state in process" spew Mike Galbraith
2019-01-09 14:42 ` Adam Borowski
2019-01-09 15:03 ` Mike Galbraith
2019-01-09 19:26 ` Sean Christopherson [this message]
2019-01-12 6:43 ` Mike Galbraith
2019-01-14 15:46 ` Sean Christopherson
2019-01-14 17:42 ` Mike Galbraith
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190109192637.GA1697@linux.intel.com \
--to=sean.j.christopherson@intel.com \
--cc=efault@gmx.de \
--cc=kilobyte@angband.pl \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox