From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752592AbdESI4h (ORCPT ); Fri, 19 May 2017 04:56:37 -0400 Received: from szxga01-in.huawei.com ([45.249.212.187]:6787 "EHLO szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750766AbdESI4g (ORCPT ); Fri, 19 May 2017 04:56:36 -0400 Message-ID: <591EB25C.9080901@huawei.com> Date: Fri, 19 May 2017 16:52:44 +0800 From: Xishi Qiu User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: Andrew Morton , Tejun Heo , Michal Hocko , Johannes Weiner , "Mel Gorman" , Michal Hocko , Vlastimil Babka , Minchan Kim , "David Rientjes" , Joonsoo Kim , , , Rik van Riel , Hugh Dickins CC: Linux MM , LKML , "zhong jiang" Subject: Re: mm, something wring in page_lock_anon_vma_read()? References: <591D6D79.7030704@huawei.com> In-Reply-To: <591D6D79.7030704@huawei.com> Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit X-Originating-IP: [10.177.25.179] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A0B0203.591EB26B.01B2,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 45fe998c3501af5cd2e05e09dc4a2ace Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2017/5/18 17:46, Xishi Qiu wrote: > Hi, my system triggers this bug, and the vmcore shows the anon_vma seems be freed. > The kernel is RHEL 7.2, and the bug is hard to reproduce, so I don't know if it > exists in mainline, any reply is welcome! > When we alloc anon_vma, we will init the value of anon_vma->root, so can we set anon_vma->root to NULL when calling anon_vma_free -> kmem_cache_free(anon_vma_cachep, anon_vma); anon_vma_free() ... anon_vma->root = NULL; kmem_cache_free(anon_vma_cachep, anon_vma); I find if we do this above, system boot failed, why? Thanks, Xishi Qiu > [35030.332666] general protection fault: 0000 [#1] SMP > [35030.333016] Modules linked in: veth ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 xt_addrtype iptable_filter xt_conntrack nf_nat nf_conntrack bridge stp llc dm_thin_pool dm_persistent_data dm_bio_prison dm_bufio libcrc32c rtos_kbox_panic(OE) ipmi_devintf ipmi_si ipmi_msghandler signo_catch(O) cirrus syscopyarea sysfillrect sysimgblt ttm crc32_pclmul ghash_clmulni_intel drm_kms_helper aesni_intel ppdev drm lrw gf128mul parport_pc glue_helper ablk_helper serio_raw cryptd i2c_piix4 parport pcspkr sg floppy i2c_core dm_mod sha512_generic ip_tables sd_mod crc_t10dif crct10dif_generic sr_mod cdrom virtio_console virtio_scsi virtio_net ata_generic pata_acpi crct10dif_pclmul crct10dif_common crc32c_intel virtio_pci virtio_ring virtio ata_piix libata ext4 mbcache > [35030.333016] jbd2 > [35030.333016] CPU: 3 PID: 48 Comm: kswapd0 Tainted: G OE ---- ------- 3.10.0-327.36.58.4.x86_64 #1 > [35030.333016] Hardware name: OpenStack Foundation OpenStack Nova, BIOS rel-1.8.1-0-g4adadbd-20160826_044443-hghoulaslx112 04/01/2014 > [35030.333016] task: ffff8801b2d20000 ti: ffff8801b4c38000 task.ti: ffff8801b4c38000 > [35030.333016] RIP: 0010:[] [] down_read_trylock+0x5/0x50 > [35030.333016] RSP: 0000:ffff8801b4c3ba90 EFLAGS: 00010282 > [35030.333016] RAX: 0000000000000000 RBX: ffff8801b3e2a100 RCX: 0000000000000000 > [35030.333016] RDX: 0000000000000000 RSI: 0000000000000000 RDI: deb604d497705c5d > [35030.333016] RBP: ffff8801b4c3bab8 R08: ffffea0002c34460 R09: ffff8801b3d7e8a0 > [35030.333016] R10: 0000000000000004 R11: fff00000fe000000 R12: ffff8801b3e2a101 > [35030.333016] R13: ffffea0002c34440 R14: deb604d497705c5d R15: ffffea0002c34440 > [35030.333016] FS: 0000000000000000(0000) GS:ffff8801bed80000(0000) knlGS:0000000000000000 > [35030.333016] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [35030.333016] CR2: 000000c422011080 CR3: 0000000001976000 CR4: 00000000001407e0 > [35030.333016] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > [35030.333016] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 > [35030.333016] Stack: > [35030.333016] ffffffff811b2795 ffffea0002c34440 0000000000000000 000000000000000f > [35030.333016] 0000000000000001 ffff8801b4c3bb30 ffffffff811b2a17 ffff8800a712d640 > [35030.333016] 000000000c4229e2 ffff8801b4c3bb80 0000000100000000 000000000c41fe38 > [35030.333016] Call Trace: > [35030.333016] [] ? page_lock_anon_vma_read+0x55/0x110 > [35030.333016] [] page_referenced+0x1c7/0x350 > [35030.333016] [] shrink_active_list+0x1e4/0x400 > [35030.333016] [] shrink_lruvec+0x4bd/0x770 > [35030.333016] [] shrink_zone+0x76/0x1a0 > [35030.333016] [] balance_pgdat+0x49c/0x610 > [35030.333016] [] kswapd+0x173/0x450 > [35030.333016] [] ? wake_up_atomic_t+0x30/0x30 > [35030.333016] [] ? balance_pgdat+0x610/0x610 > [35030.333016] [] kthread+0xcf/0xe0 > [35030.333016] [] ? kthread_create_on_node+0x120/0x120 > [35030.333016] [] ret_from_fork+0x58/0x90 > [35030.333016] [] ? kthread_create_on_node+0x120/0x120 > [35030.333016] Code: 00 ba ff ff ff ff 48 89 d8 f0 48 0f c1 10 79 05 e8 31 06 27 00 5b 5d c3 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 <48> 8b 07 48 89 c2 48 83 c2 01 7e 07 f0 48 0f b1 17 75 f0 48 f7 > [35030.333016] RIP [] down_read_trylock+0x5/0x50 > [35030.333016] RSP > [35030.333016] ------------[ cut here ]------------ > > struct page { > flags = 9007194960298056, > mapping = 0xffff8801b3e2a101, > { > { > index = 34324593617, > freelist = 0x7fde7bbd1, > pfmemalloc = 209, > thp_mmu_gather = { > counter = -35144751 > }, > pmd_huge_pte = 0x7fde7bbd1 > }, > { > counters = 8589934592, > { > { > _mapcount = { > counter = 0 > }, > { > inuse = 0, > objects = 0, > frozen = 0 > }, > units = 0 > }, > _count = { > counter = 2 > } > } > } > }, > { > lru = { > next = 0xdead000000100100, > prev = 0xdead000000200200 > }, > { > next = 0xdead000000100100, > pages = 2097664, > pobjects = -559087616 > }, > list = { > next = 0xdead000000100100, > prev = 0xdead000000200200 > }, > slab_page = 0xdead000000100100 > }, > { > private = 0, > ptl = { > { > rlock = { > raw_lock = { > { > head_tail = 0, > tickets = { > head = 0, > tail = 0 > } > } > } > } > } > }, > slab_cache = 0x0, > first_page = 0x0 > } > } > > > > crash> struct anon_vma 0xffff8801b3e2a100 > struct anon_vma { > root = 0xdeb604d497705c55, > rwsem = { > count = -8192007903225070328, > wait_lock = { > raw_lock = { > { > head_tail = 2955503940, > tickets = { > head = 26948, > tail = 45097 > } > } > } > }, > wait_list = { > next = 0x559f9107c1b47439, > prev = 0x3de13f709bfa043b > } > }, > refcount = { > counter = -13243516 > }, > rb_root = { > rb_node = 0x11dd18f9ce0bb2e9 > } > } > > This address 0xffff8801b3e2a100 can not find in "kmem -S anon_vma" > > The page flags is > crash> kmem -g 0x1FFFFF00080048 > FLAGS: 1fffff00080048 > PAGE-FLAG BIT VALUE > PG_uptodate 3 0000008 > PG_active 6 0000040 > PG_swapbacked 19 0080000 > > > . >