From mboxrd@z Thu Jan  1 00:00:00 1970
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Subject: Re: 2.6.38 x86_64 domU - BUG: Bad page state
Date: Tue, 26 Apr 2011 13:43:12 -0400
Message-ID: <20110426174312.GB25442@dumpdata.com>
References: <4DB6E58D.1080105@theshore.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Return-path: <xen-devel-bounces@lists.xensource.com>
Content-Disposition: inline
In-Reply-To: <4DB6E58D.1080105@theshore.net>
List-Unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: "Christopher S. Aker" <caker@theshore.net>, Ian Campbell <Ian.Campbell@eu.citrix.com>
Cc: xen devel <xen-devel@lists.xensource.com>
List-Id: xen-devel@lists.xenproject.org

On Tue, Apr 26, 2011 at 11:32:29AM -0400, Christopher S. Aker wrote:
> We've been experiencing this behavior since switching to 2.6.38 64
> bit.  Lots of reports across our fleet, so not an isolated
> problem...
> 
> DomU: 2.6.38 x86_64
> Xen: 3.4.1
> 
> BUG: Bad page state in process swapper  pfn:1a399
> page:ffffea00005bc978 count:-1 mapcount:0 mapping:          (null)

And the same issue as somebody else reported. Where the page
count is negative.

Ian, any thoughts on this? Could the grant freeing have a race?
Or double-freeing?


> index:0xffff88001a399700
> page flags: 0x100000000000000()
> Pid: 0, comm: swapper Not tainted 2.6.38-x86_64-linode17 #1
> Call Trace:
>  <IRQ>  [<ffffffff810aa910>] ? dump_page+0xb1/0xb6
>  [<ffffffff810ab86a>] ? bad_page+0xd8/0xf0
>  [<ffffffff810ad0ca>] ? get_page_from_freelist+0x487/0x715
>  [<ffffffff8100699f>] ? xen_restore_fl_direct_end+0x0/0x1
>  [<ffffffff810dc49a>] ? kmem_cache_free+0x71/0xad
>  [<ffffffff810ad55c>] ? __alloc_pages_nodemask+0x14d/0x6ab
>  [<ffffffff81403a73>] ? __netdev_alloc_skb+0x1d/0x3a
>  [<ffffffff8144b392>] ? ip_rcv_finish+0x319/0x343
>  [<ffffffff81403a73>] ? __netdev_alloc_skb+0x1d/0x3a
>  [<ffffffff810d6f35>] ? alloc_pages_current+0xaa/0xcd
>  [<ffffffff81372fd0>] ? xennet_alloc_rx_buffers+0x7a/0x2d9
>  [<ffffffff81374d32>] ? xennet_poll+0xbef/0xc85
>  [<ffffffff8100699f>] ? xen_restore_fl_direct_end+0x0/0x1
>  [<ffffffff8140d709>] ? net_rx_action+0xb6/0x1dc
>  [<ffffffff812f1bf7>] ? unmask_evtchn+0x1f/0xa3
>  [<ffffffff810431a4>] ? __do_softirq+0xc7/0x1a3
>  [<ffffffff81085ca9>] ? handle_fasteoi_irq+0xd2/0xe1
>  [<ffffffff810069b2>] ? check_events+0x12/0x20
>  [<ffffffff8100a85c>] ? call_softirq+0x1c/0x30
>  [<ffffffff8100bebd>] ? do_softirq+0x41/0x7e
>  [<ffffffff8104303b>] ? irq_exit+0x36/0x78
>  [<ffffffff812f273c>] ? xen_evtchn_do_upcall+0x2f/0x3c
>  [<ffffffff8100a8ae>] ? xen_do_hypervisor_callback+0x1e/0x30
>  <EOI>  [<ffffffff810013aa>] ? hypercall_page+0x3aa/0x1006
>  [<ffffffff810013aa>] ? hypercall_page+0x3aa/0x1006
>  [<ffffffff810013aa>] ? hypercall_page+0x3aa/0x1006
>  [<ffffffff810063a3>] ? xen_safe_halt+0x10/0x1a
>  [<ffffffff81010998>] ? default_idle+0x4b/0x85
>  [<ffffffff81008d53>] ? cpu_idle+0x60/0x97
>  [<ffffffff81533d09>] ? rest_init+0x6d/0x6f
>  [<ffffffff81b2bd34>] ? start_kernel+0x37f/0x38a
>  [<ffffffff81b2b2cd>] ? x86_64_start_reservations+0xb8/0xbc
>  [<ffffffff81b2ee71>] ? xen_start_kernel+0x528/0x52f
> 
> ... it continues with more BUGs.  Full log here:
> 
> http://www.theshore.net/~caker/xen/BUGS/2.6.38/
> 
> Thanks,
> -Chris
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xensource.com
> http://lists.xensource.com/xen-devel