linux-kernel - Re: Bug: 2.6.24-smp: Eeek! page_mapcount(page) went negative! (-1)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <84144f020802061233g70eebd88v1ab898c00bdb775@mail.gmail.com>
Date:	Wed, 6 Feb 2008 22:33:33 +0200
From:	"Pekka Enberg" <penberg@...helsinki.fi>
To:	kerndev@...software.com
Cc:	"Hugh Dickins" <hugh@...itas.com>, linux-kernel@...r.kernel.org
Subject: Re: Bug: 2.6.24-smp: Eeek! page_mapcount(page) went negative! (-1)

Hi,

On Feb 6, 2008 10:21 PM,  <kerndev@...software.com> wrote:
> From reboot after last hang on 02/03/08, I found this...
>
> Feb  5 23:26:26 sc-software kernel: ------------[ cut here ]------------
> Feb  5 23:26:26 sc-software kernel: kernel BUG at mm/slab.c:591!
> Feb  5 23:26:26 sc-software kernel: invalid opcode: 0000 [#1] PREEMPT SMP
> Feb  5 23:26:26 sc-software kernel: Modules linked in: shpchp pci_hotplug ohci1394 ieee1394
> Feb  5 23:26:26 sc-software kernel:
> Feb  5 23:26:26 sc-software kernel: Pid: 6040, comm: modprobe Not tainted (2.6.24 #1)
> Feb  5 23:26:26 sc-software kernel: EIP: 0060:[<c017960f>] EFLAGS: 00010046 CPU: 1
> Feb  5 23:26:26 sc-software kernel: EIP is at kfree+0x8f/0xa0
> Feb  5 23:26:26 sc-software kernel: EAX: 40000000 EBX: f5915380 ECX: c1bb4498 EDX: c1bb4498
> Feb  5 23:26:26 sc-software kernel: ESI: eff354a0 EDI: f5815280 EBP: f0067e78 ESP: f0067e68
> Feb  5 23:26:26 sc-software kernel:  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
> Feb  5 23:26:26 sc-software kernel: Process modprobe (pid: 6040, ti=f0066000 task=f00b5550 task.ti=f0066000)
> Feb  5 23:26:26 sc-software kernel: Stack: 00000282 f5915380 eff354a0 b7fb87b0 f0067f1c c01ac9ac 00000003 00001812
> Feb  5 23:26:26 sc-software kernel:        f0067e98 0805ba64 00000418 0805ba64 f0067eb4 0805ba64 00001812 00000000
> Feb  5 23:26:26 sc-software kernel:        f5815280 00000001 00000000 0805be7c 0805ba64 0805aa64 08048000 00000000
> Feb  5 23:26:26 sc-software kernel: Call Trace:
> Feb  5 23:26:26 sc-software kernel:  [<c0103e5a>] show_trace_log_lvl+0x1a/0x30
> Feb  5 23:26:26 sc-software kernel:  [<c0103f2a>] show_stack_log_lvl+0x9a/0xc0
> Feb  5 23:26:26 sc-software kernel:  [<c01040d7>] show_registers+0xc7/0x250
> Feb  5 23:26:26 sc-software kernel:  [<c010441f>] die+0x11f/0x220
> Feb  5 23:26:26 sc-software kernel:  [<c01045b1>] do_trap+0x91/0xd0
> Feb  5 23:26:26 sc-software kernel:  [<c0104859>] do_invalid_op+0x89/0xa0
> Feb  5 23:26:26 sc-software kernel:  [<c0657c22>] error_code+0x72/0x78
> Feb  5 23:26:26 sc-software kernel:  [<c01ac9ac>] load_elf_binary+0x8cc/0xcf0
> Feb  5 23:26:26 sc-software kernel:  [<c0181864>] search_binary_handler+0xc4/0x250
> Feb  5 23:26:26 sc-software kernel:  [<c0181b35>] do_execve+0x145/0x190
> Feb  5 23:26:26 sc-software kernel:  [<c0101c82>] sys_execve+0x32/0xa0
> Feb  5 23:26:26 sc-software kernel:  [<c0103102>] syscall_call+0x7/0xb

This means we pass a non-slab pointer from load_elf_binary() to
kfree() which doesn't seem likely to be a software bug reading the
code. As Hugh suggested, please run memtest86+.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/