linux-kernel - Re: [Bad page] trying to free locked page? (Re: [PATCH][RFC] fix kernel BUG at mm/migrate.c:719! in 2.6.26-rc5-mm3)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20080618113235.c89ec08d.nishimura@mxp.nes.nec.co.jp>
Date:	Wed, 18 Jun 2008 11:32:35 +0900
From:	Daisuke Nishimura <nishimura@....nes.nec.co.jp>
To:	KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Rik van Riel <riel@...hat.com>,
	Lee Schermerhorn <lee.schermerhorn@...com>,
	Nick Piggin <npiggin@...e.de>, linux-mm@...ck.org,
	linux-kernel@...r.kernel.org, kernel-testers@...r.kernel.org
Subject: Re: [Bad page] trying to free locked page? (Re: [PATCH][RFC] fix
 kernel BUG at mm/migrate.c:719! in 2.6.26-rc5-mm3)

On Wed, 18 Jun 2008 00:34:16 +0900, KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com> wrote:
> > > I got this bug while migrating pages only a few times
> > > via memory_migrate of cpuset.
> > > 
> > > Unfortunately, even if this patch is applied,
> > > I got bad_page problem after hundreds times of page migration
> > > (I'll report it in another mail).
> > > But I believe something like this patch is needed anyway.
> > > 
> > 
> > I got bad_page after hundreds times of page migration.
> > It seems that a locked page is being freed.
> 
> I can't reproduce this bad page.
> I'll try again tomorrow ;)
> 

OK. I'll report on my test more precisely.

- Environment
  HW: 4CPU(x86_64), 2node NUMA
  kernel: 2.6.26-rc5-mm3 + Lee's two fixes about double unlock_page
          + my patch. config is attached.

- mount cpuset and make settings
  # mount -t cgroup -o cpuset cpuset /cgroup/cpuset

  # mkdir /cgroup/cpuset/01
  # echo 0-1 >/cgroup/cpuset/01/cpuset.cpus
  # echo 0 >/cgroup/cpuset/01/cpuset.mems
  # echo 1 >/cgroup/cpuset/01/cpuset.memory_migrate

  # mkdir /cgroup/cpuset/02
  # echo 2-3 >/cgroup/cpuset/02/cpuset.cpus
  # echo 1 >/cgroup/cpuset/02/cpuset.mems
  # echo 1 >/cgroup/cpuset/02/cpuset.memory_migrate

- register processes in cpusets
  # echo $$ >/cgroup/cpuset/01/tasks

  I'm using LTP's page01 test, and running two instances infinitely.
  # while true; do (somewhere)/page01 4194304 1; done &
  # while true; do (somewhere)/page01 4194304 1; done &

  The same thing should be done about 02 directory.

- echo pids to another directory
  Run simple script like below.

---
#!/bin/bash

G1=$1
G2=$2

move_task()
{
        for pid in $1
        do
                echo $pid >$2/tasks 2>/dev/null
        done
}

G1_TASK=`cat ${G1}/tasks`
G2_TASK=`cat ${G2}/tasks`

move_task "${G1_TASK}" ${G2} &
move_task "${G2_TASK}" ${G1} &

wait
---

Please let me know if you need other information.
I'm also digging this problem.


Thanks,
Daisuke Nishimura.


View attachment "config-2.6.26-rc5-mm3" of type "text/plain" (76270 bytes)