lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Fri, 7 Mar 2014 14:18:10 +0200
From:	"Kirill A. Shutemov" <>
To:	Sasha Levin <>
Cc:	Bob Liu <>,
	"Kirill A. Shutemov" <>,
	Andrea Arcangeli <>,
	"" <>,
	Andrew Morton <>,
	LKML <>
Subject: Re: mm: kernel BUG at mm/huge_memory.c:2785!

On Thu, Mar 06, 2014 at 08:32:48PM -0500, Sasha Levin wrote:
> On 03/04/2014 10:53 PM, Sasha Levin wrote:
> >On 03/04/2014 10:16 PM, Bob Liu wrote:
> >>On Thu, Feb 27, 2014 at 11:03 PM, Kirill A. Shutemov
> >><> wrote:
> >>>Sasha Levin wrote:
> >>>>Hi all,
> >>>>
> >>>>While fuzzing with trinity inside a KVM tools guest running latest -next kernel I've stumbled on the
> >>>>following spew:
> >>>>
> >>>>[ 1428.146261] kernel BUG at mm/huge_memory.c:2785!
> >>>
> >>>Hm, interesting.
> >>>
> >>>It seems we either failed to split huge page on vma split or it
> >>>materialized from under us. I don't see how it can happen:
> >>>
> >>>   - it seems we do the right thing with vma_adjust_trans_huge() in
> >>>     __split_vma();
> >>>   - we hold ->mmap_sem all the way from vm_munmap(). At least I don't see
> >>>     a place where we could drop it;
> >>>
> >>
> >>Enable CONFIG_DEBUG_VM may show some useful information, at least we
> >>can confirm weather rwsem_is_locked(&tlb->mm->mmap_sem) before
> >>split_huge_page_pmd().
> >
> >I have CONFIG_DEBUG_VM enabled and that code you're talking is not triggering, so mmap_sem
> >is locked.
> Guess what. I've just hit it.

I think this particular traceback is not a real problem: by time of
exit_mm() we shouldn't race with anybody for the mm_struct.

We probably could drop ->mmap_sem later in mmput() rather then in
exit_mm() to fix this false positive.

> It's worth keeping in mind that this is the first time I see it.

Hm. That's strange exit_mmap() is called without holding ->mmap_sem.

 Kirill A. Shutemov
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

Powered by blists - more mailing lists