| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20150614085641.GC1911@wfg-t540p.sh.intel.com>
Date: Sun, 14 Jun 2015 16:56:41 +0800
From: Fengguang Wu <fengguang.wu@...el.com>
To: Mel Gorman <mgorman@...e.de>
Cc: fengguang.wu@...el.com, LKP <lkp@...org>,
LKML <linux-kernel@...r.kernel.org>
Subject: [mm] kernel BUG at mm/slab.c:2571!
Hi Mel,
0day kernel testing robot got the below dmesg and the first bad commit is
git://git.kernel.org/pub/scm/linux/kernel/git/mel/linux-balancenuma mm-vmscan-lessipi-v7r7
commit 22f13d0730d1f7bf083d8ad7dd946f0f81a7ff1e
Author: Mel Gorman <mgorman@...e.de>
AuthorDate: Wed Jun 10 13:28:13 2015 +0100
Commit: Mel Gorman <mgorman@...e.de>
CommitDate: Thu Jun 11 16:59:46 2015 +0100
mm: Dynamically allocate TLB batch unmap control structure
The size of this structure is fixed depending on the value of NR_CPU in
the config but some enterprise configurations tune this as high as 8192.
This patch will dynamically allocate the cpumask if it is very large.
There is a possibility that cannot be allocated but it's unlikely to
persist for long and the system can still make forward progress. It also
means the cache footprint is slightly higher but direct reclaim is already
an expensive path.
Signed-off-by: Mel Gorman <mgorman@...e.de>
+-------------------------------------------------------+------------+------------+------------+
| | 7b48a228e4 | 22f13d0730 | d4ca9573ac |
+-------------------------------------------------------+------------+------------+------------+
| boot_successes | 62 | 1 | 1 |
| boot_failures | 0 | 25 | 16 |
| kernel_BUG_at_mm/slab.c | 0 | 25 | 16 |
| invalid_opcode | 0 | 25 | 16 |
| EIP_is_at_free_block | 0 | 25 | 16 |
| Kernel_panic-not_syncing:Fatal_exception_in_interrupt | 0 | 18 | 13 |
| backtrace:file_free_rcu | 0 | 6 | 5 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 7 | 3 |
| backtrace:do_group_exit | 0 | 5 | 1 |
| backtrace:SyS_exit_group | 0 | 5 | 1 |
| backtrace:i_callback | 0 | 5 | 3 |
| backtrace:__d_free | 0 | 4 | 4 |
| Out_of_memory:Kill_process | 0 | 3 | |
| BUG:kernel_test_oops | 0 | 3 | |
| backtrace:proc_i_callback | 0 | 3 | 1 |
| backtrace:cache_reap | 0 | 1 | 2 |
+-------------------------------------------------------+------------+------------+------------+
[ 20.680449] mmap: trinity-c0 (1213) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.txt.
[ 20.712864] slab: double free detected in cache 'kmalloc-32', objp 404fa5e0
[ 20.713258] ------------[ cut here ]------------
[ 20.713258] kernel BUG at mm/slab.c:2571!
[ 20.713258] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC
[ 20.713258] Modules linked in:
[ 20.713258] CPU: 1 PID: 16 Comm: rcuos/1 Not tainted 4.1.0-rc7-00005-g22f13d0 #1
[ 20.713258] task: 401b7630 ti: 401c6000 task.ti: 401c6000
[ 20.713258] EIP: 0060:[<410dc9b4>] EFLAGS: 00010046 CPU: 1
[ 20.713258] EIP is at free_block+0x143/0x1b9
[ 20.713258] EAX: 0000003f EBX: 53505f40 ECX: 401b7630 EDX: 401b7630
[ 20.713258] ESI: 40098100 EDI: 4009a0c0 EBP: 401c7e18 ESP: 401c7de0
[ 20.713258] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[ 20.713258] CR0: 8005003b CR2: 0806d1b0 CR3: 001c4c00 CR4: 000006b0
[ 20.713258] Stack:
[ 20.713258] 416239f4 400990c0 404fa5e0 40098130 40098120 00000010 0000007c 538a52bc
[ 20.713258] 0000002b 0000000d 404fa5e0 00000010 00000000 4e3ab1a0 401c7e48 410dd79f
[ 20.713258] 00000000 401c7e34 4009a0c0 40098100 538a52ac 401c7e34 401c7e34 4009a0c0
[ 20.713258] Call Trace:
[ 20.713258] [<410dd79f>] cache_flusharray+0x8f/0xfb
[ 20.713258] [<410dd2aa>] kmem_cache_free+0x11c/0x16c
[ 20.713258] [<410dd436>] ? slab_destroy+0x13c/0x144
[ 20.713258] [<410dd436>] slab_destroy+0x13c/0x144
[ 20.713258] [<410dd47b>] slabs_destroy+0x3d/0x4c
[ 20.713258] [<410dd7de>] cache_flusharray+0xce/0xfb
[ 20.713258] [<410dd2aa>] kmem_cache_free+0x11c/0x16c
[ 20.713258] [<410e6c0a>] ? file_free_rcu+0x3a/0x47
[ 20.713258] [<410e6c0a>] file_free_rcu+0x3a/0x47
[ 20.713258] [<4107e4d8>] rcu_nocb_kthread+0x422/0x476
[ 20.713258] [<410e6bd0>] ? get_max_files+0xa/0xa
[ 20.713258] [<41069782>] ? wake_up_bit+0x1b/0x1b
[ 20.713258] [<4107e0b6>] ? force_qs_rnp+0x13b/0x13b
[ 20.713258] [<410533f4>] kthread+0xbd/0xc2
[ 20.713258] [<41435bc1>] ret_from_kernel_thread+0x21/0x30
[ 20.713258] [<41053337>] ? kthread_create_on_node+0x11d/0x11d
[ 20.713258] Code: 47 20 8b 53 0c 89 45 e0 89 d0 3b 45 e0 73 21 8b 4b 08 0f b6 0c 01 3b 4d e8 75 12 ff 75 f0 ff 77 40 68 f4 39 62 41 e8 5b 08 35 00 <0f> 0b 40 eb da 8d 42 ff 8a 4d e8 89 43 0c 8b 43 08 88 4c 10 ff
[ 20.713258] EIP: [<410dc9b4>] free_block+0x143/0x1b9 SS:ESP 0068:401c7de0
[ 20.713258] ---[ end trace 67ceaf648ae3c224 ]---
[ 20.713258] Kernel panic - not syncing: Fatal exception in interrupt
git bisect start d4ca9573ac617f8091d686c9484e69b727804add d4a4f75cd8f29cd9464a5a32e9224a91571d6649 --
git bisect good 88ad6cbf91cd848b8ebf8f945477da0c23f7171d # 10:11 21+ 0 Merge 'regulator/for-next' into devel-spot-201506140753
git bisect bad e1195330ef6f41104a59d76829db6970a2ea4e6e # 10:18 0- 3 Merge 'jolsa-perf/perf/per_task_2' into devel-spot-201506140753
git bisect good 66c6fe32b3b8a1a9ae92d94d39d5ef9c535e1e4f # 10:41 20+ 0 Merge 'gabbayo/amdkfd-fixes' into devel-spot-201506140753
git bisect good 6895cb46397b5e23b290358f09cc0d62dceae688 # 10:56 20+ 0 Merge 'ia64/next' into devel-spot-201506140753
git bisect bad e227d21f40e5d1ab47c447d671be72defba8172e # 11:04 0- 3 Merge 'balancenuma/mm-vmscan-lessipi-v7r7' into devel-spot-201506140753
git bisect good 1d17460363484f6dd2cf15fcaa8c97866d2441a8 # 11:20 20+ 0 Merge 'block/for-linus' into devel-spot-201506140753
git bisect good 05dd6fdc1d732f8a8496341412d1a7fb4211c80b # 11:29 20+ 0 Merge 'fujitsu-integration/mailbox-for-next' into devel-spot-201506140753
git bisect good 9c86f24c44b41f177ee04f20dca6916e9380fac0 # 11:40 20+ 0 mm: Defer flush of writable TLB entries
git bisect bad 22f13d0730d1f7bf083d8ad7dd946f0f81a7ff1e # 11:45 0- 2 mm: Dynamically allocate TLB batch unmap control structure
git bisect good 7b48a228e4c6ebae15d8effaad29e30538a9907a # 11:51 22+ 0 mm: Double SWAP_CLUSTER_MAX to batch TLB flushes
# first bad commit: [22f13d0730d1f7bf083d8ad7dd946f0f81a7ff1e] mm: Dynamically allocate TLB batch unmap control structure
git bisect good 7b48a228e4c6ebae15d8effaad29e30538a9907a # 11:54 62+ 0 mm: Double SWAP_CLUSTER_MAX to batch TLB flushes
# extra tests with DEBUG_INFO
git bisect bad 22f13d0730d1f7bf083d8ad7dd946f0f81a7ff1e # 11:57 0- 10 mm: Dynamically allocate TLB batch unmap control structure
# extra tests on HEAD of linux-devel/devel-spot-201506140753
git bisect bad d4ca9573ac617f8091d686c9484e69b727804add # 11:57 0- 16 0day head guard for 'devel-spot-201506140753'
# extra tests on tree/branch balancenuma/mm-vmscan-lessipi-v7r7
git bisect bad 22f13d0730d1f7bf083d8ad7dd946f0f81a7ff1e # 12:42 0- 25 mm: Dynamically allocate TLB batch unmap control structure
# extra tests with first bad commit reverted
git bisect good 3b0df5aceb78752c23a72204d361a28976290eb7 # 13:29 60+ 0 Revert "mm: Dynamically allocate TLB batch unmap control structure"
# extra tests on tree/branch linus/master
git bisect good c8d17b451aa18b07b60e771addf17a5fdd4138c7 # 13:43 66+ 0 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
# extra tests on tree/branch next/master
git bisect bad d9b5ec5b1b4d4055e256674de4a5337f6a66d284 # 13:54 0- 4 Add linux-next specific files for 20150612
Thanks,
Fengguang
View attachment "dmesg-vm-kbuild-yocto-i386-11:20150614114339:i386-randconfig-b0-06140911:4.1.0-rc7-00005-g22f13d0:1" of type "text/plain" (89214 bytes)
View attachment "config-4.1.0-rc7-00005-g22f13d0" of type "text/plain" (89635 bytes)
Powered by blists - more mailing lists