linux-kernel - [mm] aae2359b1a: BUG:Bad_rss-counter_state_mm:#type:MM_ANONPAGES

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220311022718.GC18612@xsang-OptiPlex-9020>
Date:   Fri, 11 Mar 2022 10:27:18 +0800
From:   kernel test robot <oliver.sang@...el.com>
To:     Yang Shi <shy828301@...il.com>
Cc:     Stephen Rothwell <sfr@...b.auug.org.au>,
        David Hildenbrand <david@...hat.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        Hugh Dickins <hughd@...gle.com>,
        "Kirill A . Shutemov" <kirill.shutemov@...ux.intel.com>,
        LKML <linux-kernel@...r.kernel.org>, lkp@...ts.01.org,
        lkp@...el.com
Subject: [mm]  aae2359b1a: BUG:Bad_rss-counter_state_mm:#type:MM_ANONPAGES_val



Greeting,

FYI, we noticed the following commit (built with gcc-9):

commit: aae2359b1a514180633c4a4e6666c91e44a928c8 ("mm: thp: don't have to lock page anymore when splitting PMD")
url: https://github.com/0day-ci/linux/commits/Qianggui-Song/arm64-dts-meson-s4-add-gpio_intc-node/20220310-172923

in testcase: trinity
version: trinity-static-i386-x86_64-f93256fb_2019-08-28
with following parameters:

	runtime: 300s
	group: group-01

test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/


on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):



If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>


[   20.947643][ T4079] mm/pgtable-generic.c:51: bad pmd e7d8e333(8000000433c000c5)
[   20.949757][  T427] BUG: Bad rss-counter state mm:84638533 type:MM_ANONPAGES val:512
[   20.951030][  T427] BUG: non-zero pgtables_bytes on freeing mm: 4096
[   20.960329][ T4080] mm/pgtable-generic.c:51: bad pmd 6dc594d8(8000000433c000c5)
[   20.961775][  T427] BUG: Bad rss-counter state mm:bf324b3f type:MM_ANONPAGES val:512
[   20.963109][  T427] BUG: non-zero pgtables_bytes on freeing mm: 4096
[   20.974600][ T4081] mm/pgtable-generic.c:51: bad pmd d1c9ec63(8000000433c000c5)
[   20.977758][  T427] BUG: Bad rss-counter state mm:e038d31c type:MM_ANONPAGES val:512
[   20.978918][  T427] BUG: non-zero pgtables_bytes on freeing mm: 4096
[   20.982960][ T4082] mm/pgtable-generic.c:51: bad pmd 8d2043e0(8000000433c000c5)
[   20.994138][ T4083] BUG: Bad rss-counter state mm:890a50d8 type:MM_ANONPAGES val:512
[   20.995441][ T4083] BUG: non-zero pgtables_bytes on freeing mm: 4096
[   20.997140][ T4083] mm/pgtable-generic.c:51: bad pmd 78b279e7(8000000433c000c5)
[   21.088268][ T3649] BUG: Bad rss-counter state mm:10e6eb4f type:MM_ANONPAGES val:512
[   21.089552][ T3649] BUG: non-zero pgtables_bytes on freeing mm: 4096



To reproduce:

        # build kernel
	cd linux
	cp config-5.17.0-rc7-11608-gaae2359b1a51 .config
	make HOSTCC=gcc-9 CC=gcc-9 ARCH=i386 olddefconfig prepare modules_prepare bzImage modules
	make HOSTCC=gcc-9 CC=gcc-9 ARCH=i386 INSTALL_MOD_PATH=<mod-install-dir> modules_install
	cd <mod-install-dir>
	find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz


        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email

        # if come across any failure that blocks the test,
        # please remove ~/.lkp and /lkp dir to run from a clean state.



---
0-DAY CI Kernel Test Service
https://lists.01.org/hyperkitty/list/lkp@lists.01.org

Thanks,
Oliver Sang


View attachment "config-5.17.0-rc7-11608-gaae2359b1a51" of type "text/plain" (141907 bytes)

View attachment "job-script" of type "text/plain" (4422 bytes)

Download attachment "dmesg.xz" of type "application/x-xz" (12428 bytes)