On Mon 20-04-20 12:15:33, Hillf Danton wrote: > > Sun, 19 Apr 2020 08:28:14 -0700 > > syzbot found the following crash on: > > > > HEAD commit: 8632e9b5 Merge tag 'hyperv-fixes-signed' of git://git.kern.. > > git tree: upstream > > console output: https://syzkaller.appspot.com/x/log.txt?x=11ac6be0100000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=5d351a1019ed81a2 > > dashboard link: https://syzkaller.appspot.com/bug?extid=a923008018a2d298247b > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > > Unfortunately, I don't have any reproducer for this crash yet. > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > Reported-by: syzbot+a923008018a2d298247b@xxxxxxxxxxxxxxxxxxxxxxxxx > > > > raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 > > page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) This looks like a page reference count underflow. If there is a reproducer then page_owner might help to tell who was the last owner. [...] > Flush TLB every chance before we get every thing done. > > --- a/mm/memory.c > +++ b/mm/memory.c > @@ -1080,8 +1080,8 @@ again: > page_remove_rmap(page, false); > if (unlikely(page_mapcount(page) < 0)) > print_bad_pte(vma, addr, ptent, page); > + force_flush = 1; > if (unlikely(__tlb_remove_page(tlb, page))) { > - force_flush = 1; > addr += PAGE_SIZE; > break; > } > @@ -1146,10 +1146,9 @@ again: > tlb_flush_mmu(tlb); > } > > - if (addr != end) { > - cond_resched(); > + cond_resched(); > + if (addr != end) > goto again; > - } > > return addr; > } This patch doesn't make any sense to me wrt to the above report. What are you trying to achieve? -- Michal Hocko SUSE Labs
