On Wed, 27 Jul 2011 17:01:48 -0700 Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote: > > (switched to email. Please respond via emailed reply-to-all, not via the > bugzilla web interface). > > On Wed, 20 Jul 2011 15:25:32 GMT > bugzilla-daemon@xxxxxxxxxxxxxxxxxxx wrote: > > > https://bugzilla.kernel.org/show_bug.cgi?id=39632 > > > > Summary: kernel BUG at arch/x86/mm/fault.c:395 > > Product: Memory Management > > Version: 2.5 > > Kernel Version: 3.0.0-RC7 > > Platform: All > > OS/Version: Linux > > Tree: Mainline > > Status: NEW > > Severity: normal > > Priority: P1 > > Component: Other > > AssignedTo: akpm@xxxxxxxxxxxxxxxxxxxx > > ReportedBy: greenhostnl@xxxxxxxxx > > Regression: No > > I think this is a plain old oops in mem_cgroup_charge_statistics(), but > for some reason it's treating the oopsing address as part of the > vmalloc arena. Perhaps this is what a use-after-free looks like on the > new percpu area implementation? > > [426900.218491] [<ffffffff81358bd9>] ? do_page_fault+0x339/0x4e0 > [426900.218501] [<ffffffff810b0d64>] ? __alloc_pages_nodemask+0x144/0x860 > [426900.218510] [<ffffffff81355915>] ? page_fault+0x25/0x30 > [426900.218519] [<ffffffff810df69a>] ? mem_cgroup_charge_statistics+0x3a/0x60 Hmm, touches unmapped vmalloc area and caused OOps. And yes, mem_cgroup_charge_statistics() touches per-cpu area, which is allocated in vmalloc() area.... The percpu area is allocated at a cgroup creation and freed at destroy. I wonder why oom-kill is a trigger for the issue...if there is double-free or some other issue, other trouble can be seen... Thanks, -Kame -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/ Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>