On Tue, Sep 22, 2015 at 8:54 PM, Hugh Dickins <hughd@xxxxxxxxxx> wrote: > On Tue, 22 Sep 2015, Andrey Konovalov wrote: >> If anybody comes up with a patch to fix the original issue I easily >> can test it, since I'm hitting "BUG: Bad page state" in a second when >> fuzzing with KTSAN and Trinity. > > This "BUG: Bad page state" sounds more serious, but I cannot track down > your report of it: please repost - thanks - though on seeing it, I may > well end up with no ideas. The report is below. I get it after a few seconds of running Trinity on a kernel with KTSAN and targeting mlock, munlock and madvise syscalls. Sasha also observed a very similar crash a while ago (https://lkml.org/lkml/2014/11/6/1055). I didn't manage to reproduce this in a kernel build without KTSAN though. The idea was that data races KTSAN reports might be the explanation of these crashes. BUG: Bad page state in process trinity-c15 pfn:281999 page:ffffea000a066640 count:0 mapcount:0 mapping: (null) index:0xd flags: 0x20000000028000c(referenced|uptodate|swapbacked|mlocked) page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set bad because of flags: flags: 0x200000(mlocked) Modules linked in: CPU: 3 PID: 11190 Comm: trinity-c15 Not tainted 4.2.0-tsan #1295 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 ffffffff821c3b70 0000000000000000 0000000100004741 ffff8800b857f948 ffffffff81e9926c 0000000000000003 ffffea000a066640 ffff8800b857f978 ffffffff811ce045 ffffffff821c3b70 ffffea000a066640 0000000000000001 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff81e9926c>] dump_stack+0x63/0x81 lib/dump_stack.c:50 [<ffffffff811ce045>] bad_page+0x115/0x1a0 mm/page_alloc.c:409 [< inline >] free_pages_check mm/page_alloc.c:731 [<ffffffff811cf3b8>] free_pages_prepare+0x2f8/0x330 mm/page_alloc.c:922 [<ffffffff811d2911>] free_hot_cold_page+0x51/0x2b0 mm/page_alloc.c:1908 [<ffffffff811d2bcf>] free_hot_cold_page_list+0x5f/0x100 mm/page_alloc.c:1956 (discriminator 3) [<ffffffff811dd9c1>] release_pages+0x151/0x300 mm/swap.c:967 [<ffffffff811de723>] __pagevec_release+0x43/0x60 mm/swap.c:984 [< inline >] pagevec_release include/linux/pagevec.h:69 [<ffffffff811ef36a>] shmem_undo_range+0x4fa/0x9d0 mm/shmem.c:446 [<ffffffff811ef86f>] shmem_truncate_range+0x2f/0x60 mm/shmem.c:540 [<ffffffff811f15d5>] shmem_fallocate+0x555/0x6e0 mm/shmem.c:2086 [<ffffffff812568d0>] vfs_fallocate+0x1e0/0x310 fs/open.c:303 [< inline >] madvise_remove mm/madvise.c:326 [< inline >] madvise_vma mm/madvise.c:378 [< inline >] SYSC_madvise mm/madvise.c:528 [<ffffffff81225548>] SyS_madvise+0x378/0x760 mm/madvise.c:459 [<ffffffff8124ef36>] ? kt_atomic64_store+0x76/0x130 mm/ktsan/sync_atomic.c:161 [<ffffffff81ea8691>] entry_SYSCALL_64_fastpath+0x31/0x95 arch/x86/entry/entry_64.S:188 Disabling lock debugging due to kernel taint > > Hugh -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>