From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: linux-mm@kvack.org, bugme-daemon@bugzilla.kernel.org,
greenhostnl@gmail.com, Tejun Heo <tj@kernel.org>
Subject: Re: [Bugme-new] [Bug 39632] New: kernel BUG at arch/x86/mm/fault.c:395
Date: Thu, 28 Jul 2011 09:23:33 +0900 [thread overview]
Message-ID: <20110728092333.9ba574d6.kamezawa.hiroyu@jp.fujitsu.com> (raw)
In-Reply-To: <20110727170148.0172a03c.akpm@linux-foundation.org>
On Wed, 27 Jul 2011 17:01:48 -0700
Andrew Morton <akpm@linux-foundation.org> wrote:
>
> (switched to email. Please respond via emailed reply-to-all, not via the
> bugzilla web interface).
>
> On Wed, 20 Jul 2011 15:25:32 GMT
> bugzilla-daemon@bugzilla.kernel.org wrote:
>
> > https://bugzilla.kernel.org/show_bug.cgi?id=39632
> >
> > Summary: kernel BUG at arch/x86/mm/fault.c:395
> > Product: Memory Management
> > Version: 2.5
> > Kernel Version: 3.0.0-RC7
> > Platform: All
> > OS/Version: Linux
> > Tree: Mainline
> > Status: NEW
> > Severity: normal
> > Priority: P1
> > Component: Other
> > AssignedTo: akpm@linux-foundation.org
> > ReportedBy: greenhostnl@gmail.com
> > Regression: No
>
> I think this is a plain old oops in mem_cgroup_charge_statistics(), but
> for some reason it's treating the oopsing address as part of the
> vmalloc arena. Perhaps this is what a use-after-free looks like on the
> new percpu area implementation?
>
> [426900.218491] [<ffffffff81358bd9>] ? do_page_fault+0x339/0x4e0
> [426900.218501] [<ffffffff810b0d64>] ? __alloc_pages_nodemask+0x144/0x860
> [426900.218510] [<ffffffff81355915>] ? page_fault+0x25/0x30
> [426900.218519] [<ffffffff810df69a>] ? mem_cgroup_charge_statistics+0x3a/0x60
Hmm, touches unmapped vmalloc area and caused OOps.
And yes, mem_cgroup_charge_statistics() touches per-cpu area, which is allocated
in vmalloc() area....
The percpu area is allocated at a cgroup creation and freed at destroy.
I wonder why oom-kill is a trigger for the issue...if there is
double-free or some other issue, other trouble can be seen...
Thanks,
-Kame
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2011-07-28 0:30 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <bug-39632-10286@https.bugzilla.kernel.org/>
2011-07-28 0:01 ` Andrew Morton
2011-07-28 0:23 ` KAMEZAWA Hiroyuki [this message]
2011-07-28 3:03 ` KAMEZAWA Hiroyuki
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110728092333.9ba574d6.kamezawa.hiroyu@jp.fujitsu.com \
--to=kamezawa.hiroyu@jp.fujitsu.com \
--cc=akpm@linux-foundation.org \
--cc=bugme-daemon@bugzilla.kernel.org \
--cc=greenhostnl@gmail.com \
--cc=linux-mm@kvack.org \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox