From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail137.messagelabs.com (mail137.messagelabs.com [216.82.249.19]) by kanga.kvack.org (Postfix) with ESMTP id B583A6B016A for ; Wed, 27 Jul 2011 20:30:52 -0400 (EDT) Received: from m4.gw.fujitsu.co.jp (unknown [10.0.50.74]) by fgwmail5.fujitsu.co.jp (Postfix) with ESMTP id 93CEB3EE0BD for ; Thu, 28 Jul 2011 09:30:49 +0900 (JST) Received: from smail (m4 [127.0.0.1]) by outgoing.m4.gw.fujitsu.co.jp (Postfix) with ESMTP id 79F6A45DE92 for ; Thu, 28 Jul 2011 09:30:49 +0900 (JST) Received: from s4.gw.fujitsu.co.jp (s4.gw.fujitsu.co.jp [10.0.50.94]) by m4.gw.fujitsu.co.jp (Postfix) with ESMTP id 62E4845DE8F for ; Thu, 28 Jul 2011 09:30:49 +0900 (JST) Received: from s4.gw.fujitsu.co.jp (localhost.localdomain [127.0.0.1]) by s4.gw.fujitsu.co.jp (Postfix) with ESMTP id 561A61DB8037 for ; Thu, 28 Jul 2011 09:30:49 +0900 (JST) Received: from m106.s.css.fujitsu.com (m106.s.css.fujitsu.com [10.240.81.146]) by s4.gw.fujitsu.co.jp (Postfix) with ESMTP id 231C71DB802F for ; Thu, 28 Jul 2011 09:30:49 +0900 (JST) Date: Thu, 28 Jul 2011 09:23:33 +0900 From: KAMEZAWA Hiroyuki Subject: Re: [Bugme-new] [Bug 39632] New: kernel BUG at arch/x86/mm/fault.c:395 Message-Id: <20110728092333.9ba574d6.kamezawa.hiroyu@jp.fujitsu.com> In-Reply-To: <20110727170148.0172a03c.akpm@linux-foundation.org> References: <20110727170148.0172a03c.akpm@linux-foundation.org> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-linux-mm@kvack.org List-ID: To: Andrew Morton Cc: linux-mm@kvack.org, bugme-daemon@bugzilla.kernel.org, greenhostnl@gmail.com, Tejun Heo On Wed, 27 Jul 2011 17:01:48 -0700 Andrew Morton wrote: > > (switched to email. Please respond via emailed reply-to-all, not via the > bugzilla web interface). > > On Wed, 20 Jul 2011 15:25:32 GMT > bugzilla-daemon@bugzilla.kernel.org wrote: > > > https://bugzilla.kernel.org/show_bug.cgi?id=39632 > > > > Summary: kernel BUG at arch/x86/mm/fault.c:395 > > Product: Memory Management > > Version: 2.5 > > Kernel Version: 3.0.0-RC7 > > Platform: All > > OS/Version: Linux > > Tree: Mainline > > Status: NEW > > Severity: normal > > Priority: P1 > > Component: Other > > AssignedTo: akpm@linux-foundation.org > > ReportedBy: greenhostnl@gmail.com > > Regression: No > > I think this is a plain old oops in mem_cgroup_charge_statistics(), but > for some reason it's treating the oopsing address as part of the > vmalloc arena. Perhaps this is what a use-after-free looks like on the > new percpu area implementation? > > [426900.218491] [] ? do_page_fault+0x339/0x4e0 > [426900.218501] [] ? __alloc_pages_nodemask+0x144/0x860 > [426900.218510] [] ? page_fault+0x25/0x30 > [426900.218519] [] ? mem_cgroup_charge_statistics+0x3a/0x60 Hmm, touches unmapped vmalloc area and caused OOps. And yes, mem_cgroup_charge_statistics() touches per-cpu area, which is allocated in vmalloc() area.... The percpu area is allocated at a cgroup creation and freed at destroy. I wonder why oom-kill is a trigger for the issue...if there is double-free or some other issue, other trouble can be seen... Thanks, -Kame -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/ Don't email: email@kvack.org