Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Andrew Morton]

On Sat, 28 Apr 2007 19:56:59 +0200 Tilman Schmidt <tilman@imap.cc> wrote:

> With kernel 2.6.21-rc7-mm2, my Dell Optiplex GX110 (P3/933) regularly
> crashes during the SuSE 10.1 startup sequence. When booting to RL5,
> it panicblinks shortly after the graphical login screen appears.
> Booting to RL3, it hangs after the startup message:
> 
> Starting Firewall Initialization (phase 2 of 2)
> 
> (the last message before "runlevel 3 has been reached") logging this:
> 
> [   57.138955] Eeek! page_mapcount(page) went negative! (-1)
> [   57.139040]   page pfn = 0
> [   57.139053]   page->flags = 400
> [   57.139066]   page->count = 1
> [   57.139079]   page->mapping = 00000000
> [   57.139111]   vma->vm_ops = generic_file_vm_ops+0x0/0x18
> [   57.139147]   vma->vm_ops->nopage = 0x0
> [   57.139181]   vma->vm_file->f_op->mmap = reiserfs_file_mmap+0x0/0x47
> [   57.139220] ------------[ cut here ]------------
> [   57.139236] kernel BUG at mm/rmap.c:648!
> [   57.139251] invalid opcode: 0000 [#1]
> [   57.139264] PREEMPT
> [   57.139278] Modules linked in: usbserial snd_rtctimer snd_seq_dummy snd_pcm_oss snd_mixer_oss snd_seq snd_seq_device thermal processor fan button battery ac af_packet usb_gigaset ser_gigaset bas_gigaset gigaset isdn slhc crc_ccitt ip6t_REJECT xt_tcpudp ipt_REJECT xt_state iptable_mangle iptable_nat nf_nat iptable_filter ip6table_mangle nf_conntrack_ipv4 nf_conntrack nfnetlink ip_tables ip6table_filter ip6_tables x_tables ehci_hcd snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm snd_timer snd soundcore snd_page_alloc i2c_i801 uhci_hcd parport_pc lp parport ipv6 nls_iso8859_1 nls_cp437 vfat fat nls_utf8 ntfs dm_mod
> [   57.139447] CPU:    0
> [   57.139450] EIP:    0060:[<c015dfc0>]    Not tainted VLI
> [   57.139453] EFLAGS: 00010282   (2.6.21-rc7-mm2-noinitrd #1)
> [   57.139506] EIP is at page_remove_rmap+0xd7/0x106
> [   57.139522] eax: 0000004b   ebx: c1000000   ecx: 00000001   edx: 00000002
> [   57.139541] esi: c309fde0   edi: b7f24000   ebp: c373ec90   esp: c373ec78
> [   57.139559] ds: 007b   es: 007b   fs: 0000  gs: 0000  ss: 0068
> [   57.139577] Process getcfg-interfac (pid: 4343, ti=c373e000 task=c18734d0 task.ti=c373e000)
> [   57.139586] Stack: c042abb5 00000000 c373ec90 c13f91c0 c1000000 c373dc90 c373ecf0 c0158df4
> [   57.139618]        c04f2ac4 00000001 00000000 c309fde0 c373ed10 00005ff1 00000000 00000001
> [   57.139647]        b7f62000 c374cb7c c374cb7c c374cb7c c373b344 fffffffe 00000000 c0569c2c
> [   57.139677] Call Trace:
> [   57.139721]  [<c0158df4>] unmap_vmas+0x2d7/0x4c9
> [   57.139748]  [<c015b7dd>] exit_mmap+0x68/0xeb
> [   57.139772]  [<c01191b0>] mmput+0x52/0xcb
> [   57.139805]  [<c011c368>] exit_mm+0xbb/0xc3
> [   57.139832]  [<c011d188>] do_exit+0x1ea/0x73e
> [   57.139857]  [<c011d74d>] sys_exit_group+0x0/0x13
> [   57.139880]  [<c012524e>] get_signal_to_deliver+0x6cd/0x6f8
> [   57.139917]  [<c01036cf>] do_notify_resume+0x91/0x692
> [   57.139944]  [<c0103f15>] work_notifysig+0x13/0x1a
> [   57.139970]  [<b7f6b7a8>] 0xb7f6b7a8
> [   57.139988]  =======================
> [   57.140002] INFO: lockdep is turned off.
> [   57.140015] Code: c0 74 0d 8b 50 0c b8 e5 ab 42 c0 e8 d7 fa fd ff 8b 46 48 85 c0 74 14 8b 40 10 85 c0 74 0d 8b 50 2c b8 04 ac 42 c0 e8 bc fa fd ff <0f> 0b eb fe 8b 53 10 8b 03 83 e2 01 f7 da c1 e8 1e 83 c2 04 69

I don't know which patch might have caused that.  Is it always
getcfg-interface which dies?  Seems to be a suse-only thing, and I
unfortunately don't have any test boxes which have it.

It seems wildly screwed up that we have a PageReserved() page with a pfn of
zero (!) which claims to be in a reiserfs mapping, only it isn't attached to a
reiserfs file.  How the heck did that happen?

Nick, I think that printk needs updating for changed vm_operations methods,
btw (->fault?)

This puts a dark cloud over about 200 patches at present.  It would be
great if you could perform a bisection search as per
http://www.zip.com.au/~akpm/linux/patches/stuff/bisecting-mm-trees.txt. 
I'd start out at fix-slab-corruption-running-ip6sic.patch then try
mm-fix-handling-of-panic_on_oom-when-cpusets-are-in-use.patch.  It should
take six or seven hops.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Hugh Dickins]

On Sat, 28 Apr 2007, Andrew Morton wrote:
> 
> It seems wildly screwed up that we have a PageReserved() page with a pfn of
> zero (!) which claims to be in a reiserfs mapping, only it isn't attached
> to a reiserfs file.  How the heck did that happen?

It's "simply" that it somehow got a spurious page table entry 00000001.
Great that it's so reproducible, I take that to mean this one is not
bad RAM.  Your request for a bisection is just what we want, thanks.

Hugh

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Tilman Schmidt]

[-- Attachment #1: Type: text/plain, Size: 1349 bytes --]

>> With kernel 2.6.21-rc7-mm2, my Dell Optiplex GX110 (P3/933) regularly
>> crashes during the SuSE 10.1 startup sequence. When booting to RL5,
>> it panicblinks shortly after the graphical login screen appears.
>> Booting to RL3, it hangs after the startup message:

I have now bisected this down to the section in the series file between
#GREGKH-DRIVER-START and #GREGKH-DRIVER-END, and therefore added GregKH
to the CC list. I'll try bisecting further inside that section (unless
you tell me not to), but it may take some time.

The exact point during the startup sequence when the crash occurred and
the amount of BUG messages produced varied somewhat during these tests.
The common denominator, and my criterion for the good/bad decisions
during the bisect, was the crash (panic blink) just before completion
of the system startup.
Sometimes there weren't any BUG messages in the log (or perhaps they
just didn't make it to the disk.) Sometimes I just had a couple of the
"sleeping function called from invalid context at mm/slab.c:3054"
ones but no "Eeek! page_mapcount(page) went negative!" one before them.
However, whenever the "Eeek!" did appear it announced "getcfg-interfac"
as the current process and was followed by a few of the "mm/slab.c:3054"
ones.

HTH
Tilman

-- 
In the long run, we'll all be dead.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 253 bytes --]

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Andrew Morton]

On Mon, 30 Apr 2007 19:17:02 +0200
Tilman Schmidt <tilman@imap.cc> wrote:

> >> With kernel 2.6.21-rc7-mm2, my Dell Optiplex GX110 (P3/933) regularly
> >> crashes during the SuSE 10.1 startup sequence. When booting to RL5,
> >> it panicblinks shortly after the graphical login screen appears.
> >> Booting to RL3, it hangs after the startup message:
> 
> I have now bisected this down to the section in the series file between
> #GREGKH-DRIVER-START and #GREGKH-DRIVER-END, and therefore added GregKH
> to the CC list.

This is rather good news.  I was staring at about 200-300 MM patches
wondering which one was buggy.  Thanks heaps for doing the bisect.  Now the
main worry is Randy's dead box.

A lot of Greg's driver tree has gone upstream, so please check current
mainline.  If that's OK then we need to pick through the difference between
2.6.21-rc7-mm2's driver tree and the patches which went into mainline.  And
that's a pretty small set.

> I'll try bisecting further inside that section (unless
> you tell me not to), but it may take some time.
> 
> The exact point during the startup sequence when the crash occurred and
> the amount of BUG messages produced varied somewhat during these tests.
> The common denominator, and my criterion for the good/bad decisions
> during the bisect, was the crash (panic blink) just before completion
> of the system startup.
> Sometimes there weren't any BUG messages in the log (or perhaps they
> just didn't make it to the disk.) Sometimes I just had a couple of the
> "sleeping function called from invalid context at mm/slab.c:3054"
> ones but no "Eeek! page_mapcount(page) went negative!" one before them.
> However, whenever the "Eeek!" did appear it announced "getcfg-interfac"
> as the current process and was followed by a few of the "mm/slab.c:3054"
> ones.

hm, big mess.  Could be it was some glitch from Tejun's sysfs changes which
are all being extensively redone, so perhaps we'll never hear from it
again.  Or perhaps we just merged it into mainline.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Tilman Schmidt]

[-- Attachment #1: Type: text/plain, Size: 654 bytes --]

Am 30.04.2007 20:21 schrieb Andrew Morton:
> A lot of Greg's driver tree has gone upstream, so please check current
> mainline.

2.6.21-final is fine.

>  If that's OK then we need to pick through the difference between
> 2.6.21-rc7-mm2's driver tree and the patches which went into mainline.  And
> that's a pretty small set.

I'm not quite sure how to determine that difference. Can you just provide
me with a list of patches you'd like me to test?

Thanks,
Tilman

-- 
Tilman Schmidt                                  E-Mail: tilman@imap.cc
Wehrhausweg 66                                  Fax: +49 228 4299019
53227 Bonn
Germany


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 253 bytes --]

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Andrew Morton]

On Mon, 30 Apr 2007 21:28:06 +0200
Tilman Schmidt <tilman@imap.cc> wrote:

> Am 30.04.2007 20:21 schrieb Andrew Morton:
> > A lot of Greg's driver tree has gone upstream, so please check current
> > mainline.
> 
> 2.6.21-final is fine.

Sure, but what about 2.6.21-git3 (or, better, current -git)?

> >  If that's OK then we need to pick through the difference between
> > 2.6.21-rc7-mm2's driver tree and the patches which went into mainline.  And
> > that's a pretty small set.
> 
> I'm not quite sure how to determine that difference. Can you just provide
> me with a list of patches you'd like me to test?

Not really - everything's tangled up.  A bisection search on the
2.6.21-rc7-mm2 driver tree would be the best bet.

See, 2.6.21-rc7-mm2 had:

gregkh-driver-driver-core-fix-device_add-error-path.patch
gregkh-driver-driver-core-fix-namespace-issue-with-devices-assigned-to-classes.patch
gregkh-driver-dev_printk-and-new-style-class-devices.patch
gregkh-driver-driver-core-udev-triggered-device-driver-binding.patch
gregkh-driver-driver-core-use-attribute-groups-in-struct-device_type.patch
gregkh-driver-named-device_type.patch
gregkh-driver-kobject-kobject_shadow_add-cleanup.patch
gregkh-driver-driver-core-per-subsystem-multithreaded-probing.patch
gregkh-driver-powerpc-make-it-compile-for-multithread-change.patch
gregkh-driver-driver-core-don-t-fail-attaching-the-device-if-it-cannot-be-bound.patch
gregkh-driver-driver-no-more-wait.patch
gregkh-driver-kref-fix-cpu-ordering-with-respect-to-krefs.patch
gregkh-driver-driver-core-notify-userspace-of-network-device-renames.patch
gregkh-driver-driver-core-suppress-uevents-via-filter.patch
gregkh-driver-driver-core-switch-firmware_class-to-uevent_suppress.patch
gregkh-driver-uevent-use-add_uevent_var-instead-of-open-coding-it.patch
gregkh-driver-driver-core-add-suspend-and-resume-to-struct-device_type.patch
gregkh-driver-kobject-kobject_ueventc-collapse-unnecessary-loop-nesting.patch
gregkh-driver-kobject-kobject_add-reference-leak.patch
gregkh-driver-devices_subsys-rwsem-removal.patch
gregkh-driver-scsi-hosts-rwsem-removal.patch
gregkh-driver-usb-bus-mutex.patch
gregkh-driver-pnp-remove-rwsem-usage.patch
gregkh-driver-input-serio-do-not-touch-bus-s-rwsem.patch
gregkh-driver-input-gameport-do-not-touch-bus-s-rwsem.patch
gregkh-driver-ide-proc-remove-rwsem.patch
gregkh-driver-ieee1394-rwsem-removal.patch
gregkh-driver-phy-rwsem-removal.patch
gregkh-driver-qeth-remove-usage-of-subsys_rwsem.patch
gregkh-driver-subsys-rwsem-removal.patch
gregkh-driver-sysfs-fix-i_ino-handling-in-sysfs.patch
gregkh-driver-sysfs-fix-error-handling-in-binattr-write.patch
gregkh-driver-sysfs-move-release_sysfs_dirent-to-dirc.patch
gregkh-driver-sysfs-flatten-cleanup-paths-in-sysfs_add_link-and-create_dir.patch
gregkh-driver-sysfs-consolidate-sysfs_dirent-creation-functions.patch
gregkh-driver-sysfs-add-sysfs_dirent-s_parent.patch
gregkh-driver-sysfs-add-sysfs_dirent-s_name.patch
gregkh-driver-sysfs-make-sysfs_dirent-s_element-a-union.patch
gregkh-driver-sysfs-implement-kobj_sysfs_assoc_lock.patch
gregkh-driver-sysfs-reimplement-symlink-using-sysfs_dirent-tree.patch
gregkh-driver-sysfs-implement-bin_buffer.patch
gregkh-driver-sysfs-implement-sysfs_dirent-active-reference-and-immediate-disconnect.patch
gregkh-driver-sysfs-kill-attribute-file-orphaning.patch
gregkh-driver-sysfs-kill-unnecessary-attribute-owner.patch
gregkh-driver-sysfs-make-lockdep-ignore-s_active.patch
gregkh-driver-sysfs-make-sysfs_put-ignore-null-sd.patch
gregkh-driver-sysfs-rename-object_depth-to-sysfs_path_depth-and-make-it-global.patch
gregkh-driver-sysfs-reimplement-sysfs_drop_dentry.patch
gregkh-driver-sysfs-kill-sysfs_dirent-s_dentry.patch
gregkh-driver-driver-core-make-uevent-environment-available-in-uevent-file.patch
gregkh-driver-driver-core-warn-for-odd-store-uevent-usage.patch
gregkh-driver-kobject-comment-and-warning-fixes-to-kobjectc.patch
gregkh-driver-the-overdue-removal-of-the-mount-umount-uevents.patch
gregkh-driver-debugfs-add-debugfs_create_u64.patch
gregkh-driver-bus_add_driver-return-error-for-no-bus.patch
gregkh-driver-uio.patch
gregkh-driver-uio-documentation.patch
gregkh-driver-uio-dummy.patch
gregkh-driver-uio-hilscher-cif-card-driver.patch
gregkh-driver-remove-struct-subsystem-as-it-is-no-longer-needed.patch
gregkh-driver-put_device-might_sleep.patch
gregkh-driver-kobject-warn.patch
gregkh-driver-warn-when-statically-allocated-kobjects-are-used.patch
gregkh-driver-nozomi.patch


and Greg's driver tree (as of yesterday, I think) had

gregkh-driver-uio.patch
gregkh-driver-uio-documentation.patch
gregkh-driver-uio-dummy.patch
gregkh-driver-uio-hilscher-cif-card-driver.patch
gregkh-driver-remove-struct-subsystem-as-it-is-no-longer-needed.patch
gregkh-driver-put_device-might_sleep.patch
gregkh-driver-kobject-warn.patch
gregkh-driver-warn-when-statically-allocated-kobjects-are-used.patch
gregkh-driver-nozomi.patch

So what has happened (approximately) is that

- the above nine patches have been held back, or are new

- Tejun's sysfs changes have been dropped

- Everything else from 2.6.21-rc7-mm2 has gone into mainline


--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Tilman Schmidt]

[-- Attachment #1: Type: text/plain, Size: 906 bytes --]

Am 30.04.2007 21:46 schrieb Andrew Morton:

>> 2.6.21-final is fine.
> 
> Sure, but what about 2.6.21-git3 (or, better, current -git)?

OIC. Sorry for being dense. Will check.

>>>  If that's OK then we need to pick through the difference between
>>> 2.6.21-rc7-mm2's driver tree and the patches which went into mainline.  And
>>> that's a pretty small set.
>> I'm not quite sure how to determine that difference. Can you just provide
>> me with a list of patches you'd like me to test?
> 
> Not really - everything's tangled up.  A bisection search on the
> 2.6.21-rc7-mm2 driver tree would be the best bet.

Ok. No prob. It'll just take a bit of time. (Compiling a kernel on
that machine takes about 4 hours.)

I'll be back. :-)

-- 
Tilman Schmidt                          E-Mail: tilman@imap.cc
Bonn, Germany
- Undetected errors are handled as if no error occurred. (IBM) -


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 253 bytes --]

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Tilman Schmidt]

[-- Attachment #1: Type: text/plain, Size: 405 bytes --]

Am 30.04.2007 21:46 schrieb Andrew Morton:
> Sure, but what about 2.6.21-git3 (or, better, current -git)?

2.6.21-git3 crashed with panic blink at "scanning usb: .."
(Nothing in the log this time.)

Will continue bisecting -rc7-mm2.

HTH
T.

-- 
Tilman Schmidt                          E-Mail: tilman@imap.cc
Bonn, Germany
- Undetected errors are handled as if no error occurred. (IBM) -


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 253 bytes --]

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Greg KH]

On Tue, May 01, 2007 at 01:26:44PM +0200, Tilman Schmidt wrote:
> Am 30.04.2007 21:46 schrieb Andrew Morton:
> > Sure, but what about 2.6.21-git3 (or, better, current -git)?
> 
> 2.6.21-git3 crashed with panic blink at "scanning usb: .."
> (Nothing in the log this time.)

Eeek, that's not good.

Can you keep bisecting Linus's tree?  'git bisect' makes this very easy
to do.  We need to track this down as soon as possible if we can.

> Will continue bisecting -rc7-mm2.

Can you focus on Linus's tree now, as we know that it is the part
causing problems?

thanks,

greg k-h

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Tilman Schmidt]

[-- Attachment #1: Type: text/plain, Size: 673 bytes --]

Am 30.04.2007 21:46 schrieb Andrew Morton:
> Not really - everything's tangled up.  A bisection search on the
> 2.6.21-rc7-mm2 driver tree would be the best bet.

And the winner is:

gregkh-driver-driver-core-make-uevent-environment-available-in-uevent-file.patch

Reverting only that from 2.6.21-rc7-mm2 gives me a working kernel
again.

I'll try building 2.6.21-git3 minus that one next, but I'll have
to revert it manually, because my naive attempt to "patch -R" it
failed 1 out of 2 hunks.

HTH
T.

-- 
Tilman Schmidt                          E-Mail: tilman@imap.cc
Bonn, Germany
- Undetected errors are handled as if no error occurred. (IBM) -


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 253 bytes --]

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Greg KH]

On Wed, May 02, 2007 at 09:01:22AM +0200, Tilman Schmidt wrote:
> Am 30.04.2007 21:46 schrieb Andrew Morton:
> > Not really - everything's tangled up.  A bisection search on the
> > 2.6.21-rc7-mm2 driver tree would be the best bet.
> 
> And the winner is:
> 
> gregkh-driver-driver-core-make-uevent-environment-available-in-uevent-file.patch
> 
> Reverting only that from 2.6.21-rc7-mm2 gives me a working kernel
> again.
> 
> I'll try building 2.6.21-git3 minus that one next, but I'll have
> to revert it manually, because my naive attempt to "patch -R" it
> failed 1 out of 2 hunks.

Ok, that's just wierd, it only adds a new feature, it doesn't touch any
existing code to cause things to go wrong.

Can you try using 'git bisect' on Linus's tree instead?  That should
show the real problem much easier.

thanks,

greg k-h

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Andrew Morton]

On Wed, 02 May 2007 09:01:22 +0200 Tilman Schmidt <tilman@imap.cc> wrote:

> Am 30.04.2007 21:46 schrieb Andrew Morton:
> > Not really - everything's tangled up.  A bisection search on the
> > 2.6.21-rc7-mm2 driver tree would be the best bet.
> 
> And the winner is:
> 
> gregkh-driver-driver-core-make-uevent-environment-available-in-uevent-file.patch
> 
> Reverting only that from 2.6.21-rc7-mm2 gives me a working kernel
> again.

cripes.

+static ssize_t show_uevent(struct device *dev, struct device_attribute *attr,
+                          char *buf)
+{
+       struct kobject *top_kobj;
+       struct kset *kset;
+       char *envp[32];
+       char data[PAGE_SIZE];

That won't work too well with 4k stacks.

Who's reviewing this stuff?  The patch headers indicate that no mailing list was
cc'ed?

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Nick Piggin]

Tilman Schmidt wrote:
> Am 30.04.2007 21:46 schrieb Andrew Morton:
> 
>>Not really - everything's tangled up.  A bisection search on the
>>2.6.21-rc7-mm2 driver tree would be the best bet.
> 
> 
> And the winner is:
> 
> gregkh-driver-driver-core-make-uevent-environment-available-in-uevent-file.patch

+	struct kobject *top_kobj;
+	struct kset *kset;
+	char *envp[32];
+	char data[PAGE_SIZE];
+	char *pos;
+	int i;
+	size_t count = 0;
+	int retval;

... that seems like a lot of stack to be using.

-- 
SUSE Labs, Novell Inc.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Greg KH]

On Wed, May 02, 2007 at 12:10:00AM -0700, Andrew Morton wrote:
> On Wed, 02 May 2007 09:01:22 +0200 Tilman Schmidt <tilman@imap.cc> wrote:
> 
> > Am 30.04.2007 21:46 schrieb Andrew Morton:
> > > Not really - everything's tangled up.  A bisection search on the
> > > 2.6.21-rc7-mm2 driver tree would be the best bet.
> > 
> > And the winner is:
> > 
> > gregkh-driver-driver-core-make-uevent-environment-available-in-uevent-file.patch
> > 
> > Reverting only that from 2.6.21-rc7-mm2 gives me a working kernel
> > again.
> 
> cripes.
> 
> +static ssize_t show_uevent(struct device *dev, struct device_attribute *attr,
> +                          char *buf)
> +{
> +       struct kobject *top_kobj;
> +       struct kset *kset;
> +       char *envp[32];
> +       char data[PAGE_SIZE];
> 
> That won't work too well with 4k stacks.

Oh crap.  Yeah, that's not nice.

> Who's reviewing this stuff?  The patch headers indicate that no mailing list was
> cc'ed?

Kay and I did this, sorry, it should have been cc:ed to lkml.

I'll go fix it up now...

thanks,

greg k-h

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Greg KH]

On Wed, May 02, 2007 at 12:10:00AM -0700, Andrew Morton wrote:
> On Wed, 02 May 2007 09:01:22 +0200 Tilman Schmidt <tilman@imap.cc> wrote:
> 
> > Am 30.04.2007 21:46 schrieb Andrew Morton:
> > > Not really - everything's tangled up.  A bisection search on the
> > > 2.6.21-rc7-mm2 driver tree would be the best bet.
> > 
> > And the winner is:
> > 
> > gregkh-driver-driver-core-make-uevent-environment-available-in-uevent-file.patch
> > 
> > Reverting only that from 2.6.21-rc7-mm2 gives me a working kernel
> > again.
> 
> cripes.
> 
> +static ssize_t show_uevent(struct device *dev, struct device_attribute *attr,
> +                          char *buf)
> +{
> +       struct kobject *top_kobj;
> +       struct kset *kset;
> +       char *envp[32];
> +       char data[PAGE_SIZE];
> 
> That won't work too well with 4k stacks.

Wait, even though this isn't good, it shouldn't have been hit by anyone,
that file used to not be readable, so I doubt userspace would have been
trying to read it...

Tilman, what version of HAL and udev do you have on your machine?

Kay, did you get the 'read the uevent file' code already into udev
and/or HAL?

thanks,

greg k-h

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Greg KH]

On Wed, May 02, 2007 at 12:10:00AM -0700, Andrew Morton wrote:
> On Wed, 02 May 2007 09:01:22 +0200 Tilman Schmidt <tilman@imap.cc> wrote:
> 
> > Am 30.04.2007 21:46 schrieb Andrew Morton:
> > > Not really - everything's tangled up.  A bisection search on the
> > > 2.6.21-rc7-mm2 driver tree would be the best bet.
> > 
> > And the winner is:
> > 
> > gregkh-driver-driver-core-make-uevent-environment-available-in-uevent-file.patch
> > 
> > Reverting only that from 2.6.21-rc7-mm2 gives me a working kernel
> > again.
> 
> cripes.
> 
> +static ssize_t show_uevent(struct device *dev, struct device_attribute *attr,
> +                          char *buf)
> +{
> +       struct kobject *top_kobj;
> +       struct kset *kset;
> +       char *envp[32];
> +       char data[PAGE_SIZE];
> 
> That won't work too well with 4k stacks.

Tilman, here's a patch, can you try this on top of your tree that dies?

thanks,

greg k-h

---
 drivers/base/core.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -252,7 +252,7 @@ static ssize_t show_uevent(struct device
 	struct kobject *top_kobj;
 	struct kset *kset;
 	char *envp[32];
-	char data[PAGE_SIZE];
+	char *data = NULL;
 	char *pos;
 	int i;
 	size_t count = 0;
@@ -276,6 +276,10 @@ static ssize_t show_uevent(struct device
 		if (!kset->uevent_ops->filter(kset, &dev->kobj))
 			goto out;
 
+	data = (char *)get_zeroed_page(GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
 	/* let the kset specific function add its keys */
 	pos = data;
 	retval = kset->uevent_ops->uevent(kset, &dev->kobj,
@@ -290,6 +294,7 @@ static ssize_t show_uevent(struct device
 		count += sprintf(pos, "%s\n", envp[i]);
 	}
 out:
+	free_page((unsigned long)data);
 	return count;
 }
 

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Tilman Schmidt]

On Wed, 2 May 2007 00:43:05 -0700, "Greg KH" <gregkh@suse.de> said:

> > > And the winner is:
> > > 
> > > gregkh-driver-driver-core-make-uevent-environment-available-in-uevent-file.patch
> > > 
> > > Reverting only that from 2.6.21-rc7-mm2 gives me a working kernel
> > > again.
> 
> Wait, even though this isn't good, it shouldn't have been hit by anyone,
> that file used to not be readable, so I doubt userspace would have been
> trying to read it...
> 
> Tilman, what version of HAL and udev do you have on your machine?

The ones that came with SuSE 10.0:

hal-0.5.4-6.4
udev-068git20050831-9

HTH
Tilman

PS: I'll test your patch and git-bisect when I'm back at the machine.
-- 
  Tilman Schmidt
  tilman@imap.cc

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Kay Sievers]

On 5/2/07, Greg KH <gregkh@suse.de> wrote:
> On Wed, May 02, 2007 at 12:10:00AM -0700, Andrew Morton wrote:
> > On Wed, 02 May 2007 09:01:22 +0200 Tilman Schmidt <tilman@imap.cc> wrote:
> >
> > > Am 30.04.2007 21:46 schrieb Andrew Morton:
> > > > Not really - everything's tangled up.  A bisection search on the
> > > > 2.6.21-rc7-mm2 driver tree would be the best bet.
> > >
> > > And the winner is:
> > >
> > > gregkh-driver-driver-core-make-uevent-environment-available-in-uevent-file.patch
> > >
> > > Reverting only that from 2.6.21-rc7-mm2 gives me a working kernel
> > > again.
> >
> > cripes.
> >
> > +static ssize_t show_uevent(struct device *dev, struct device_attribute *attr,
> > +                          char *buf)
> > +{
> > +       struct kobject *top_kobj;
> > +       struct kset *kset;
> > +       char *envp[32];
> > +       char data[PAGE_SIZE];
> >
> > That won't work too well with 4k stacks.

Yeah, sorry.

> Wait, even though this isn't good, it shouldn't have been hit by anyone,
> that file used to not be readable, so I doubt userspace would have been
> trying to read it...
>
> Tilman, what version of HAL and udev do you have on your machine?
>
> Kay, did you get the 'read the uevent file' code already into udev
> and/or HAL?

Only udevtest uses this at the moment, but that is only used for debugging.
It's probably the brain-dead libsysfs, which opens and reads every
file in /sys, even when nobody is interested in the data.

Thanks,
Kay

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Tilman Schmidt]

[-- Attachment #1: Type: text/plain, Size: 1606 bytes --]

Am 02.05.2007 09:52 schrieb Greg KH:
> Tilman, here's a patch, can you try this on top of your tree that dies?

2.6.21-git3 plus that patch comes up fine.

(Except for a UDP problem I seem to remember I already saw reported
on lkml and which I'll ignore for now in order not to blur the
picture.)

Started to git-bisect mainline now, but that will take some time.
It's more than 800 patches to check and I don't get more than 2-3
iterations per day out of that machine.

HTH
T.

> ---
>  drivers/base/core.c |    7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> --- a/drivers/base/core.c
> +++ b/drivers/base/core.c
> @@ -252,7 +252,7 @@ static ssize_t show_uevent(struct device
>  	struct kobject *top_kobj;
>  	struct kset *kset;
>  	char *envp[32];
> -	char data[PAGE_SIZE];
> +	char *data = NULL;
>  	char *pos;
>  	int i;
>  	size_t count = 0;
> @@ -276,6 +276,10 @@ static ssize_t show_uevent(struct device
>  		if (!kset->uevent_ops->filter(kset, &dev->kobj))
>  			goto out;
>  
> +	data = (char *)get_zeroed_page(GFP_KERNEL);
> +	if (!data)
> +		return -ENOMEM;
> +
>  	/* let the kset specific function add its keys */
>  	pos = data;
>  	retval = kset->uevent_ops->uevent(kset, &dev->kobj,
> @@ -290,6 +294,7 @@ static ssize_t show_uevent(struct device
>  		count += sprintf(pos, "%s\n", envp[i]);
>  	}
>  out:
> +	free_page((unsigned long)data);
>  	return count;
>  }
>  

-- 
Tilman Schmidt                          E-Mail: tilman@imap.cc
Bonn, Germany
- Undetected errors are handled as if no error occurred. (IBM) -


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 253 bytes --]

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Andrew Morton]

On Wed, 02 May 2007 19:36:03 +0200
Tilman Schmidt <tilman@imap.cc> wrote:

> Am 02.05.2007 09:52 schrieb Greg KH:
> > Tilman, here's a patch, can you try this on top of your tree that dies?
> 
> 2.6.21-git3 plus that patch comes up fine.
> 
> (Except for a UDP problem I seem to remember I already saw reported
> on lkml and which I'll ignore for now in order not to blur the
> picture.)

Thanks.

> Started to git-bisect mainline now, but that will take some time.
> It's more than 800 patches to check and I don't get more than 2-3
> iterations per day out of that machine.

I don't think there's much point in you doing that.  We know what the bug is.

Switching to 8k stacks will probably fix things up too.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Tilman Schmidt]

[-- Attachment #1: Type: text/plain, Size: 464 bytes --]

Am 02.05.2007 22:07 schrieb Andrew Morton:
>> Started to git-bisect mainline now, but that will take some time.
[...]
> I don't think there's much point in you doing that.  We know what the bug is.

Good. Saves me some work. :-)

If you'd like me to test anything, just let me know.

Thanks,
Tilman

-- 
Tilman Schmidt                          E-Mail: tilman@imap.cc
Bonn, Germany
- Undetected errors are handled as if no error occurred. (IBM) -


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 253 bytes --]

Re: 2.6.21-rc7-mm2 crash: Eeek! page_mapcount(page) went negative! (-1)

[Greg KH]

On Wed, May 02, 2007 at 11:41:22AM +0200, Tilman Schmidt wrote:
> On Wed, 2 May 2007 00:43:05 -0700, "Greg KH" <gregkh@suse.de> said:
> 
> > > > And the winner is:
> > > > 
> > > > gregkh-driver-driver-core-make-uevent-environment-available-in-uevent-file.patch
> > > > 
> > > > Reverting only that from 2.6.21-rc7-mm2 gives me a working kernel
> > > > again.
> > 
> > Wait, even though this isn't good, it shouldn't have been hit by anyone,
> > that file used to not be readable, so I doubt userspace would have been
> > trying to read it...
> > 
> > Tilman, what version of HAL and udev do you have on your machine?
> 
> The ones that came with SuSE 10.0:
> 
> hal-0.5.4-6.4
> udev-068git20050831-9

Ah, ok, that explains it, the really old libsysfs walks and opens all
files in sysfs for some odd, strange, and broken reason.  This has been
fixed in newer versions, and explains why you are seeing this happen.

I'll send my fix for this to Linus in a few hours.

thanks for testing and tracking this down, I really appreciate it.

greg k-h

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>