From: Sasha Levin <sasha.levin@oracle.com>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: "linux-mm@kvack.org" <linux-mm@kvack.org>,
LKML <linux-kernel@vger.kernel.org>,
Dave Jones <davej@redhat.com>, Oleg Nesterov <oleg@redhat.com>,
"Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
Rik van Riel <riel@redhat.com>,
Michel Lespinasse <walken@google.com>,
Jerome Marchand <jmarchan@redhat.com>,
Davidlohr Bueso <davidlohr@hp.com>,
Andy Lutomirski <luto@amacapital.net>,
Hugh Dickins <hughd@google.com>
Subject: mm: kernel BUG at mm/mmap.c:446!
Date: Wed, 03 Sep 2014 13:24:09 -0400 [thread overview]
Message-ID: <54074EB9.4000301@oracle.com> (raw)
Hi all,
While fuzzing with trinity inside a KVM tools guest running the latest -next
kernel, I've stumbled on the following spew:
[ 8419.384997] kernel BUG at mm/mmap.c:446!
[ 8419.385478] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 8419.388478] Dumping ftrace buffer:
[ 8419.390338] (ftrace buffer empty)
[ 8419.393890] Modules linked in:
[ 8419.393890] CPU: 19 PID: 32634 Comm: trinity-c190 Not tainted 3.17.0-rc3-next-20140902-sasha-00031-g407ff1a #1099
[ 8419.393890] task: ffff880349293000 ti: ffff880458304000 task.ti: ffff880458304000
[ 8419.393890] RIP: validate_mm (mm/mmap.c:446 (discriminator 1))
[ 8419.393890] RSP: 0000:ffff880458307da8 EFLAGS: 00010296
[ 8419.393890] RAX: 000000000000001a RBX: 00000000000002c2 RCX: 0000000000000000
[ 8419.393890] RDX: 000000000000001a RSI: ffffffffb14e5e17 RDI: ffffffffae1e4007
[ 8419.393890] RBP: ffff880458307de8 R08: 0000000000000001 R09: 0000000000000001
[ 8419.393890] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001
[ 8419.393890] R13: 0000000000000000 R14: ffff8802aac8d000 R15: 0000000000000000
[ 8419.393890] FS: 00007fd40a4d0700(0000) GS:ffff880958400000(0000) knlGS:0000000000000000
[ 8419.393890] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 8419.393890] CR2: 000000000063c378 CR3: 00000002891ee000 CR4: 00000000000006a0
[ 8419.393890] DR0: 00000000006f0000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8419.393890] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
[ 8419.393890] Stack:
[ 8419.393890] ffff8802c4f87e00 000000000229be00 ffff880200000001 ffff880354275600
[ 8419.393890] ffff88030229be00 ffff88030229be78 ffff88035c215800 ffff88030229be68
[ 8419.393890] ffff880458307e78 ffffffffae2e42f8 fffffffffffff9fa 00000000000025d2
[ 8419.393890] Call Trace:
[ 8419.393890] vma_adjust (mm/mmap.c:895)
[ 8419.393890] vma_merge (mm/mmap.c:1056)
[ 8419.393890] do_brk (mm/mmap.c:2743)
[ 8419.393890] SyS_brk (mm/mmap.c:322 mm/mmap.c:269)
[ 8419.393890] tracesys (arch/x86/kernel/entry_64.S:542)
[ 8419.393890] Code: 8b 76 58 39 d6 75 16 8b 45 cc 85 c0 75 1d 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 c7 c7 88 c0 75 b2 31 c0 e8 06 2c 20 03 <0f> 0b 31 db 45 31 ff e9 f5 fe ff ff 48 89 c2 48 c7 c7 28 09 76
All code
========
0: 8b 76 58 mov 0x58(%rsi),%esi
3: 39 d6 cmp %edx,%esi
5: 75 16 jne 0x1d
7: 8b 45 cc mov -0x34(%rbp),%eax
a: 85 c0 test %eax,%eax
c: 75 1d jne 0x2b
e: 48 83 c4 18 add $0x18,%rsp
12: 5b pop %rbx
13: 41 5c pop %r12
15: 41 5d pop %r13
17: 41 5e pop %r14
19: 41 5f pop %r15
1b: 5d pop %rbp
1c: c3 retq
1d: 48 c7 c7 88 c0 75 b2 mov $0xffffffffb275c088,%rdi
24: 31 c0 xor %eax,%eax
26: e8 06 2c 20 03 callq 0x3202c31
2b:* 0f 0b ud2 <-- trapping instruction
2d: 31 db xor %ebx,%ebx
2f: 45 31 ff xor %r15d,%r15d
32: e9 f5 fe ff ff jmpq 0xffffffffffffff2c
37: 48 89 c2 mov %rax,%rdx
3a: 48 c7 c7 28 09 76 00 mov $0x760928,%rdi
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: 31 db xor %ebx,%ebx
4: 45 31 ff xor %r15d,%r15d
7: e9 f5 fe ff ff jmpq 0xffffffffffffff01
c: 48 89 c2 mov %rax,%rdx
f: 48 c7 c7 28 09 76 00 mov $0x760928,%rdi
[ 8419.393890] RIP validate_mm (mm/mmap.c:446 (discriminator 1))
[ 8419.393890] RSP <ffff880458307da8>
I'm not sure which one of the possible reasons for BUG() it was since the
pr_info didn't end up getting printed (I'm sending a patch to make that code
nicer).
Thanks,
Sasha
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next reply other threads:[~2014-09-03 17:24 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-09-03 17:24 Sasha Levin [this message]
2014-09-03 18:06 ` Andrew Morton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=54074EB9.4000301@oracle.com \
--to=sasha.levin@oracle.com \
--cc=akpm@linux-foundation.org \
--cc=davej@redhat.com \
--cc=davidlohr@hp.com \
--cc=hughd@google.com \
--cc=jmarchan@redhat.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=luto@amacapital.net \
--cc=oleg@redhat.com \
--cc=riel@redhat.com \
--cc=walken@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox