From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f52.google.com (mail-wm0-f52.google.com [74.125.82.52]) by kanga.kvack.org (Postfix) with ESMTP id 8788E6B0253 for ; Thu, 28 Jan 2016 05:27:32 -0500 (EST) Received: by mail-wm0-f52.google.com with SMTP id r129so17906648wmr.0 for ; Thu, 28 Jan 2016 02:27:32 -0800 (PST) Received: from mail-wm0-x233.google.com (mail-wm0-x233.google.com. [2a00:1450:400c:c09::233]) by mx.google.com with ESMTPS id q10si14455541wjo.159.2016.01.28.02.27.31 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 28 Jan 2016 02:27:31 -0800 (PST) Received: by mail-wm0-x233.google.com with SMTP id l66so18821865wml.0 for ; Thu, 28 Jan 2016 02:27:31 -0800 (PST) MIME-Version: 1.0 From: Dmitry Vyukov Date: Thu, 28 Jan 2016 11:27:11 +0100 Message-ID: Subject: mm: another VM_BUG_ON_PAGE(PageTail(page)) Content-Type: text/plain; charset=UTF-8 Sender: owner-linux-mm@kvack.org List-ID: To: Vlastimil Babka , "Kirill A. Shutemov" , Doug Gilbert , Andrew Morton , David Rientjes , Naoya Horiguchi , "Kirill A. Shutemov" , Shiraz Hashim , "linux-mm@kvack.org" , LKML , Hugh Dickins , Sasha Levin , syzkaller , Kostya Serebryany , Alexander Potapenko , linux-scsi Hello, The following program triggers VM_BUG_ON_PAGE(PageTail(page)): // autogenerated by syzkaller (http://github.com/google/syzkaller) #include #include #include #include int main() { int fd; mmap((void*)0x20000000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0); fd = open("/dev/sg1", O_RDONLY|O_SYNC|0x100000); mmap((void*)0x20001000, 0x4000, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, fd, 0); mbind((void*)0x20000000, 0x4000, 0x8002, (void*)0x20002ff8, 3660, MPOL_MF_STRICT|MPOL_MF_MOVE); return 0; } page:ffffea0000f5da80 count:0 mapcount:1 mapping:dead000000000400 index:0x0 compound_mapcount: 0 flags: 0x1fffc0000000000() page dumped because: VM_BUG_ON_PAGE(PageTail(page)) ------------[ cut here ]------------ kernel BUG at mm/vmscan.c:1446! invalid opcode: 0000 [#27] SMP DEBUG_PAGEALLOC KASAN Modules linked in: CPU: 1 PID: 8185 Comm: a.out Tainted: G D 4.5.0-rc1+ #300 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff88006146c740 ti: ffff88006c8f0000 task.ti: ffff88006c8f0000 RIP: 0010:[] [] isolate_lru_page+0x4ea/0x6d0 RSP: 0018:ffff88006c8f7a50 EFLAGS: 00010282 RAX: ffff88006146c740 RBX: ffffea0000f5da80 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffea0000f5dab8 RBP: ffff88006c8f7a88 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000002 R11: 1ffffffff134edc5 R12: ffffea0000f5daa0 R13: ffffea0000f5da00 R14: ffffea0000f5da01 R15: 0000000020004000 FS: 00000000022ec880(0063) GS:ffff88003ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000020003000 CR3: 0000000031d0b000 CR4: 00000000000006e0 Stack: 00000001ffffffff ffffffff816e4159 ffff8800310f6018 0000000020003000 dffffc0000000000 ffffea0000f5da80 0000000020004000 ffff88006c8f7b10 ffffffff8174efdd ffffea0000000001 ffff88006c8f7c70 ffff88006c8f7de8 Call Trace: [< inline >] migrate_page_add mm/mempolicy.c:966 [] queue_pages_pte_range+0x4ad/0x10b0 mm/mempolicy.c:552 [< inline >] walk_pmd_range mm/pagewalk.c:50 [< inline >] walk_pud_range mm/pagewalk.c:90 [< inline >] walk_pgd_range mm/pagewalk.c:116 [] __walk_page_range+0x653/0xcd0 mm/pagewalk.c:204 [] walk_page_range+0x134/0x300 mm/pagewalk.c:281 [] queue_pages_range+0xfb/0x130 mm/mempolicy.c:687 [] do_mbind+0x2c1/0xdc0 mm/mempolicy.c:1239 [< inline >] SYSC_mbind mm/mempolicy.c:1351 [] SyS_mbind+0x13d/0x150 mm/mempolicy.c:1333 [] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 Code: 89 df e8 5a 62 04 00 0f 0b e8 43 71 ed ff 4d 8d 6e ff e9 73 fb ff ff e8 35 71 ed ff 48 c7 c6 a0 ab 79 86 48 89 df e8 36 62 04 00 <0f> 0b e8 1f 71 ed ff 4d 8d 6e ff e9 eb fb ff ff c7 45 d0 f0 ff RIP [] isolate_lru_page+0x4ea/0x6d0 mm/vmscan.c:1446 RSP ---[ end trace 4b07319c03942d44 ]--- BUG: sleeping function called from invalid context at include/linux/sched.h:2805 in_atomic(): 1, irqs_disabled(): 0, pid: 8185, name: a.out INFO: lockdep is turned off. CPU: 1 PID: 8185 Comm: a.out Tainted: G D 4.5.0-rc1+ #300 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 00000000ffffffff ffff88006c8f7548 ffffffff82be118d ffff88006146c740 0000000000001ff9 0000000000000000 ffff88006c8f7570 ffffffff813cb8cb ffff88006146c740 ffffffff867387a0 0000000000000af5 ffff88006c8f75b0 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [] dump_stack+0x6f/0xa2 lib/dump_stack.c:50 [] ___might_sleep+0x27b/0x3a0 kernel/sched/core.c:7703 [] __might_sleep+0x90/0x1a0 kernel/sched/core.c:7665 [< inline >] threadgroup_change_begin include/linux/sched.h:2805 [] exit_signals+0x81/0x430 kernel/signal.c:2392 [] do_exit+0x23c/0x2cb0 kernel/exit.c:701 [] oops_end+0x9f/0xd0 arch/x86/kernel/dumpstack.c:250 [] die+0x46/0x60 arch/x86/kernel/dumpstack.c:316 [< inline >] do_trap_no_signal arch/x86/kernel/traps.c:205 [] do_trap+0x18f/0x380 arch/x86/kernel/traps.c:251 [] do_error_trap+0x11e/0x280 arch/x86/kernel/traps.c:290 [] do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:303 [] invalid_op+0x1e/0x30 arch/x86/entry/entry_64.S:830 [< inline >] migrate_page_add mm/mempolicy.c:966 [] queue_pages_pte_range+0x4ad/0x10b0 mm/mempolicy.c:552 [< inline >] walk_pmd_range mm/pagewalk.c:50 [< inline >] walk_pud_range mm/pagewalk.c:90 [< inline >] walk_pgd_range mm/pagewalk.c:116 [] __walk_page_range+0x653/0xcd0 mm/pagewalk.c:204 [] walk_page_range+0x134/0x300 mm/pagewalk.c:281 [] queue_pages_range+0xfb/0x130 mm/mempolicy.c:687 [] do_mbind+0x2c1/0xdc0 mm/mempolicy.c:1239 [< inline >] SYSC_mbind mm/mempolicy.c:1351 [] SyS_mbind+0x13d/0x150 mm/mempolicy.c:1333 [] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 note: a.out[8185] exited with preempt_count 1 On commit 92e963f50fc74041b5e9e744c330dca48e04f08d with Kirill recent fix: --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -1261,7 +1261,7 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma) } sfp->mmap_called = 1; - vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP; + vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP; vma->vm_private_data = sfp; vma->vm_ops = &sg_mmap_vm_ops; return 0; -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org