From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4EE86C64E90 for ; Tue, 1 Dec 2020 01:20:34 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 82CEC208DB for ; Tue, 1 Dec 2020 01:20:33 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=intel-com.20150623.gappssmtp.com header.i=@intel-com.20150623.gappssmtp.com header.b="Uzmqq/O0" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 82CEC208DB Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 59BA26B0036; Mon, 30 Nov 2020 20:20:32 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 54D9C6B005D; Mon, 30 Nov 2020 20:20:32 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 43CD58D0001; Mon, 30 Nov 2020 20:20:32 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0215.hostedemail.com [216.40.44.215]) by kanga.kvack.org (Postfix) with ESMTP id 2DA9B6B0036 for ; Mon, 30 Nov 2020 20:20:32 -0500 (EST) Received: from smtpin29.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id EDC62181AEF1F for ; Tue, 1 Dec 2020 01:20:31 +0000 (UTC) X-FDA: 77542958262.29.leaf13_200dea0273a6 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin29.hostedemail.com (Postfix) with ESMTP id CACD918086CCB for ; Tue, 1 Dec 2020 01:20:31 +0000 (UTC) X-HE-Tag: leaf13_200dea0273a6 X-Filterd-Recvd-Size: 4575 Received: from mail-ej1-f68.google.com (mail-ej1-f68.google.com [209.85.218.68]) by imf19.hostedemail.com (Postfix) with ESMTP for ; Tue, 1 Dec 2020 01:20:30 +0000 (UTC) Received: by mail-ej1-f68.google.com with SMTP id d17so422605ejy.9 for ; Mon, 30 Nov 2020 17:20:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to:cc; bh=J+1U/f8XUIfRYcLWaEg2HuJO67e2bBkfXtfCPlsTd8I=; b=Uzmqq/O0H8LGO8ruL15nzggaqZT5+d2foYv3eXaSR9eNZIPcQwx9us0q6mHObu0lyZ STWaZymD2WDC9z8lUYjT6RDWe1Ek+qgPxfgjzFBmxAcXmnljtAO2Mp2JikFtTsCMyjDT FEfHk5WXXH6X6iRsgt740Uon3v/4GujWFcy2/3bL6AoDnJ52xj42AUomdmC1EJjzSPIs kkItq0ZgVFlnfGJKJBxKCBA/GwhW9MWHoBpnNLJd1T6y2Tf++ePuwgljIAv++/AM0lLr 0MyMazwANlgRfgSOINEXOXXHdCDaT2uZHLQTJ8BL2UXzVOErHpCDaktgGpRQ7qV0omJl B3qw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=J+1U/f8XUIfRYcLWaEg2HuJO67e2bBkfXtfCPlsTd8I=; b=BEg186+FmlCMzruFrbrQB4grv0qlqtT83jCqATfZILtY0XsPFCllDrn0NSa9E5xUYC 7y7XViYOdrCW/iFXmZ3CX6SB60/iIrYQK1G9YE+9zD6q1ORZ3sIb/D+4B4afCIsT3G0+ jhybxWHa7NN24uJeWUMbBhPxIqwnwIds3726b0bEV2rytUo7eksep9O0RRaQPDMnYF8M I+7eZD7rWFooLaxU2p7dWR2uvatf4BhPd0SKuHFoUuFNIdEZ136kQbDmzCpEPiLTcV10 qmjnfambsp9VwEJ+qib/zlfHFMGwMCYYI4BOZ8d3/lukV+LOnhonihCmPMlR4GVRg1s7 PfmQ== X-Gm-Message-State: AOAM530Ebed4BAppFWwxOXagUuzr/2oNxxZmuD9TRLe6joM2wEHJWtl2 FMfk7cwzW0UslV9nlmsJniiuAOBEdB8OEHaXIjDnBw== X-Google-Smtp-Source: ABdhPJwQsKZvZIvFtzYz5SKLhjU9W4cEeglvDwkZ9WlyzschrlmmfuQnvhrsnqHbTMw6vrio/DD/YMY3EUD2jcR43as= X-Received: by 2002:a17:906:6bc9:: with SMTP id t9mr641225ejs.472.1606785629524; Mon, 30 Nov 2020 17:20:29 -0800 (PST) MIME-Version: 1.0 From: Dan Williams Date: Mon, 30 Nov 2020 17:20:25 -0800 Message-ID: Subject: mapcount corruption regression To: "Shutemov, Kirill" , Matthew Wilcox Cc: Linux Kernel Mailing List , Linux MM , linux-nvdimm Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Kirill, Willy, compound page experts, I am seeking some debug ideas about the following splat: BUG: Bad page state in process lt-pmem-ns pfn:121a12 page:0000000051ef73f7 refcount:0 mapcount:-1024 mapping:0000000000000000 index:0x0 pfn:0x121a12 flags: 0x2ffff800000000() raw: 002ffff800000000 dead000000000100 0000000000000000 0000000000000000 raw: 0000000000000000 ffff8a6914886b48 00000000fffffbff 0000000000000000 page dumped because: nonzero mapcount [..] CPU: 26 PID: 6127 Comm: lt-pmem-ns Tainted: G OE 5.10.0-rc4+ #450 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: dump_stack+0x8b/0xb0 bad_page.cold+0x63/0x94 free_pcp_prepare+0x224/0x270 free_unref_page+0x18/0xd0 pud_free_pmd_page+0x146/0x160 ioremap_pud_range+0xe3/0x350 ioremap_page_range+0x108/0x160 __ioremap_caller.constprop.0+0x174/0x2b0 ? memremap+0x7a/0x110 memremap+0x7a/0x110 devm_memremap+0x53/0xa0 pmem_attach_disk+0x4ed/0x530 [nd_pmem] It triggers on v5.10-rc4 not on v5.9, but the bisect comes up with an ambiguous result. I've run the bisect 3 times and landed on: 032c7ed95817 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux ...which does not touch anything near _mapcount. I suspect there is something unique about the build that lines up the corruption to happen or not happen. The test is a simple namespace creation test that results in an memremap() / ioremap() over several gigabytes of memory capacity. The -1024 was interesting because that's the GUP_PIN_COUNTING_BIAS, but that's the _refcount, I did not see any questionable changes to how _mapcount is manipulated post v5.9. Problem should be reproducible by running: make -j TESTS="pmem-ns" check ...in qemu-kvm with some virtual pmem defined: -object memory-backend-file,id=mem1,share,mem-path=${mem}1,size=$((mem_size+label_size)) -device nvdimm,memdev=mem1,id=nv1,label-size=${label_size} ...where ${mem}1 is a 128GB sparse file $mem_size is 127GB and $label_size is 128KB.