[lkml]   [2002]   [Sep]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Kernel BUG at page_alloc.c:91! (2.4.19)
On Monday 02 September 2002 10:26, Heiko Carstens wrote:
> Looks to me that this function itself has a bug: after the drop_pte label
> it is
> checked if the current page has a mapping. If this is true there is a jump
> to
> the drop_pte label, where without any further checking
> page_cache_release() gets
> called which will result in the above described BUG() if page_count(page)

It's not a bug in itself. The pte was cleared just above, so the reference
being dropped corresponds to the pte that was cleared. Because the page
has a mapping, there is still at least one count on the page that got there
when the page was put in the page cache, so the page won't be freed just
yet. (No, this code is not a model of clarity.)

Chances are, you've run into the subtle double-free race I've been working
on for the last few days. Would you like to try this patch as see if it
makes a difference?

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:22    [W:0.029 / U:7.056 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site