Messages in this thread | | | Date | Fri, 14 Mar 2014 16:42:23 -0400 | From | Sasha Levin <> | Subject | Re: mm: kernel BUG at mm/huge_memory.c:2785! |
| |
On 03/07/2014 07:18 AM, Kirill A. Shutemov wrote: > On Thu, Mar 06, 2014 at 08:32:48PM -0500, Sasha Levin wrote: >> On 03/04/2014 10:53 PM, Sasha Levin wrote: >>> On 03/04/2014 10:16 PM, Bob Liu wrote: >>>> On Thu, Feb 27, 2014 at 11:03 PM, Kirill A. Shutemov >>>> <kirill.shutemov@linux.intel.com> wrote: >>>>> Sasha Levin wrote: >>>>>> Hi all, >>>>>> >>>>>> While fuzzing with trinity inside a KVM tools guest running latest -next kernel I've stumbled on the >>>>>> following spew: >>>>>> >>>>>> [ 1428.146261] kernel BUG at mm/huge_memory.c:2785! >>>>> >>>>> Hm, interesting. >>>>> >>>>> It seems we either failed to split huge page on vma split or it >>>>> materialized from under us. I don't see how it can happen: >>>>> >>>>> - it seems we do the right thing with vma_adjust_trans_huge() in >>>>> __split_vma(); >>>>> - we hold ->mmap_sem all the way from vm_munmap(). At least I don't see >>>>> a place where we could drop it; >>>>> >>>> >>>> Enable CONFIG_DEBUG_VM may show some useful information, at least we >>>> can confirm weather rwsem_is_locked(&tlb->mm->mmap_sem) before >>>> split_huge_page_pmd(). >>> >>> I have CONFIG_DEBUG_VM enabled and that code you're talking is not triggering, so mmap_sem >>> is locked. >> >> Guess what. I've just hit it. > > I think this particular traceback is not a real problem: by time of > exit_mm() we shouldn't race with anybody for the mm_struct. > > We probably could drop ->mmap_sem later in mmput() rather then in > exit_mm() to fix this false positive. > >> It's worth keeping in mind that this is the first time I see it. > > Hm. That's strange exit_mmap() is called without holding ->mmap_sem. >
This issues does happen quite often and is very easy to reproduce, I could try anything you can thing of.
Thanks, Sasha
| |