From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760416AbdEWCUf (ORCPT ); Mon, 22 May 2017 22:20:35 -0400 Received: from szxga01-in.huawei.com ([45.249.212.187]:6800 "EHLO szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759483AbdEWCUc (ORCPT ); Mon, 22 May 2017 22:20:32 -0400 Message-ID: <59239C4C.5020709@huawei.com> Date: Tue, 23 May 2017 10:19:56 +0800 From: Xishi Qiu User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: Hugh Dickins CC: Andrew Morton , Tejun Heo , Michal Hocko , Johannes Weiner , "Mel Gorman" , Michal Hocko , Vlastimil Babka , Minchan Kim , "David Rientjes" , Joonsoo Kim , , , Rik van Riel , Linux MM , LKML , zhong jiang Subject: Re: mm, something wring in page_lock_anon_vma_read()? References: <591D6D79.7030704@huawei.com> <591EB25C.9080901@huawei.com> <591EBE71.7080402@huawei.com> <591F9A09.6010707@huawei.com> <591FA78E.9050307@huawei.com> <5922B3D4.1030700@huawei.com> In-Reply-To: Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit X-Originating-IP: [10.177.25.179] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090203.59239C5D.00D0,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 45fe998c3501af5cd2e05e09dc4a2ace Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2017/5/23 3:26, Hugh Dickins wrote: > On Mon, 22 May 2017, Xishi Qiu wrote: >> On 2017/5/20 10:40, Hugh Dickins wrote: >>> On Sat, 20 May 2017, Xishi Qiu wrote: >>>> >>>> Here is a bug report form redhat: https://bugzilla.redhat.com/show_bug.cgi?id=1305620 >>>> And I meet the bug too. However it is hard to reproduce, and >>>> 624483f3ea82598("mm: rmap: fix use-after-free in __put_anon_vma") is not help. >>>> >>>> From the vmcore, it seems that the page is still mapped(_mapcount=0 and _count=2), >>>> and the value of mapping is a valid address(mapping = 0xffff8801b3e2a101), >>>> but anon_vma has been corrupted. >>>> >>>> Any ideas? >>> >>> Sorry, no. I assume that _mapcount has been misaccounted, for example >>> a pte mapped in on top of another pte; but cannot begin tell you where >> >> Hi Hugh, >> >> What does "a pte mapped in on top of another pte" mean? Could you give more info? > > I mean, there are various places in mm/memory.c which decide what they > intend to do based on orig_pte, then take pte lock, then check that > pte_same(pte, orig_pte) before taking it any further. If a pte_same() > check were missing (I do not know of any such case), then two racing > tasks might install the same pte, one on top of the other - page > mapcount being incremented twice, but decremented only once when > that pte is finally unmapped later. > Hi Hugh, Do you mean that the ptes from two racing point to the same page? or the two racing point to two pages, but one covers the other later? and the first page maybe alone in the lru list, and it will never be freed when the process exit. We got this info before crash. [26068.316592] BUG: Bad rss-counter state mm:ffff8800a7de2d80 idx:1 val:1 Thanks, Xishi Qiu > Please see similar discussion in the earlier thread at > marc.info/?l=linux-mm&m=148222656211837&w=2 > > Hugh > >> >> Thanks, >> Xishi Qiu >> >>> in Red Hat's kernel-3.10.0-229.4.2.el7 that might happen. >>> >>> Hugh > > . >