Re: Kernel BUG at page_alloc.c:91! (2.4.19)

[Daniel Phillips <phillips@arcor.de>]

On Monday 02 September 2002 10:26, Heiko Carstens wrote:
> Looks to me that this function itself has a bug: after the drop_pte label 
> it is
> checked if the current page has a mapping. If this is true there is a jump 
> to
> the drop_pte label, where without any further checking 
> page_cache_release() gets
> called which will result in the above described BUG() if page_count(page) 

It's not a bug in itself.  The pte was cleared just above, so the reference
being dropped corresponds to the pte that was cleared.  Because the page
has a mapping, there is still at least one count on the page that got there
when the page was put in the page cache, so the page won't be freed just
yet.  (No, this code is not a model of clarity.)

Chances are, you've run into the subtle double-free race I've been working
on for the last few days.  Would you like to try this patch as see if it
makes a difference?

   http://nl.linux.org/~phillips/patches/lru.race-2.4.19


-- 
Daniel