Bug 99101
| Summary: | kernel bug at mm/memory.c:3137 | ||
|---|---|---|---|
| Product: | Memory Management | Reporter: | Trevor Saunders (tbsaunde) |
| Component: | NUMA/discontigmem | Assignee: | mm_numa-discontigmem |
| Status: | NEW --- | ||
| Severity: | normal | CC: | lstoakes, robert |
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | 4.1.0-rc5+ | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
| Attachments: |
test.c
test.c test.c |
||
|
Description
Trevor Saunders
2015-05-28 14:40:24 UTC
Somewhat simpler str:
still build github.com/mozilla/rr
compile this program with gcc -pthread test.c
#include <pthread.h>
#include <sys/time.h>
static pthread_t reader;
static void* reader_thread(void* dontcare) {
return NULL;
}
int main(int argc, char* argv[]) {
struct timeval ts;
/* (Kick on the syscallbuf if it's enabled.) */
gettimeofday(&ts, NULL);
pthread_create(&reader, NULL, reader_thread, NULL);
pthread_join(reader, NULL);
return 0;
}
then run
rr record ./a.out
rr replay
when you are dropped into gdb continnue the inferior and see the connection is closed rr is killed and the same kernel bug message appears in dmesg.
I have reduced this to a simple test program that doesn't involve rr. The program is basically
int fd = open("/proc/self/mem", O_RDWR);
void* p = mmap(NULL, PAGE_SIZE*2, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
mmap(p, PAGE_SIZE, PROT_NONE, MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
pwrite(fd, zeroes, sizeof(zeroes), (size_t)p);
It seems to be as simple as a write to /proc/.../mem that crosses VMAs.
On 4.0.4-301.fc22.x86_64, this program fails with a SIGSEGV and we get this in the kernel log:
[14719.326561] ------------[ cut here ]------------
[14719.326570] kernel BUG at mm/memory.c:3042!
[14719.326573] invalid opcode: 0000 [#164] SMP
[14719.326577] Modules linked in: ccm nfnetlink_queue nfnetlink_log nfnetlink snd_seq_dummy rfcomm xt_CHECKSUM iptable_mangle ipt_MASQUERAD
E nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack tun bridge ebtable_filter ebtables ip6table_filter ip6_tables ppdev parport_pc parport fuse vmw_vsock_vmci_transport vsock vmw_vmci bnep vfat fat nvidia(POE) arc4 iwldvm uvcvideo btusb videobuf2_vmalloc videobuf2_core videobuf2_memops v4l2_common videodev bluetooth cdc_mbim media cdc_ncm usbnet cdc_acm cdc_wdm mii mac80211 snd_hda_codec_realtek snd_hda_codec_generic snd_hda_codec_hdmi iTCO_wdt iTCO_vendor_support snd_hda_intel mmc_block snd_hda_controller snd_hda_codec intel_rapl iosf_mbi drm iwlwifi snd_hwdep x86_pkg_temp_thermal coretemp snd_seq snd_seq_device
[14719.326643] cfg80211 snd_pcm sdhci_pci sdhci mmc_core lpc_ich mfd_core snd_timer kvm_intel mei_me mei i2c_i801 shpchp kvm thinkpad_acpi joydev snd serio_raw soundcore tpm_tis rfkill tpm video wmi nfsd auth_rpcgss nfs_acl lockd grace sunrpc binfmt_misc dm_crypt 8021q garp stp llc mrp crct10dif_pclmul crc32_pclmul e1000e crc32c_intel firewire_ohci ghash_clmulni_intel firewire_core uas usb_storage crc_itu_t ptp pps_core
[14719.326688] CPU: 6 PID: 21417 Comm: test Tainted: P D W OE 4.0.4-301.fc22.x86_64 #1
[14719.326691] Hardware name: LENOVO 243827M/243827M, BIOS G5ET61WW (2.03 ) 09/13/2012
[14719.326695] task: ffff8807405831b0 ti: ffff88061c00c000 task.ti: ffff88061c00c000
[14719.326697] RIP: 0010:[<ffffffff811d2dd4>] [<ffffffff811d2dd4>] handle_mm_fault+0x12a4/0x1840
[14719.326710] RSP: 0018:ffff88061c00fbf8 EFLAGS: 00010246
[14719.326712] RAX: 0000000000000100 RBX: 0000000000000000 RCX: 0000000000000120
[14719.326715] RDX: ffff8806a614c8d0 RSI: 00003ffffffff000 RDI: 00000006a614c067
[14719.326717] RBP: ffff88061c00fcd8 R08: 00000005ef2dc120 R09: ffff8807a0bbba70
[14719.326719] R10: ffff8800000008d0 R11: 0000000000000120 R12: 0000000000000000
[14719.326721] R13: ffff8807a0bbba70 R14: ffff8806a53e9c38 R15: 00007f9ee9d1a000
[14719.326725] FS: 00007f9ee9cec700(0000) GS:ffff88081dd80000(0000) knlGS:0000000000000000
[14719.326727] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[14719.326729] CR2: 0000000000601000 CR3: 00000007f4db5000 CR4: 00000000001407e0
[14719.326732] Stack:
[14719.326734] ffff88061c00fc80 0000000000000000 ffff88081dd98e38 ffff88061c00fda8
[14719.326738] ffff88061c00fc88 ffffffff811cbc64 ffff8807a0bbba70 ffff8800ce994400
[14719.326742] 01000005ef2dc120 00000000000008d0 ffffea0000000001 ffff8800ce994400
[14719.326747] Call Trace:
[14719.326755] [<ffffffff811cbc64>] ? follow_page_pte+0xc4/0x400
[14719.326761] [<ffffffff811cc14c>] ? follow_page_mask+0x1ac/0x330
[14719.326766] [<ffffffff811cc4c3>] __get_user_pages+0x1f3/0x710
[14719.326772] [<ffffffff811cce32>] get_user_pages+0x52/0x60
[14719.326778] [<ffffffff811cd19c>] __access_remote_vm+0xec/0x300
[14719.326783] [<ffffffff811d353f>] access_remote_vm+0x1f/0x30
[14719.326790] [<ffffffff8128b11b>] mem_rw.isra.13+0xbb/0x190
[14719.326795] [<ffffffff8128b20b>] mem_write+0x1b/0x20
[14719.326801] [<ffffffff8121d1d4>] vfs_write+0xb4/0x210
[14719.326809] [<ffffffff810226a5>] ? do_audit_syscall_entry+0x55/0x80
[14719.326814] [<ffffffff8121e07a>] SyS_pwrite64+0x9a/0xc0
[14719.326823] [<ffffffff81788c89>] system_call_fastpath+0x12/0x17
[14719.326825] Code: ff ff 48 89 75 b8 48 8d 75 90 48 89 4d c0 48 89 55 98 89 45 90 49 8b 86 90 00 00 00 ff 50 18 4c 8b 95 60 ff ff ff e9 9e fa ff ff <0f> 0b 83 e8 1e 83 f8 01 0f 86 7a 03 00 00 c7 85 60 ff ff ff 10
[14719.326868] RIP [<ffffffff811d2dd4>] handle_mm_fault+0x12a4/0x1840
[14719.326873] RSP <ffff88061c00fbf8>
[14719.326877] ---[ end trace a3f27ce02b728e21 ]---
Created attachment 180381 [details]
test.c
Created attachment 180391 [details]
test.c
Sorry, attached the wrong file previously.
Created attachment 180401 [details]
test.c
Actually I can simplify it further.
This seems to boil down to writing to /proc/.../mem where memory has been mapped PROT_NONE.
This definitely worked in older kernels, though I don't have a precise regression range. I contributed a patch to address this which has been merged into 4.8rc8, assuming there are no problems discovered with the patch during the testing window, this should be resolved. ref: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=38e088546522e1e86d2b8f401a1354ad3a9b3303 Thanks! |