LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Nick Piggin <nickpiggin@yahoo.com.au>
To: Daniel Drake <dsd@gentoo.org>
Cc: LKML <linux-kernel@vger.kernel.org>,
	Arjan van de Ven <arjan@infradead.org>
Subject: Re: Eeek! page_mapcount(page) went negative! (-1)
Date: Sun, 02 Jul 2006 03:30:03 +1000	[thread overview]
Message-ID: <44A6B11B.9080204@yahoo.com.au> (raw)
In-Reply-To: <44A6AB99.8060407@gentoo.org>

Daniel Drake wrote:
> A user at http://bugs.gentoo.org/138366 reported a one-off crash on x86 
> with 2.6.16.19. Here's hoping it might be useful to somebody:
> 
> Eeek! page_mapcount(page) went negative! (-1)
>   page->flags = 8001003c

They are PG_s referenced|uptodate|dirty|lru|mappedtodisk

So it is a regular pagecache page. Even though X is involved,
I'd be surprised if there is a kernel bug there, but it does
look like more than a simple single-bit flip.


>   page->count = 1
>   page->mapping = f6ad2418

If it is a pagecache page, page->mapping != NULL should add 1
to page->count. Then there should be another reference taken
for this mapping, and not decremented until after page_remove_rmap.

So both page_mapcount is wrong (was 0, should be at least 1) and
either page_count is wrong (was 1, should be at least 2).

If the page was truncated, dirty, mappedtodisk, and ->mapping
should have been cleared AFAIKS.

Oh. I see Arjan's pointed out it is using the nvidia driver (how
did he figure that out?). That couldn't be helping. If the
reporter can reproduce without any binary modules loaded, and
after surviving memtest overnight, it would be very interesting.

Thanks

-- 
SUSE Labs, Novell Inc.
Send instant messages to your online friends http://au.messenger.yahoo.com 

  parent reply	other threads:[~2006-07-01 17:30 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2006-07-01 17:06 Daniel Drake
2006-07-01 17:07 ` Arjan van de Ven
2006-07-01 17:44   ` Lee Revell
2006-07-01 17:45     ` Arjan van de Ven
2006-07-01 18:11       ` Lee Revell
2006-07-01 21:29         ` Daniel Drake
2006-07-01 17:30 ` Nick Piggin [this message]
2006-07-01 18:09   ` Dave Jones
2006-07-01 20:13     ` Alistair John Strachan
2007-02-05  2:39 David Liontooth
2007-02-05  4:48 ` David Liontooth
2007-02-05  5:17   ` Randy Dunlap
2007-02-05  6:10     ` David Liontooth
2007-02-05 13:57       ` Dave Jones
2007-02-05 16:30       ` Randy Dunlap

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=44A6B11B.9080204@yahoo.com.au \
    --to=nickpiggin@yahoo.com.au \
    --cc=arjan@infradead.org \
    --cc=dsd@gentoo.org \
    --cc=linux-kernel@vger.kernel.org \
    --subject='Re: Eeek'\!' page_mapcount(page) went negative'\!' (-1)' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).