Kernel bug with MPX?

From: Richard Biener
Date: Wed Mar 06 2019 - 03:53:07 EST



Hi,

I've reported this internally but got directed here, hopefully
the correct forum for bugreporting.

When running the gcc.target/i386/mpx/memmove-1.c testcase
from the GCC 8 branch on MPX capable hardware the testcase
faults and the kernel log reports the following:

[1216548.787494] BUG: Bad rss-counter state mm:0000000017ce560b idx:0
val:385
[1216548.787498] BUG: Bad rss-counter state mm:0000000017ce560b idx:1
val:551
[1216548.787500] BUG: non-zero pgtables_bytes on freeing mm: 24576

This is on a 4.20.7 kernel but it was reproduced it with 5.0 as well.
I believe it was fine on earlier kernels though.

I've put a statically linked executable at
http://www.suse.de/~rguenther/memmove-1.exe (needs some time to sync
to the public webserver still).

Thanks,
Richard.

--
Richard Biener <rguenther@xxxxxxx>
SUSE LINUX GmbH, GF: Felix Imendoerffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nuernberg)

---------- Forwarded message ----------
Date: Tue, 5 Mar 2019 15:22:22 +0100
From: Michal Hocko <mhocko@xxxxxxxx>
To: Richard Biener <rguenther@xxxxxxx>
Cc: suse-labs@xxxxxxx
Subject: Re: [suse-labs] Kernel bug with MPX?

On Mon 04-03-19 14:12:07, Richard Guenther wrote:
>
> I have a MPX testcase (GCC mpx testsuite) that triggers
>
> [1216548.787494] BUG: Bad rss-counter state mm:0000000017ce560b idx:0
> val:385
> [1216548.787498] BUG: Bad rss-counter state mm:0000000017ce560b idx:1
> val:551
> [1216548.787500] BUG: non-zero pgtables_bytes on freeing mm: 24576
>
> on Tumbleweed from a few weeks ago

That looks like both file and anonymous mappings do not get torn down
properly and some memory leaks.

> > uname -a
> Linux e23 4.20.7-1-default #1 SMP PREEMPT Thu Feb 7 07:16:45 UTC 2019
> (730812f) x86_64 x86_64 x86_64 GNU/Linux
>
> does this ring any bell?

Not really but I haven't been following MPX development closely. I
can reproduce the issue on 5.0 kernel

BUG: Bad rss-counter state mm:00000000406bd30e idx:1 val:25591

so I guess it would be best to report upstream (Cc linux-mm@xxxxxxxxx,
linux-kernel@xxxxxxxxxxxxxxx and dave.hansen@xxxxxxxxx). Let me know if
you need any help.

--
Michal Hocko
SUSE Labs