Re: [BUG] Bad page flags when process using mlock()ed memory exits

[Johannes Weiner]

On Fri, Jun 19, 2009 at 02:11:21PM +1000, Peter Chubb wrote:
> 
> In recent kernels I've been seeing many mesages of the form:
> 
> BUG: Bad page state in process reiserfsck  pfn:79c58
> page:c3d03b00 flags:8050000c count:0 mapcount:0 mapping:(null) index:8095
> Pid: 3927, comm: reiserfsck Not tainted 2.6.30-test-05456-gda456f1 #60
> Call Trace:
>  [<c134a67c>] ? printk+0xf/0x13
>  [<c10774dc>] bad_page+0xc9/0xe2
>  [<c1078041>] free_hot_cold_page+0x5c/0x204
>  [<c1078206>] __pagevec_free+0x1d/0x25
>  [<c107ac3e>] release_pages+0x14e/0x18e)
>  [<c108ef8a>] free_pages_and_swap_cache+0x69/0x82
>  [<c1089458>] exit_mmap+0xf6/0x11f
>  [<c102afcd>] mmput+0x39/0xaf
>  [<c102e534>] exit_mm+0xe5/0xed
>  [<c102fa66>] do_exit+0x13f/0x578
>  [<c102fefd>] do_group_exit+0x5e/0x85
>  [<c102ff37>] sys_exit_group+0x13/0x17
>  [<c10031ef>] sysenter_do_call+0x12/0x3c
> Disabling lock debugging due to kernel taint
> 
> This appears to have been introduced by patch 
>     da456f14d2f2d7350f2b9440af79c85a34c7eed5
>     page allocator: do not disable interrupts in free_page_mlock()
> 
> That patch removed the free_page_mlock() from free_pages_check(), so
> if free_hot_cold_page() is called on an Mlocked page (e.g., if a
> process that used mlock() calls exit()) free_pages_check() will always
> barf, whereas before it would just unlock the page.

I prepared a fix, thanks for chasing it down.

Mel, to keep this simple I just used the atomic test-clear, but if I
am not mistaken we should not need any atomicity here, so we could
probably add a __TestClearPage version and use this instead...?

---