mm: kernel BUG at mm/mmap.c:446!
From: Sasha Levin
Date: Wed Sep 03 2014 - 13:24:48 EST
Hi all,
While fuzzing with trinity inside a KVM tools guest running the latest -next
kernel, I've stumbled on the following spew:
[ 8419.384997] kernel BUG at mm/mmap.c:446!
[ 8419.385478] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 8419.388478] Dumping ftrace buffer:
[ 8419.390338] (ftrace buffer empty)
[ 8419.393890] Modules linked in:
[ 8419.393890] CPU: 19 PID: 32634 Comm: trinity-c190 Not tainted 3.17.0-rc3-next-20140902-sasha-00031-g407ff1a #1099
[ 8419.393890] task: ffff880349293000 ti: ffff880458304000 task.ti: ffff880458304000
[ 8419.393890] RIP: validate_mm (mm/mmap.c:446 (discriminator 1))
[ 8419.393890] RSP: 0000:ffff880458307da8 EFLAGS: 00010296
[ 8419.393890] RAX: 000000000000001a RBX: 00000000000002c2 RCX: 0000000000000000
[ 8419.393890] RDX: 000000000000001a RSI: ffffffffb14e5e17 RDI: ffffffffae1e4007
[ 8419.393890] RBP: ffff880458307de8 R08: 0000000000000001 R09: 0000000000000001
[ 8419.393890] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001
[ 8419.393890] R13: 0000000000000000 R14: ffff8802aac8d000 R15: 0000000000000000
[ 8419.393890] FS: 00007fd40a4d0700(0000) GS:ffff880958400000(0000) knlGS:0000000000000000
[ 8419.393890] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 8419.393890] CR2: 000000000063c378 CR3: 00000002891ee000 CR4: 00000000000006a0
[ 8419.393890] DR0: 00000000006f0000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8419.393890] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
[ 8419.393890] Stack:
[ 8419.393890] ffff8802c4f87e00 000000000229be00 ffff880200000001 ffff880354275600
[ 8419.393890] ffff88030229be00 ffff88030229be78 ffff88035c215800 ffff88030229be68
[ 8419.393890] ffff880458307e78 ffffffffae2e42f8 fffffffffffff9fa 00000000000025d2
[ 8419.393890] Call Trace:
[ 8419.393890] vma_adjust (mm/mmap.c:895)
[ 8419.393890] vma_merge (mm/mmap.c:1056)
[ 8419.393890] do_brk (mm/mmap.c:2743)
[ 8419.393890] SyS_brk (mm/mmap.c:322 mm/mmap.c:269)
[ 8419.393890] tracesys (arch/x86/kernel/entry_64.S:542)
[ 8419.393890] Code: 8b 76 58 39 d6 75 16 8b 45 cc 85 c0 75 1d 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 c7 c7 88 c0 75 b2 31 c0 e8 06 2c 20 03 <0f> 0b 31 db 45 31 ff e9 f5 fe ff ff 48 89 c2 48 c7 c7 28 09 76
All code
========
0: 8b 76 58 mov 0x58(%rsi),%esi
3: 39 d6 cmp %edx,%esi
5: 75 16 jne 0x1d
7: 8b 45 cc mov -0x34(%rbp),%eax
a: 85 c0 test %eax,%eax
c: 75 1d jne 0x2b
e: 48 83 c4 18 add $0x18,%rsp
12: 5b pop %rbx
13: 41 5c pop %r12
15: 41 5d pop %r13
17: 41 5e pop %r14
19: 41 5f pop %r15
1b: 5d pop %rbp
1c: c3 retq
1d: 48 c7 c7 88 c0 75 b2 mov $0xffffffffb275c088,%rdi
24: 31 c0 xor %eax,%eax
26: e8 06 2c 20 03 callq 0x3202c31
2b:* 0f 0b ud2 <-- trapping instruction
2d: 31 db xor %ebx,%ebx
2f: 45 31 ff xor %r15d,%r15d
32: e9 f5 fe ff ff jmpq 0xffffffffffffff2c
37: 48 89 c2 mov %rax,%rdx
3a: 48 c7 c7 28 09 76 00 mov $0x760928,%rdi
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: 31 db xor %ebx,%ebx
4: 45 31 ff xor %r15d,%r15d
7: e9 f5 fe ff ff jmpq 0xffffffffffffff01
c: 48 89 c2 mov %rax,%rdx
f: 48 c7 c7 28 09 76 00 mov $0x760928,%rdi
[ 8419.393890] RIP validate_mm (mm/mmap.c:446 (discriminator 1))
[ 8419.393890] RSP <ffff880458307da8>
I'm not sure which one of the possible reasons for BUG() it was since the
pr_info didn't end up getting printed (I'm sending a patch to make that code
nicer).
Thanks,
Sasha
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/