[lkml]   [2019]   [Mar]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [Qestion] Hit a WARN_ON_ONCE in try_to_unmap_one when runing syzkaller

On Wed, Mar 13, 2019 at 12:03:20AM +0800, zhong jiang wrote:
> Minchan has changed the conditon check from BUG_ON to WARN_ON_ONCE in try_to_unmap_one.
> However, It is still an abnormal condition when PageSwapBacked is not equal to PageSwapCache.
> But Is there any case it will meet the conditon in the mainline.
> It is assumed that PageSwapBacked(page) is true in the anonymous page, This is to say, PageSwapcache
> is false. however, That is impossible because we will update the pte for hwpoison entry.
> Because page is locked , Its page flags should not be changed except for PageSwapBacked

try_to_unmap_one() from hwpoison_user_mappings() could reach the
WARN_ON_ONCE() only if TTU_IGNORE_HWPOISON is set, because PageHWPoison()
is set at the beginning of memory_failure().

Clearing TTU_IGNORE_HWPOISON might happen on the following two paths:

static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
int flags, struct page **hpagep)

if (PageSwapCache(p)) {
pr_err("Memory failure: %#lx: keeping poisoned page in swap cache\n",

mapping = page_mapping(hpage);
if (!(flags & MF_MUST_KILL) && !PageDirty(hpage) && mapping &&
mapping_cap_writeback_dirty(mapping)) {
if (page_mkclean(hpage)) {
} else {
kill = 0;
pr_info("Memory failure: %#lx: corrupted page was clean: dropped without side effects\n",

unmap_success = try_to_unmap(hpage, ttu);

So either of the above "ttu |= TTU_IGNORE_HWPOISON" should be executed.
I'm not sure which one, but both paths show printk messages, so if you
could have kernel message log, that might help ...

Naoya Horiguchi

 \ /
  Last update: 2019-03-14 07:30    [W:0.061 / U:0.656 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site