On Tue, Jan 12, 2021 at 09:27:51PM +0800, kernel test robot wrote:
>
> Greeting,
>
> FYI, we noticed the following commit (built with gcc-9):
>
> commit: 755e5d55367af5ff75a4db9b6cf439416878e2c7 ("bpf: Eliminate
> rlimit-based memory accounting for hashtab maps")
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
>
>
> in testcase: trinity
> version: trinity-i386-4d2343bd-1_20200320
> with following parameters:
>
> runtime: 300s
>
> test-description: Trinity is a linux system call fuzz tester.
> test-url: http://codemonkey.org.uk/projects/trinity/
>
>
> on test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 8G
>
> caused below changes (please refer to attached dmesg/kmsg for entire
> log/backtrace):
>
>
> +------------------------------------------------------------+------------+------------+
> | | 844f157f6c |
> 755e5d5536 |
> +------------------------------------------------------------+------------+------------+
> | BUG:Bad_page_map_in_process | 0 | 9
> |
> | BUG:Bad_page_state_in_process | 0 | 9
> |
> | BUG:Bad_rss-counter_state_mm:(ptrval)type:MM_FILEPAGES_val | 0 | 1
> |
> | BUG:Bad_rss-counter_state_mm:#type:MM_FILEPAGES_val | 0 | 8
> |
> | WARNING:at_mm/vmalloc.c:#vmap_pte_range | 0 | 3
> |
> | EIP:vmap_pte_range | 0 | 3
> |
> | BUG:unable_to_handle_page_fault_for_address | 0 | 1
> |
> | Oops:#[##] | 0 | 1
> |
> | EIP:free_percpu | 0 | 1
> |
> | EIP:__rb_reserve_next | 0 | 1
> |
> | WARNING:at_mm/percpu-vm.c:#__pcpu_balance_workfn | 0 | 1
> |
> | EIP:__pcpu_balance_workfn | 0 | 1
> |
> | WARNING:at_mm/vmalloc.c:#unmap_kernel_range_noflush | 0 | 1
> |
> | EIP:unmap_kernel_range_noflush | 0 | 1
> |
> +------------------------------------------------------------+------------+------------+
>
>
> If you fix the issue, kindly add following tag
> Reported-by: kernel test robot <oliver.s...@intel.com>
I've tried to reproduce the problem on two different machines running the test
case many times,
but haven't succeed yet. I wonder though, if it's the same problem as described
and fixed by
commit e1868b9e36d0 ("bpf: Avoid overflows involving hash elem_size").
Thanks!
