Re: mmap/munmap bug

Tue, 22 Mar 2005 01:41:15 -0800


The page contains the data part of the skbuff, so I guess it is used by a slab.

Isn't this the idea of mapcount? to keep count of number of mapping to a page, and free the page only when this ref-count reaches zero??


I don't mind the slab being freed and the page not. My application won't access that page until the net-driver allocates a buffer on this page and I receive its pointer.
Will this page be used again, if I keep a mapping to it?
I don't see any reasons not to.

On Tue, 22 Mar 2005, yingchao zhou wrote:

Suppose the page used by slab, and when it was cut
down, the page probably be freed twice.
--- Hayim Shaul <[EMAIL PROTECTED]> 的正文：


It certainly is.

But doesn't the get_page() supposed to increment the
map_count??

If so, then the kernel should have crashed every
time I mapped/unmapped.



On Tue, 22 Mar 2005, yingchao zhou wrote:

The returned page from proc_file_nopage probably
used 
by other part of kernel or application.
--- Hayim Shaul <[EMAIL PROTECTED]> 的正文：


Hi all,

I have an unexplained bug with mmap/munmap on
2.6.X. 

I'm writing a kernel module that gives super-fast
access to the network.
It does so by doing mmap thus avoiding the memcpy
to/from user.

It works well for some time but then the kernel
panics with a bad_page
message (full stack is given below)

What I understand from this message is that an
unmapped page is being
unmapped again. The bug usually appears when I
unmap 
the area from user
space.

I don't understand what I am doing wrong. I
follow 
the example from
Linux-device-driver (2nd ed.) and codes I found
under drivers/.

I also saw that there's a mapping bug in the 2.6
kernels. I'm not
convinced yet that this is the case, but if so,
is 
there a work around?

relevant parts of the code are given below.

I'd appreciate any input,
   Hayim.

************************************88
The full panic message:

Mar 21 08:48:15 localhost kernel: Bad page state
at 
free_hot_cold_page
(in process 'noa', page c1000100)
Mar 21 08:48:15 localhost kernel:
flags:0x00001014 
mapping:00000000
mapcount:0 count:0
Mar 21 08:48:15 localhost kernel: Backtrace:
Mar 21 08:48:15 localhost kernel:  [<c01329a5>]
bad_page+0x75/0xb0
Mar 21 08:48:15 localhost kernel:  [<c013308c>]
free_hot_cold_page+0x5c/0xd0
Mar 21 08:48:15 localhost kernel:  [<c013c6fb>]
zap_pte_range+0x14b/0x270
Mar 21 08:48:15 localhost kernel:  [<c013c873>]
zap_pmd_range+0x53/0x70
Mar 21 08:48:15 localhost kernel:  [<c013c8d3>]
zap_pud_range+0x43/0x60
Mar 21 08:48:15 localhost kernel:  [<c013c96e>]
unmap_page_range+0x7e/0xa0
Mar 21 08:48:15 localhost kernel:  [<c013ca81>]
unmap_vmas+0xf1/0x200
Mar 21 08:48:15 localhost kernel:  [<c0141005>]
unmap_region+0x75/0xe0
Mar 21 08:48:15 localhost kernel:  [<c0141303>]
do_munmap+0x113/0x150
Mar 21 08:48:15 localhost kernel:  [<c0141384>]
sys_munmap+0x44/0x70
Mar 21 08:48:15 localhost kernel:  [<c0102563>]
syscall_call+0x7/0xb
Mar 21 08:48:15 localhost kernel: Trying to fix
it 
up, but a reboot is
needed




**********************************************************8


static void sniffer_vma_open(struct
vm_area_struct 
*vma) {
     printk("vma_open\n");
}

static void sniffer_vma_close(struct
vm_area_struct 
*vma) {
     printk("vma_close\n");
}

static int proc_file_mmap(struct file *filp,
struct 
vm_area_struct *vma)
{
     /* don.t do anything here: "nopage" will
fill 
the holes */
     vma->vm_ops = &sniffer_vm_ops;
     vma->vm_flags |= VM_RESERVED;
     sniffer_vma_open(vma);
     return 0;
}

static struct page *proc_file_nopage(struct
vm_area_struct *vma,
                 unsigned long address, int
*type) 
{
     struct page *page = NOPAGE_SIGBUS;

     unsigned long physaddr = ((address -
vma->vm_start) >> PAGE_SHIFT) +
vma->vm_pgoff;

     if (! page_should_be_mapped(my_page_bitmap,
physaddr))
         return NOPAGE_SIGBUS;

page = virt_to_page((physaddr <<
PAGE_SHIFT)); 
//  page = virt_to_page(__va(physaddr <<
PAGE_SHIFT));    // bug in LDD?
     get_page(page);
     return page;

                           }

struct vm_operations_struct sniffer_vm_ops = {
     .open   = sniffer_vma_open,
     .close  = sniffer_vma_close,
     .nopage = proc_file_nopage,
};

                            static
struct file_operations File_Ops_4_Our_Proc_File =
{ 
     .read = proc_file_read,
     .write = proc_file_write,
     .open = proc_file_open,
     .release = proc_file_close,
     .mmap = proc_file_mmap,
};

--
Kernelnewbies: Help each other learn about the
Linux 
kernel.
Archive:
http://mail.nl.linux.org/kernelnewbies/
FAQ:           http://kernelnewbies.org/faq/


+++++++++++++++++++++++++++++++++++++++++++
This Mail Was Scanned By Mail-seCure System
at the Tel-Aviv University CC.
-
To unsubscribe from this list: send the line
"unsubscribe linux-kernel" in
the body of a message to
[EMAIL PROTECTED] 
More majordomo info at
http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/




_________________________________________________________ 
Do You Yahoo!?
注册世界一流品质的雅虎免费电邮


http://cn.rd.yahoo.com/mail_cn/tag/1g/*http://cn.mail.yahoo.com/ 

+++++++++++++++++++++++++++++++++++++++++++
This Mail Was Scanned By Mail-seCure System
at the Tel-Aviv University CC.


_________________________________________________________
Do You Yahoo!?
注册世界一流品质的雅虎免费电邮
http://cn.rd.yahoo.com/mail_cn/tag/1g/*http://cn.mail.yahoo.com/

+++++++++++++++++++++++++++++++++++++++++++
This Mail Was Scanned By Mail-seCure System
at the Tel-Aviv University CC.

Reply via email to