0xffffffff811cbf78 <free_huge_pag= e+0xc8>:=C2=A0 =C2=A0 =C2=A0 =C2=A0cmp=C2=A0 =C2=A0 $0xffffffff,%eax

0xffffffff811cbf7b <free_huge_page+0xcb>:=C2=A0 =C2=A0 =C2=A0 = =C2=A0jne=C2=A0 =C2=A0 0xffffffff811cc094 <free_huge_page+0x1e4>

......

0xffffffff811cc094 <free_huge_page+0x1e4>:=C2= =A0 =C2=A0 ud2

and check the source= code,i can only know that the panic reason is:

page->_count=3D= 0 but page->_mapcount=3D1,so hit the

BUG_ON(page_mapcount(page= ));

But can not get any further clue how the issue happen.

<= div>

So i modify= the code as the patch show,and apply the new code to our produce line and = wait some days,then the issue come again on another server.

And t= his time,by analyse the coredump using crash tool,i can know the whole file= path which trigger the issue.

For example:

crash> p= age.mapping ffffea02f9000000

=C2=A0 =C2=A0 =C2=A0 mapping =3D 0xf= fff88b098ae8160

crash> address_space.host 0xffff88b098ae8160

=C2=A0 =C2=A0 =C2=A0 host =3D 0xffff88b098ae8010

crash&g= t; inode.i_dentry 0xffff88b098ae8010

=C2=A0 =C2=A0 =C2=A0 =C2=A0 = i_dentry =3D {

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 f= irst =3D 0xffff88b0bbeb58b0

=C2=A0 =C2=A0 =C2=A0 =C2=A0 }

crash> dentry.d_name.name -= l dentry.d_alias 0xffff88b0bbeb58b0

=C2=A0 =C2=A0 =C2=A0 =C2=A0d_name.name =3D 0xffff88b0bbeb5838 "f= ile_a"

So i can know the issue happen when do= ing soft offline to the page of the file "file_a".

And = i can also know the whole file path by list the dentry.d_parent and check t= he dentry name.

Check with other team,i know that their user component will use = file_a all the time,

so the page->_mapcount not equal to -1 se= ems normal,and page->_count=3D0 is abnormal at that time.

I guess if i triggeer a soft offline to the physical addr of the= page using by file_a,maybe the issue can reproduce.

So i write a= user application to mmap to file_a and get the physical addr of the page,t= he key step just as the following:

=C2=A0 =C2=A0 =C2=A0 fd =3D op= en(FILE_A_PATH,O_RDWR,0666);

=C2=A0 =C2=A0 =C2=A0 buf =3D mmap(NU= LL, pagesize, PROT_READ, MAP_SHARED, fd, 0);

=C2=A0 =C2=A0 =C2=A0= phys_addr =3D vtop((unsigned long long)buf);

In the function vto= p(),i use "/proc/pid/pagemap" to get the physical addr of the pag= e.

Suppose that the physical addr is 0xbe40000000,= then i can trigger a soft offline to the addr:

=C2=A0 =C2=A0 =C2= =A0 =C2=A0 echo 0xbe40000000 > /sys/devices/system/memory/soft_offline_p= age

And after i trigger two or more times,the issue reproduce.

Then i use systemtap to probe page->_count and page->_mapcoun= t in the fucntions soft_offline_page(),putback_active_hugepage() and migrat= e_pages()

part of my systemtap script:

f= unction get_page_mapcount:long (page:long) %{

=C2=A0 =C2=A0 struc= t page *page;

=C2=A0 =C2=A0 page =3D (struct page = *)STAP_ARG_page;

=C2=A0 =C2=A0 if(page =3D=3D NULL)

=C2= =A0 =C2=A0 =C2=A0 =C2=A0 STAP_RETURN(NULL);

=C2=A0 =C2=A0 else

=C2=A0 =C2=A0 =C2=A0 =C2=A0 STAP_RETURN(page_mapcount(page)-1);

probe kernel.function("migrate_page= s")

{

=C2=A0 =C2=A0 page2 =3D get_page_from_migrat= e_pages($from);

=C2=A0 =C2=A0 printf("Now exec migrate_pages= -- page=3D%p,pfn=3D%ld,phy_addr=3D0x%lx,page_flags=3D0x%lx\n",page2,g= et_page_pfn(page2),get_page_phy_addr(page2),get_page_flags(page2));

=C2=A0 =C2=A0 printf("page->mapping=3D%p,page->_count=3D%d,pa= ge->_mapcount=3D%d\n",get_page_mapping(page2),get_page_count(page2)= ,get_page_mapcount(page2));

=C2=A0 =C2=A0 print_backtrace();

}

Then i trigger soft offline to reproduce t= he issue,and finally find the root cause:

In centos 7.4,when run = into soft_offline_huge_page(),get_any_page() only increase the page->_co= unt by 1,

(isolate_huge_page() will also inc page->_count by 1= but then put_page() will release the ref)

because= we use 1 GB size of hugepage,so hugepage_migration_supported() will always= return false,

so soft_offline_huge_page() -->=C2=A0 migrate_p= ages() --> unmap_and_move_huge_page() will call putback_active_hugepage(= ) to decrease page->_count by 1 just as the code show:

static = int unmap_and_move_huge_page(new_page_t get_new_page,

{

......

if (!hugepage_mig= ration_supported(page_hstate(hpage))) {

=C2=A0 =C2=A0 putback_active_hugepage(hpage);=C2=A0 =C2=A0/= / =3D=3D> will decrease page->_count by 1

=C2=A0 =C2=A0 return -ENOSYS;

}

......

Th= en when return to soft_offline_huge_page,page->_count will be decrease b= y 1 again by putback_active_hugepage():

static int soft_offline_h= uge_page(struct page *page, int flags)

{

=C2=A0 =C2=A0= =C2=A0 ret =3D migrate_pages(&pa= gelist, new_page, MPOL_MF_MOVE_ALL,

=C2=A0 =C2=A0=C2=A0 MIGRATE_SYNC, MR_MEMORY_FAILURE);

=C2=A0 =C2=A0=C2=A0 if (ret) {

=C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0 <= /span>pr_info("soft offline: %#lx: migration failed %d, type %lx\n&quo= t;,

=C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0 pfn, ret, page->flags);

=C2=A0 =C2=A0 =C2=A0 =C2= =A0=C2=A0 putback_active_hugepage(h= page);=C2=A0 // =3D=3D> here will decrease page->_count by 1 again

=C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0 = ......

=C2=A0 =C2=A0=C2=A0= } else {

=C2=A0 =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 ......

=C2=A0 =C2=A0=C2=A0 }

}

So we can know when call soft_offline_page() to the 1 GB size o= f hugepage,page->_count will be abnormally decrease by 1!

=E3=80=90=C2=A0 I remove one putba= ck_active_hugepage() in soft_offline_huge_page() to fix this issue.=C2=A0 = =E3=80=91

And i check the latest kernel code on gi= t hub(4.19),it seems already fix this issue by the following code:

static int soft_offline_huge_page(struct page *page, int flags)

{

=C2=A0 =C2=A0=C2=A0 ret= =3D migrate_pages(&pagelist, new_page, NULL, MPOL_MF_MOVE_ALL,

=C2=A0 =C2=A0=C2=A0 MIGRATE_SY= NC, MR_MEMORY_FAILURE);

=C2=A0 =C2=A0=C2=A0 if (ret) {

=C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0 pr_info("soft offline: %#lx: hug= epage migration failed %d, type %lx (%pGp)\n",

=C2=A0 =C2=A0= =C2=A0 =C2=A0=C2=A0 =C2=A0 =C2=A0= pfn, ret, page->flags, &page->flags);

=C2=A0 =C2=A0 = =C2=A0 =C2=A0=C2=A0 if (!list_empty= (&pagelist))=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0// =3D=3D&g= t; seems this code can fix the issue i meet

=C2=A0 =C2=A0 =C2=A0 = =C2=A0=C2=A0 =C2=A0 =C2=A0 putback= _movable_pages(&pagelist);

=C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0<= span style=3D"white-space:pre"> if (ret > 0)

=C2=A0 = =C2=A0 =C2=A0 =C2=A0=C2=A0 ret =3D= -EIO;

=C2=A0 =C2=A0=C2=A0 } else {

=C2=A0 =C2=A0=C2=A0 }

}

But i can not find a similar bug fix report or = commit log.