Kernel page_mapcount Eek Requires Reboot

[richb]

Kernel randomly crashes with dmesg "page_mapcount(page) went negative!".

Some lines from my dmesg:
Eeek! page_mapcount(page) went negative! (-1)
kernel BUG at mm/rmap.c:588!
Trying to fix it up, but a reboot is needed

My test setup sometimes crashes with a hard freeze, but of course there is no log about those crashes.

All three dmesgs this far (2007-04-27) have similarities:
- Linux 2.6.20-15.27-generic (my test setup is also unstable with other Ubuntu kernels)
- AMD Athlon CPU (both 32 bit and 64 bit)

[richb (richard-bradshaw-blueyonder)]

Forgot to attach dmesg.

[Christophe Giboudeaux (krop)]

I just got something similar but it seems the problem appeared after firefox crash :

[36968.052000] Eeek! page_mapcount(page) went negative! (-1)
[36968.052000] page pfn = 3817d
[36968.052000] page->flags = 80000014
[36968.052000] page->count = 1
[36968.052000] page->mapping = 00000000
[36968.052000] vma->vm_ops = 0x0
[36968.052000] ------------[ cut here ]------------
[36968.052000] kernel BUG at mm/rmap.c:588!
[36968.052000] invalid opcode: 0000 [#1]
[36968.052000] SMP
[36968.052000] Modules linked in: bluetooth snd_rtctimer binfmt_misc vboxdrv ppdev powernow_k8 cpufreq_userspace cpufreq_stats cpufreq_powersave cpufreq_ondemand freq_table cpufreq_conservative tc1100_wmi pcc_acpi dev_acpi sony_acpi video sbs i2c_ec dock button battery container ac asus_acpi backlight fuse parport_pc lp parport ndiswrapper tuner tvaudio snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm_oss msp3400 snd_pcm snd_mixer_oss bttv video_buf snd_seq_dummy ir_common snd_seq_oss compat_ioctl32 i2c_algo_bit snd_seq_midi snd_rawmidi btcx_risc snd_seq_midi_event snd_seq snd_timer snd_seq_device nvidia(P) tveeprom videodev v4l2_common v4l1_compat snd soundcore amd64_agp pcspkr shpchp pci_hotplug snd_page_alloc k8temp i2c_nforce2 i2c_core agpgart evdev tsdev ext3 jbd mbcache sg sd_mod ide_cd cdrom ide_disk sata_nv usbhid hid ata_generic libata scsi_mod amd74xx generic ehci_hcd ohci_hcd usbcore thermal processor fan fbcon tileblit font bitblit softcursor vesafb capability commoncap
[36968.052000] CPU: 0
[36968.052000] EIP: 0060:[<c0169f10>] Tainted: P VLI
[36968.052000] EFLAGS: 00210246 (2.6.20-15-generic #2)
[36968.052000] EIP is at page_remove_rmap+0xe0/0xf0
[36968.052000] eax: 00000000 ebx: c1702fa0 ecx: 00200046 edx: 00000000
[36968.052000] esi: eed935c0 edi: 0ccfc000 ebp: c1702fa0 esp: ce709ec8
[36968.052000] ds: 007b es: 007b ss: 0068
[36968.052000] Process firefox-bin (pid: 26697, ti=ce708000 task=c7789a90 task.ti=ce708000)
[36968.052000] Stack: c036966b 00000000 fffffd00 dcda83f0 c0163a8d f8bd34ad 0cd49fff 0c568000
[36968.052000] eed935c0 ce709f58 00000000 00000000 0cd4a000 da5110cc e14fbe40 c1806140
[36968.052000] ffffff04 ffffffff c139b50c dcda8000 da5110cc 3817d067 3817d067 0006b000
[36968.052000] Call Trace:
[36968.052000] [<c0163a8d>] unmap_vmas+0x2dd/0x5c0
[36968.052000] [<c0166c89>] unmap_region+0x99/0x110
[36968.052000] [<c016777d>] do_munmap+0x14d/0x1e0
[36968.052000] [<c016800d>] sys_brk+0xdd/0xf0
[36968.052000] [<c01031f0>] sysenter_past_esp+0x69/0xa9
[36968.052000] =======================
[36968.052000] Code: c0 74 0d 8b 50 08 b8 fc a1 36 c0 e8 3b ca fd ff 8b 46 48 85 c0 74 14 8b 40 10 85 c0 74 0d 8b 50 2c b8 1c a2 36 c0 e8 20 ca fd ff <0f> 0b eb fe 8b 53 0c eb 95 8d b4 26 00 00 00 00 55 57 56 89 d6
[36968.052000] EIP: [<c0169f10>] page_remove_rmap+0xe0/0xf0 SS:ESP 0068:ce709ec8
[36968.052000] <6>note: firefox-bin[26697] exited with preempt_count 1
[36968.052000] BUG: scheduling while atomic: firefox-bin/0x10000001/26697
[36968.052000] [<c02ec938>] __sched_text_start+0x5f8/0xa90
[36968.052000] [<c0120f46>] __cond_resched+0x16/0x40
[36968.052000] [<c02ecdfa>] cond_resched+0x2a/0x40
[36968.052000...

[Tero Karvinen (karvinen+launchpad)]

I have the same kernel problem. The machine is unstable, with random freezees every couple of days.

The problem:
- Machine is unstable. Max uptime is about two weeks. Hard freezees occur randomly, sometimes after less than day of use. Freeze is hard, nothing works: num lock does not change light, alt-ctrl-del does not work, picture is frozen on screen. Freeze also occurs when machine is not heavily loaded, even though heavy load seems to make it crash faster sometimes.
- To test the problem, I changed hard disk, re-installed Ubuntu (6.06 LTS -> 7.04). I checked that hard drive and motherboard temperature is acceptable. Memory passed test.
- Also, USB stopped to work after a kernel upgrade in Dapper (another bug).
- Machine is unstable in both 6.06 LTS and 7.04, even though I have only seen the error in dmesg of 7.07. Attached dmesg is from 7.04.

Some lines from dmesg:
Eeek! page_mapcount(page) went negative! (-1)
kernel BUG at mm/rmap.c:588!
Trying to fix it up, but a reboot is needed

Test setup:
- sudo lshw: CPU AMD Athlon(tm) XP 2200+, BIOS American Megatrends Inc. 07.00T (04/02/01), Motherboard ECS M848A
- uname -a: Linux *** 2.6.20-15-generic #2 SMP Sun Apr 15 07:36:31 UTC 2007 i686 GNU/Linux
- Ubuntu 7.04, fresh install.

[Sam Kimbrel (kimbrel)]

Also getting this bug in Feisty 7.04, with Linux 2.6.20-16-generic i686.
Kernel bug message is attached even though it matches previously submitted copies.
Active process at the time of crash was Pidgin.

[Charles Perreault (muganor)]

I get the same kernel error but with kernel 2.6.22-14, in gutsy. I'm using a pentium 4 cpu. This bug may be a duplicate (or vice-versa) of bug #123223. I get random freeze every 1-2 day or so. Last time my system crash was just after starting firefox. The system memory was far from full (about 500 mb used in cache). System froze hard, after reboot I saw this in syslog :

Oct 11 20:43:19 nec kernel: [29991.443174] Eeek! page_mapcount(page) went negative! (-1)
Oct 11 20:43:19 nec kernel: [29991.443196] page pfn = 2ece0
Oct 11 20:43:19 nec kernel: [29991.443200] page->flags = 40000824
Oct 11 20:43:19 nec kernel: [29991.443203] page->count = 2
Oct 11 20:43:19 nec kernel: [29991.443206] page->mapping = effe4654
Oct 11 20:43:19 nec kernel: [29991.443223] vma->vm_ops = generic_file_vm_ops+0x0/0x18
Oct 11 20:43:19 nec kernel: [29991.443237] vma->vm_ops->nopage = filemap_nopage+0x0/0x340
Oct 11 20:43:19 nec kernel: [29991.443243] vma->vm_file->f_op->mmap = generic_file_mmap+0x0/0x40
Oct 11 20:43:19 nec kernel: [29991.443313] ------------[ cut here ]------------
Oct 11 20:43:19 nec kernel: [29991.443316] kernel BUG at /build/buildd/linux-source-2.6.22-2.6.22/mm/rmap.c:628!
Oct 11 20:43:19 nec kernel: [29991.443321] invalid opcode: 0000 [#1]
Oct 11 20:43:19 nec kernel: [29991.443324] SMP
Oct 11 20:43:19 nec kernel: [29991.443328] Modules linked in: vmnet(P) vmmon(P) binfmt_misc rfcomm l2cap bluetooth ppdev r128 drm cpufreq_stats cpufreq_ondemand cpufreq_powersave cpufreq_conservative cpufreq_userspace ac button container dock sbs video battery parport_pc lp parport p4_clockmod speedstep_lib freq_table snd_via82xx gameport snd_ac97_codec ac97_bus snd_pcm_oss snd_mixer_oss snd_pcm snd_page_alloc snd_mpu401_uart snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device i2c_viapro i2c_core via_ircc snd pcspkr psmouse serio_raw soundcore via_agp irda shpchp pci_hotplug agpgart crc_ccitt ipv6 nls_cp437 nls_utf8 cifs evdev ext3 jbd mbcache ide_cd cdrom ide_disk ata_generic libata scsi_mod via_rhine mii floppy via82cxxx ide_core uhci_hcd usbcore thermal processor fan fuse apparmor commoncap
Oct 11 20:43:19 nec kernel: [29991.443438] CPU: 0
Oct 11 20:43:19 nec kernel: [29991.443439] EIP: 0060:[page_remove_rmap+233/256] Tainted: P VLI
Oct 11 20:43:19 nec kernel: [29991.443441] EFLAGS: 00213282 (2.6.22-14-generic #1)
Oct 11 20:43:19 nec kernel: [29991.443452] EIP is at page_remove_rmap+0xe9/0x100
Oct 11 20:43:19 nec kernel: [29991.443457] eax: 0000004a ebx: c15d9c00 ecx: 00203046 edx: 00000000
Oct 11 20:43:19 nec kernel: [29991.443462] esi: dfe0b8f0 edi: b7d71000 ebp: dfeda380 esp: df941dc8
Oct 11 20:43:19 nec kernel: [29991.443466] ds: 007b es: 007b fs: 00d8 gs: 0000 ss: 0068
Oct 11 20:43:19 nec kernel: [29991.443471] Process Xorg (pid: 4493, ti=df940000 task=dfacc530 task.ti=df940000)
Oct 11 20:43:19 nec kernel: [29991.443475] Stack: c037ae8d effe4654 c15d9c00 ef1465c4 c016b5c2 c019e13c 2ece0025 3882d12b
Oct 11 20:43:19 nec kernel: [29991.443487] b7ea4fff 00000000 dfe0b8f0 df941e5c 001dff20 00000000 00000001 b7ea5000
Oct 11 20:43:19 nec kernel: [29991.4...

[Charles Perreault (muganor)]

This bug may have duplicates : #123223, #123243 and #134996.

[ChrisLees (christopher-lees)]

Poster "krop" mentions it happening straight after a Firefox crash. This has happened to me twice, both times forshadowed by Firefox freezing up.

I have run Memtest86 for 5 passes. The RAM (which is new, anyway) passes. I have a Core 2 Duo. The problem has only happened twice - once on the 14th of Feb, the other time on the 16th. I have had this computer unaltered since the beginning of the year.

[Marlon Cisternas Milla (mcisternas-deactivatedaccount)]

this bug happens in the kernel 2.6.24-19 or not?

Please, don't forget to answer.

[Launchpad Janitor (janitor)]

Beginning with the Hardy Heron 8.04 development cycle, all open Ubuntu kernel bugs need to be reported against the "linux" kernel package. We are automatically migrating this bug to the new "linux" package. However, development has already began for the upcoming Intrepid Ibex 8.10 release. It would be helpful if you could test the upcoming release and verify if this is still an issue - http://www.ubuntu.com/testing . If the issue still exists, please update this report by changing the Status of the "linux" task from "Incomplete" to "New". We appreciate your patience and understanding as we make this transition. Thanks!

[Leann Ogasawara (leannogasawara)]

The Ubuntu Kernel Team is planning to move to the 2.6.27 kernel for the upcoming Intrepid Ibex 8.10 release. As a result, the kernel team would appreciate it if you could please test this newer 2.6.27 Ubuntu kernel. There are one of two ways you should be able to test:

1) If you are comfortable installing packages on your own, the linux-image-2.6.27-* package is currently available for you to install and test.

--or--

2) The upcoming Alpha5 for Intrepid Ibex 8.10 will contain this newer 2.6.27 Ubuntu kernel. Alpha5 is set to be released Thursday Sept 4. Please watch http://www.ubuntu.com/testing for Alpha5 to be announced. You should then be able to test via a LiveCD.

Please let us know immediately if this newer 2.6.27 kernel resolves the bug reported here or if the issue remains. More importantly, please open a new bug report for each new bug/regression introduced by the 2.6.27 kernel and tag the bug report with 'linux-2.6.27'. Also, please specifically note if the issue does or does not appear in the 2.6.26 kernel. Thanks again, we really appreicate your help and feedback.