Firefox causes Kernel bug and crash

[Eli L]

Binary package hint: firefox

I am using Ubuntu 8.04 x64.

I was just minding my own business browsing in FF3 and it crashed. After tha,t programs became unresponsive and I was unable to open any more programs. To stop this, a hard reboot was required.

The error log is as follows:

Apr 25 16:27:16 eli-desktop kernel: [ 1559.591529] Eeek! page_mapcount(page) went negative! (-1)
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591535] page pfn = 9a8f
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591537] page->flags = 100000000000014
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591538] page->count = 2
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591539] page->mapping = 0000000000000000
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591553] vma->vm_ops = 0x0
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591563] ------------[ cut here ]------------
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591565] kernel BUG at /build/buildd/linux-2.6.24/mm/rmap.c:631!
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591566] invalid opcode: 0000 [1] SMP
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591568] CPU 0
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591569] Modules linked in: ipv6 af_packet rfcomm l2cap bluetooth ppdev cpufreq_conservative cpufreq_powersave cpufreq_stats cpufreq_userspace cpufreq_ondemand freq_table sbs sbshc dock container video output battery iptable_filter ip_tables x_tables ac sbp2 lp parport_pc parport joydev evdev pcspkr snd_usb_audio snd_usb_lib snd_hwdep snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy fglrx(P) snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device button k8temp snd shpchp soundcore snd_page_alloc i2c_nforce2 pci_hotplug i2c_core ext3 jbd mbcache sd_mod usbhid hid sg sr_mod cdrom sata_nv pata_acpi pata_amd floppy r8169 ohci1394 ata_generic ieee1394 libata scsi_mod ehci_hcd ohci_hcd forcedeth usbcore thermal processor fan fbcon tileblit font bitblit softcursor fuse
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591606] Pid: 5962, comm: firefox Tainted: P 2.6.24-16-generic #1
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591608] RIP: 0010:[page_remove_rmap+0x11a/0x130] [page_remove_rmap+0x11a/0x130] page_remove_rmap+0x11a/0x130
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591615] RSP: 0018:ffff810017aedbd8 EFLAGS: 00010246
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591617] RAX: 0000000000000000 RBX: ffff81003f40cf48 RCX: ffffffff803a1970
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591619] RDX: 00000000ffffffff RSI: 0000000000000000 RDI: ffffffff8057d9e4
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591621] RBP: ffff81002210c580 R08: 0000000000000000 R09: 00000000ffffffff
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591623] R10: 0000000000000000 R11: 0000000000000000 R12: 000000000371a000
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591624] R13: ffff81003f40cf48 R14: 0000000003c9b000 R15: 00000000002ed000
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591627] FS: 00007f24c93726f0(0000) GS:ffffffff805b0000(0000) knlGS:00000000f7ded8c0
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591628] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591630] CR2: 00007f24c918d000 CR3: 000000003e5ec000 CR4: 00000000000006e0
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591632] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591634] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591636] Process firefox (pid: 5962, threadinfo ffff810017aec000, task ffff81002954e7c0)
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591637] Stack: 0000000003719000 0000000003800000 ffff810015f418d0 ffffffff8028fea2
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591641] ffff810022005380 ffffffff8061e7a0 ffff8100010087b8 0000000003c9afff
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591643] 0000000000000000 ffff810017aedcf8 ffffffffffffffff 0000000000000000
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591646] Call Trace:
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591650] [unmap_vmas+0x4f2/0x7e0] unmap_vmas+0x4f2/0x7e0
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591666] [exit_mmap+0x78/0x100] exit_mmap+0x78/0x100
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591672] [mmput+0x26/0xb0] mmput+0x26/0xb0
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591675] [do_exit+0x1c0/0x940] do_exit+0x1c0/0x940
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591683] [do_group_exit+0x2c/0x80] do_group_exit+0x2c/0x80
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591687] [get_signal_to_deliver+0x2f7/0x4b0] get_signal_to_deliver+0x2f7/0x4b0
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591693] [do_notify_resume+0xc4/0x810] do_notify_resume+0xc4/0x810
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591696] [try_to_wake_up+0x62/0x2e0] try_to_wake_up+0x62/0x2e0
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591702] [__sigqueue_alloc+0x25/0x70] __sigqueue_alloc+0x25/0x70
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591708] [recalc_sigpending+0xe/0x40] recalc_sigpending+0xe/0x40
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591710] [fuse:sigprocmask+0x67/0x1630] sigprocmask+0x67/0xf0
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591713] [sys_rt_sigprocmask+0x80/0x100] sys_rt_sigprocmask+0x80/0x100
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591718] [recalc_sigpending+0xe/0x40] recalc_sigpending+0xe/0x40
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591720] [fuse:sigprocmask+0x67/0x1630] sigprocmask+0x67/0xf0
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591724] [sysret_signal+0x1c/0x27] sysret_signal+0x1c/0x27
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591727] [ptregscall_common+0x67/0xb0] ptregscall_common+0x67/0xb0
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591737]
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591738]
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591738] Code: 0f 0b eb fe 48 8b 53 10 e9 65 ff ff ff 66 0f 1f 84 00 00 00
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591744] RIP [page_remove_rmap+0x11a/0x130] page_remove_rmap+0x11a/0x130
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591747] RSP <ffff810017aedbd8>
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591749] ---[ end trace 0c400dcdb83ea85c ]---
Apr 25 16:27:16 eli-desktop kernel: [ 1559.591750] Fixing recursive fault but reboot is needed!
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661474] Bad page state in process 'Xorg'
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661476] page:ffff81003f40cf48 flags:0x0100000000000014 mapping:0000000000000000 mapcount:-1 count:0
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661478] Trying to fix it up, but a reboot is needed
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661479] Backtrace:
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661486] Pid: 5407, comm: Xorg Tainted: P D 2.6.24-16-generic #1
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661488]
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661489] Call Trace:
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661507] [bad_page+0x60/0xa0] bad_page+0x60/0xa0
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661511] [free_hot_cold_page+0x18c/0x1a0] free_hot_cold_page+0x18c/0x1a0
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661517] [agp_generic_destroy_page+0x62/0x90] agp_generic_destroy_page+0x62/0x90
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661521] [fglrx:agp_free_memory+0xa5/0x6f0] agp_free_memory+0xa5/0x100
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661577] [fglrx:drm_free_agp+0x59/0x640] :fglrx:drm_free_agp+0x59/0xf0
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661621] [fglrx:firegl_free_buffer_queue_nomap+0x17a/0x930] :fglrx:firegl_free_buffer_queue_nomap+0x17a/0x1a0
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661664] [fglrx:firegl_cmmqs_free_pool+0x4f/0xf10] :fglrx:firegl_cmmqs_free_pool+0x4f/0x180
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661708] [fglrx:MCIL_FreeMemoryInDescriptor+0x48/0x80] :fglrx:MCIL_FreeMemoryInDescriptor+0x48/0x80
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661763] [fglrx:_ZN2OS9gart_FreeEP7CMMPool+0xce/0xf0] :fglrx:_ZN2OS9gart_FreeEP7CMMPool+0xce/0xf0
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661822] [fglrx:_ZN12CMMHeap_GART16dropPoolFromHeapEP7CMMPool+0x38/0x280] :fglrx:_ZN12CMMHeap_GART16dropPoolFromHeapEP7CMMPool+0x38/0x80
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661878] [fglrx:_ZN12CMMHeap_GART10shrinkHeapEb+0xa3/0x160] :fglrx:_ZN12CMMHeap_GART10shrinkHeapEb+0xa3/0xb0
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661933] [fglrx:_ZN3MSF19free_surf_resourcesEP10CMMSurfaceP9CMMClientP9CMMDriver+0x150/0x1e0] :fglrx:_ZN3MSF19free_surf_resourcesEP10CMMSurfaceP9CMMClientP9CMMDriver+0x150/0x1e0
Apr 25 16:27:26 eli-desktop kernel: [ 1569.661989] [fglrx:_ZN3MSF9free_surfEP9CMMDriverP10CMMSurface+0x80/0xe0] :fglrx:_ZN3MSF9free_surfEP9CMMDriverP10CMMSurface+0x80/0xe0
Apr 25 16:27:26 eli-desktop kernel: [ 1569.662042] [fglrx:CMMFreeSurface+0x132/0x170] :fglrx:CMMFreeSurface+0x132/0x170
Apr 25 16:27:26 eli-desktop kernel: [ 1569.662098] [fglrx:_Z8uCWDDEQCmjjPvjS_+0x740/0x3810] :fglrx:_Z8uCWDDEQCmjjPvjS_+0x740/0xf80
Apr 25 16:27:26 eli-desktop kernel: [ 1569.662145] [fglrx:firegl_cmmqs_CWDDE_32+0x20a/0x310] :fglrx:firegl_cmmqs_CWDDE_32+0x20a/0x310
Apr 25 16:27:26 eli-desktop kernel: [ 1569.662189] [fglrx:firegl_cmmqs_CWDDE32+0x67/0xf0] :fglrx:firegl_cmmqs_CWDDE32+0x67/0xf0
Apr 25 16:27:26 eli-desktop kernel: [ 1569.662233] [fglrx:firegl_cmmqs_CWDDE32+0x0/0xf0] :fglrx:firegl_cmmqs_CWDDE32+0x0/0xf0
Apr 25 16:27:26 eli-desktop kernel: [ 1569.662273] [fglrx:firegl_ioctl+0x1b6/0x230] :fglrx:firegl_ioctl+0x1b6/0x230
Apr 25 16:27:26 eli-desktop kernel: [ 1569.662282] [do_ioctl+0x7d/0xa0] do_ioctl+0x7d/0xa0
Apr 25 16:27:26 eli-desktop kernel: [ 1569.662286] [vfs_ioctl+0x220/0x2c0] vfs_ioctl+0x220/0x2c0
Apr 25 16:27:26 eli-desktop kernel: [ 1569.662291] [sys_ioctl+0x91/0xb0] sys_ioctl+0x91/0xb0
Apr 25 16:27:26 eli-desktop kernel: [ 1569.662297] [system_call+0x7e/0x83] system_call+0x7e/0x83
Apr 25 16:27:26 eli-desktop kernel: [ 1569.662304]

[Eli L (flclfan)]

I think FGLRX and/or Pulseaudio caused this problem. After disabling those two things all my problems went away.

[Bryce Harrington (bryce)]

Hi flclfan,

Thank you for taking the time to report this bug and helping to make Ubuntu better. You reported this bug a while ago and there hasn't been any activity in it recently. We were wondering is this still an issue for you? Can you try with the latest development release of Ubuntu? (ISOs are available from cdimage.ubuntu.com)

If it remains an issue, could you also attach a new /var/log/Xorg.0.log?
Thanks in advance.

The output of lspci -vvnn would also be worth having.

[Bryce Harrington (bryce)]

We're closing this bug since it is has been some time with no response from the original reporter. However, if the issue still exists please feel free to reopen with the requested information. Also, if you could, please test against the latest development version of Ubuntu, since this confirms the bug is one we may be able to pass upstream for help.

[mercutio22 (macabro22)]

This is also happening here. I am attaching my kern.log file.

[mercutio22 (macabro22)]

I am using the latest ubuntu 9.04, up to date.

[mrlarkin (mrlarkin)]

Same here. Firefox crashed and I had to reboot.

program versions:
Ubuntu: 9.04 (amd64)
Firefox: 3.0.10+nobinonly-0ubuntu0.9.04.1
Kernel: linux-image-2.6.28-11-generic 2.6.28-11.42

system info:
---- /proc/cpuinfo ----
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 23
model name : Intel(R) Core(TM)2 Duo CPU T9400 @ 2.53GHz
stepping : 6
cpu MHz : 800.000
cache size : 6144 KB
physical id : 0
siblings : 2
core id : 0
cpu cores : 2
apicid : 0
initial apicid : 0
fpu : yes
fpu_exception : yes
cpuid level : 10
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts rep_good pni dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm sse4_1 lahf_lm tpr_shadow vnmi flexpriority
bogomips : 5053.67
clflush size : 64
cache_alignment : 64
address sizes : 36 bits physical, 48 bits virtual
power management:

processor : 1
vendor_id : GenuineIntel
cpu family : 6
model : 23
model name : Intel(R) Core(TM)2 Duo CPU T9400 @ 2.53GHz
stepping : 6
cpu MHz : 800.000
cache size : 6144 KB
physical id : 0
siblings : 2
core id : 1
cpu cores : 2
apicid : 1
initial apicid : 1
fpu : yes
fpu_exception : yes
cpuid level : 10
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts rep_good pni dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm sse4_1 lahf_lm tpr_shadow vnmi flexpriority
bogomips : 5053.97
clflush size : 64
cache_alignment : 64
address sizes : 36 bits physical, 48 bits virtual
power management:

--- /proc/meminfo ---
MemTotal: 3869680 kB
MemFree: 2967276 kB
Buffers: 90740 kB
Cached: 322376 kB
SwapCached: 0 kB
Active: 603128 kB
Inactive: 166220 kB
Active(anon): 443004 kB
Inactive(anon): 8 kB
Active(file): 160124 kB
Inactive(file): 166212 kB
Unevictable: 8 kB
Mlocked: 8 kB
SwapTotal: 4000144 kB
SwapFree: 4000144 kB
Dirty: 4 kB
Writeback: 0 kB
AnonPages: 356252 kB
Mapped: 88872 kB
Slab: 43868 kB
SReclaimable: 23356 kB
SUnreclaim: 20512 kB
PageTables: 19052 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 5934984 kB
Committed_AS: 1070552 kB
VmallocTotal: 34359738367 kB
VmallocUsed: 338012 kB
VmallocChunk: 34359398907 kB
HugePages_Total: 0
HugePages_Free: 0
HugePages_Rsvd: 0
HugePages_Surp: 0
Hugepagesize: 2048 kB
DirectMap4k: 45056 kB
DirectMap2M: 4046848 kB

--- dmesg at crash ---
[30565.497826] swap_free: Bad swap offset entry ffffffffffff00
[30565.498138] Eeek! page_mapcount(page) went negative! (-1)
[30565.498142] page pfn = 0
[30565.498145] page->flags = 414
[30565.498149] page->count = 1
[30565.498152] page->mapping = 0000000000000000
[30565.498164] vma->vm_ops = generic_file_vm_ops+0x0/0x40
[30565.498172] vma->vm_ops->fault = filemap_fault+...

[mrlarkin (mrlarkin)]

Firefox crashed again, shortly after skype went down..
it doesn't seem to be the same bug, so just for completeness here's the ouput of dmesg:
[ 1121.236330] process `skype' is using obsolete setsockopt SO_BSDCOMPAT
[ 1906.291716] VM: killing process skype
[ 1906.301322] swap_free: Bad swap offset entry ffffff00000000
[ 1906.301353] swap_free: Bad swap offset entry ffffff00000000
[ 1940.699062] firefox: Corrupted page table at address 7f96a3f11f08
[ 1940.699070] PGD 141158067 PUD 13c163067 PMD 140031067 PTE ffffffffffffffff
[ 1940.699081] Bad pagetable: 000d [#1] SMP
[ 1940.699088] last sysfs file: /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq
[ 1940.699095] Dumping ftrace buffer:
[ 1940.699100] (ftrace buffer empty)
[ 1940.699104] CPU 1
[ 1940.699108] Modules linked in: aes_x86_64 aes_generic i915 drm binfmt_misc ppdev bridge stp bnep vboxnetflt vboxdrv input_polldev joydev lp parport snd_hda_intel snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy snd_seq_oss snd_seq_midi arc4 ecb snd_rawmidi snd_seq_midi_event snd_seq snd_timer iwlagn iwlcore uvcvideo snd_seq_device psmouse thinkpad_acpi pcmcia mac80211 compat_ioctl32 led_class snd soundcore pcspkr serio_raw intel_agp videodev v4l1_compat nvram ricoh_mmc sdhci_pci sdhci video btusb yenta_socket rsrc_nonstatic pcmcia_core iTCO_wdt iTCO_vendor_support snd_page_alloc cfg80211 output usbhid usb_storage ohci1394 ieee1394 e1000e fbcon tileblit font bitblit softcursor
[ 1940.699225] Pid: 4411, comm: firefox Not tainted 2.6.28-11-generic #42-Ubuntu
[ 1940.699230] RIP: 0033:[<00007f96a3dd4069>] [<00007f96a3dd4069>] 0x7f96a3dd4069
[ 1940.699241] RSP: 002b:00007fffb1c04b90 EFLAGS: 00010297
[ 1940.699245] RAX: 0000000000000012 RBX: 00007fffb1c04b9c RCX: 0000000000000011
[ 1940.699249] RDX: 00007f96a3f11ec0 RSI: 0000000000000030 RDI: 0000000000000000
[ 1940.699253] RBP: 00000000047c5ac0 R08: 000000000000001e R09: 0000000000000022
[ 1940.699258] R10: 00000000000000f0 R11: 00007fffb1c049d0 R12: 0000000003385d60
[ 1940.699262] R13: 0000000003385d60 R14: 0000000000000000 R15: 000000000217f660
[ 1940.699268] FS: 00007f96a9be5700(0000) GS:ffff88015b802d80(0000) knlGS:0000000000000000
[ 1940.699273] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1940.699277] CR2: 00007f96a3f11f08 CR3: 000000013bd89000 CR4: 00000000000006a0
[ 1940.699282] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1940.699286] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 1940.699292] Process firefox (pid: 4411, threadinfo ffff8801400a2000, task ffff88015091acc0)
[ 1940.699296]
[ 1940.699298] RIP [<00007f96a3dd4069>] 0x7f96a3dd4069
[ 1940.699305] RSP <00007fffb1c04b90>
[ 1940.699310] ---[ end trace 6fcb1843ff25a59f ]---

[Knut Ola (knutola)]

I have the same problem. When I use firefox, some times when there are many connections, everything freezes, also mouse pointer animation. But I am able to move the mouse. But I have to do a hard reset (turn off the power on my laptop) to continue. Usually I get this when I go to my www.netvibes.com account. Many rss connections on that page

[mrlarkin (mrlarkin)]

I think that this is more general. The applications gvfs-gphoto2-vo, notify-osd and again gvfa-gphoto2-vo produced corrupted page table messages. The latter two may be consecutive faults, but I'm just speculating.

I hadn't too many connections open. But the system became unresponsive. I could switch to a terminal and call dmesg. But it hung completely when i called reboot.

[Andres Mujica (andres.mujica)]

I' m marking this bug as dupe from bug #252977

If someone has a reliable way to reproduce this bug please report back.

Thanks