Eeek! page_mapcount(page) went negative! (-1)

[Matt Zimmerman]

This is very likely a duplicate of bug #252977, but note that I'm seeing this on Jaunty. Here's an excerpt from dmesg showing the error and subsequent fallout:

[87034.543827] Eeek! page_mapcount(page) went negative! (-1)
[87034.543832] page pfn = 636f1
[87034.543833] page->flags = ffffffffffffffff
[87034.543864] BUG: unable to handle kernel NULL pointer dereference at 0000000000000007
[87034.543867] IP: [<ffffffff802ccda7>] page_remove_rmap+0xc7/0x150

A complete dmesg and hardware information are attached.

When this happened, I was preparing to debug bug 311440, which included:
1. Installing xserver-xorg-core-dbg
2. Plugging in a USB remote control
3. Opening an ssh session into the system
4. Running screen
5. Running 'ps aux |grep X' to get the PID for the X server

at this point I noticed that the ps command hung partway through, and examining dmesg, found the errors. Many operations would block at this point, and so I had to reboot in order to file this bug.

ProblemType: Bug
Architecture: amd64
DistroRelease: Ubuntu 9.04
Package: linux-image-2.6.28-3-generic 2.6.28-3.4
ProcCmdLine: root=UUID=305dde78-d20a-4248-aaf4-09447b7c5791 ro quiet splash
ProcEnviron:
 LC_COLLATE=C
 PATH: custom, user
 LANG=en_US.UTF-8
 SHELL=/bin/zsh
ProcVersionSignature: Ubuntu 2.6.28-3.4-generic
SourcePackage: linux

[Matt Zimmerman (mdz)]

(FWIW, I was actually trying to debug bug 311254, not 311440)

[Leann Ogasawara (leannogasawara)]

Hi Matt,

I have asked the reporter in bug 252977 to first attach a more recent dmesg output so we can compare the stack traces before we mark this as a duplicate. I did however post the information you provided here as a comment in bug 252977 so Andy is aware. Thanks.