page_mapcount(page) went negative

With which particular version of the kernel did you notice this bug? Has it occurred any more with newer versions?

Ah, I see the kernel version now - "2.6.22-6-generic".

I just encountered the same bug, once with 2.6.22-13 and once with 2.6.22-14. Here is a copy of syslog :

Oct 11 20:43:19 nec kernel: [29991.443174] Eeek! page_mapcount(page) went negative! (-1)
Oct 11 20:43:19 nec kernel: [29991.443196] page pfn = 2ece0
Oct 11 20:43:19 nec kernel: [29991.443200] page->flags = 40000824
Oct 11 20:43:19 nec kernel: [29991.443203] page->count = 2
Oct 11 20:43:19 nec kernel: [29991.443206] page->mapping = effe4654
Oct 11 20:43:19 nec kernel: [29991.443223] vma->vm_ops = generic_file_vm_ops+0x0/0x18
Oct 11 20:43:19 nec kernel: [29991.443237] vma->vm_ops->nopage = filemap_nopage+0x0/0x340
Oct 11 20:43:19 nec kernel: [29991.443243] vma->vm_file->f_op->mmap = generic_file_mmap+0x0/0x40
Oct 11 20:43:19 nec kernel: [29991.443313] ------------[ cut here ]------------
Oct 11 20:43:19 nec kernel: [29991.443316] kernel BUG at /build/buildd/linux-source-2.6.22-2.6.22/mm/rmap.c:628!
Oct 11 20:43:19 nec kernel: [29991.443321] invalid opcode: 0000 [#1]
Oct 11 20:43:19 nec kernel: [29991.443324] SMP
Oct 11 20:43:19 nec kernel: [29991.443328] Modules linked in: vmnet(P) vmmon(P) binfmt_misc rfcomm l2cap bluetooth ppdev r128 drm cpufreq_stats cpufreq_ondemand cpufreq_powersave cpufreq_conservative cpufreq_userspace ac button container dock sbs video battery parport_pc lp parport p4_clockmod speedstep_lib freq_table snd_via82xx gameport snd_ac97_codec ac97_bus snd_pcm_oss snd_mixer_oss snd_pcm snd_page_alloc snd_mpu401_uart snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device i2c_viapro i2c_core via_ircc snd pcspkr psmouse serio_raw soundcore via_agp irda shpchp pci_hotplug agpgart crc_ccitt ipv6 nls_cp437 nls_utf8 cifs evdev ext3 jbd mbcache ide_cd cdrom ide_disk ata_generic libata scsi_mod via_rhine mii floppy via82cxxx ide_core uhci_hcd usbcore thermal processor fan fuse apparmor commoncap
Oct 11 20:43:19 nec kernel: [29991.443438] CPU: 0
Oct 11 20:43:19 nec kernel: [29991.443439] EIP: 0060:[page_remove_rmap+233/256] Tainted: P VLI
Oct 11 20:43:19 nec kernel: [29991.443441] EFLAGS: 00213282 (2.6.22-14-generic #1)
Oct 11 20:43:19 nec kernel: [29991.443452] EIP is at page_remove_rmap+0xe9/0x100
Oct 11 20:43:19 nec kernel: [29991.443457] eax: 0000004a ebx: c15d9c00 ecx: 00203046 edx: 00000000
Oct 11 20:43:19 nec kernel: [29991.443462] esi: dfe0b8f0 edi: b7d71000 ebp: dfeda380 esp: df941dc8
Oct 11 20:43:19 nec kernel: [29991.443466] ds: 007b es: 007b fs: 00d8 gs: 0000 ss: 0068
Oct 11 20:43:19 nec kernel: [29991.443471] Process Xorg (pid: 4493, ti=df940000 task=dfacc530 task.ti=df940000)
Oct 11 20:43:19 nec kernel: [29991.443475] Stack: c037ae8d effe4654 c15d9c00 ef1465c4 c016b5c2 c019e13c 2ece0025 3882d12b
Oct 11 20:43:19 nec kernel: [29991.443487] b7ea4fff 00000000 dfe0b8f0 df941e5c 001dff20 00000000 00000001 b7ea5000
Oct 11 20:43:19 nec kernel: [29991.443499] dfab9b7c c16092c0 0000a6df 00000000 00000000 ffffffef c15e28cc 00000000
Oct 11 20:43:19 nec kernel: [29991.443510] Call Trace:
Oct 11 20:43:19 nec kernel: [29991.443528] [unmap_vmas+770/1488] unmap_vmas+0x302/0x5d0
Oct 11 20:43:19 nec kernel: [29991.443535] ...

I just encountered the bug on another machine (previous was named nec, new is nas2). nas2 is a gutsy server. I assure that while I may had have doubt about nec's hardware (faulty memory), I doubt that two of my machines could have defective memory at the same time. My NAS servers (nas1,nas2,nas3) were all very stable for the last years with uptimes of months. Ok upgrading to gutsy may seem dumb, I know, but I wanted a newer kernel with better encryption/jfs support. Anyway, now we have this kernel bug and I think it's critical. I'm not the only people having it.

So far, I've seen this bug in kernel 2.6.22-14-server, 2.6.22-14-generic and 2.6.22-13-generic.

[436307.718390] Eeek! page_mapcount(page) went negative! (-1)
[436307.718452] page pfn = 12f11
[436307.718471] page->flags = 4001002c
[436307.718490] page->count = 1
[436307.718508] page->mapping = c78ade8c
[436307.718548] vma->vm_ops = generic_file_vm_ops+0x0/0x18
[436307.718592] vma->vm_ops->nopage = filemap_nopage+0x0/0x330
[436307.718622] vma->vm_file->f_op->mmap = generic_file_mmap+0x0/0x40
[436307.718719] ------------[ cut here ]------------
[436307.718743] kernel BUG at /build/buildd/linux-source-2.6.22-2.6.22/mm/rmap.c:628!
[436307.718780] invalid opcode: 0000 [#1]
[436307.718799] SMP
[436307.718819] Modules linked in: jfs sha256 cbc blkcipher aes_i586 aes dm_crypt dm_mod fuse lp sg sd_mod i2c_viapro via686a pcspkr i2c_isa i2c_core via_agp parport_pc parport agpgart shpchp pci_hotplug ipv6 evdev ext3 jbd mbcache ide_cd cdrom ide_disk floppy 3c59x mii sata_sil uhci_hcd usbcore via82cxxx ide_core ata_generic libata scsi_mod raid10 raid456 xor raid1 raid0 multipath linear md_mod thermal processor fan capability commoncap
[436307.719076] CPU: 0
[436307.719079] EIP: 0060:[<c0173779>] Not tainted VLI
[436307.719084] EFLAGS: 00010282 (2.6.22-14-server #1)
[436307.719161] EIP is at page_remove_rmap+0xe9/0x100
[436307.719187] eax: 0000004b ebx: c125e220 ecx: 00000046 edx: 00000000
[436307.719217] esi: c0a3b5d8 edi: c125e220 ebp: b7ee2000 esp: c0cc9e9c
[436307.719246] ds: 007b es: 007b fs: 00d8 gs: 0000 ss: 0068
[436307.719277] Process rsync (pid: 6228, ti=c0cc8000 task=d3d70000 task.ti=c0cc8000)
[436307.719307] Stack: c0383ba6 c78ade8c 00000020 c1cbb710 c016b6bf 12f11025 00000000 b7f41fff
[436307.719364] 01cbb067 00000000 00000000 c0a3b5d8 c0cc9f44 00000000 00000000 12f11025
[436307.719419] 00000000 00000000 00000001 b7f42000 d3e68010 d1d01540 c12872c0 00000000
[436307.719475] Call Trace:
[436307.719509] [<c016b6bf>] unmap_vmas+0x43f/0x6f0
[436307.719574] [<c01700b8>] exit_mmap+0x78/0xf0
[436307.719611] [<c0125c73>] mmput+0x33/0xa0
[436307.719648] [<c012b15f>] do_exit+0x10f/0x800
[436307.719679] [<c013387a>] do_sigaction+0x14a/0x1c0
[436307.719736] [<c012b876>] do_group_exit+0x26/0x80
[436307.719770] [<c010418a>] sysenter_past_esp+0x6b/0xa1
[436307.719822] =======================
[436307.719843] Code: c0 74 0d 8b 50 08 b8 c4 2b 38 c0 e8 02 95 fd ff 8b 46 4c 85 c0 74 14 8b 40 10 85 c0 74 0d 8b 50 2c b8 e4 2b 38 c0 e8 e7 94 fd ff <0f> 0b eb fe 8b 53 0c eb 95 8d b4 26 00 00 00 00 8d bc 27 00 00
[436307.720023] EIP: [<...

Bug #123243 may be a duplicate of this one. It shows that the bug may be present in 2.6.20 also.

Same error here on Kubuntu Gutsy. I was copying some gigabytes of data from an external drive to the hard disk when the system froze. I couldn't do anything under KDE on the machine but could ssh into it from my laptop. After logging in remotely, I ran 'top' to find 'kswapd0' hogging 100% CPU. I am attaching relevant snips from /var/log/syslog & /var/log/messages. On my machine:

$uname -a
Linux cellar 2.6.22-14-generic #1 SMP Tue Dec 18 08:02:57 UTC 2007 i686 GNU/Linux

This thread on LKML seems to refer to a similar bug: http://kerneltrap.org/mailarchive/linux-kernel/2007/12/3/470732

Arjan van de Ven's reply in that thread is that this issue is probably non-existent in 2.6.23

I also noticed some ACPI errors in my boot sequence. I don't know if the errors & this bug are related.
From dmesg:
--------------------------
[ 3.032000] AppArmor: AppArmor initialized<5>audit(1198941367.848:2): type=1505 info="AppArmor initialized" pid=1211
[ 3.040000] fuse init (API version 7.8)
[ 3.044000] Failure registering capabilities with primary security module.
[ 3.164000] ACPI Warning (tbutils-0217): Incorrect checksum in table [ ^Eð] - 00, should be 50 [20070126]
[ 3.164000] ACPI Error (tbinstal-0134): Table has invalid signature [ ^Eð], must be SSDT, PSDT or OEMx [20070126]
[ 3.164000] ACPI Error (psparse-0551): Method parse/execution failed [\_PR_.CPU1._PDC] (Node df826180), AE_BAD_SIGNATURE
[ 3.164000] ACPI: Processor [CPU1] (supports 8 throttling states)
[ 3.256000] ACPI Warning (tbutils-0217): Incorrect checksum in table [ ^Eð] - 00, should be 50 [20070126]
[ 3.256000] ACPI Error (tbinstal-0134): Table has invalid signature [ ^Eð], must be SSDT, PSDT or OEMx [20070126]
[ 3.256000] ACPI Error (psparse-0551): Method parse/execution failed [\_PR_.CPU2._PDC] (Node df826240), AE_BAD_SIGNATURE
[ 3.256000] ACPI: Processor [CPU2] (supports 8 throttling states)
[ 3.256000] ACPI Exception (processor_core-0783): AE_NOT_FOUND, Processor Device is not present [20070126]
[ 3.256000] ACPI Exception (processor_core-0783): AE_NOT_FOUND, Processor Device is not present [20070126]
--------------------------------

Hi, I got something very similar.
At boot The mount failed and fsck failed too.
On running fsck mannually, it was trying to relocate group 282's inode bitmap when this happened.
I got the line number as being 628 for the bug.
I run Kubuntu and until recently had received automatic updates so my kernel should be recent.
I was having problems with the OS well before this, so I'm not sure where the fault lies.
In the same log, I also had:
"BUG: schecduling while atomic@ fcsk.ext3/0x00000001/4165".
Hope that helps

In the past week I've had this same error message twice, while using Firefox.

The first time, Firefox froze, then gnome-panel crashed, then Compiz crashed. I killed X with Control-Alt-Delete. The virtual terminals printed information which looks like the same sort of thing ("call trace", libraries and what look like memory addresses) as in the original bug report. Finally, I had a kernel panic message... sorry I can't remember it precisely, but it was something like "Kernel Panic: Sync failed - tried to kill init!".

The same problem happened again with me just now. Firefox froze. I force-quit it straight away, but the Compiz animation froze half-way through. X froze as well, but I was able to force an emergency sync before I rebooted. The only error message printed to the kernel log was "Feb 16 22:01:24 chris-desktop kernel: [15332.295773] Eeek! page_mapcount(page) went negative! (-1)". That is also the only error printed to the syslog. I have just found the messages from the first time it happened 2 days ago; these are attached.

I know that the first time I was running Firefox and Pidgin. The second time I know I was running Firefox and Kdenlive, which had been killing the X server earlier. I might have been running Kdenlive the first time as well, and I might've been running Pidgin the second time.

The major oddity of my system is that I don't have any swap, but it has been running fine for 1.5 months since I built it. It passed Memtest86 a month ago. The only hardware or software change I have made recently is that I set up Gnome so that when I press the power button on my tower, it shuts down (rather than the default action of "ask").

Running Ubuntu Gutsy, with kernel 2.6.22-14.46 generic on 32-bit x86 with SMP in use.

I just had this happen while running MythTV with the 2.6.22-14.52 generic kernel, 32-bit x86, SMP in use (Athlon 64 X2 3800+, pcHDTV HD-5500, Abit AN-M2 mobo). Other than an ACPI temperature issue [1] that forces me to run with acpi=off, the system has been otherwise stable.

Fortunately, the Daytona 500 was in a caution period when the system crashed. :)

[1] ACPI occasionally reports wacky CPU temperature values that are *not* corroborated by lm_sensors, nor by a dumb temperature gauge with a probe in the CPU heat sink.

Russ Price: You've got an Athlon X2, I've got a Core 2 Duo; yet we both have wacky CPU temperatures. Mine is reporting that it is 11 degrees C. On a really hot day, when I'm video encoding without the air con turned on, the CPU gets up to a whopping 17 degrees celcius. Or, at least, I assume that's the incorrect temperature; the room temp is 40 degrees C and the system temp is 31 degrees.

I don't know quite how, but there could be a link.

Actually, I suspect my ACPI temperature problem is a BIOS bug. I just found a new BIOS revision for my motherboard, and I'm trying it now - it may be a couple of days before I find out for sure if the new BIOS fixes it. In my case, the bad readings come at random times, sometimes for a few seconds, and sometimes long enough to force a system shutdown - but lm_sensors always reports sensible temperatures. At worst, the bad ACPI temperature readings force system shutdowns, and I can use acpi=off as a workaround.

The page_mapcount problem is far worse, as it causes a crash. I've only seen it once so far.

Correction on the CPU type: my system is using a 4800+, not a 3800+.

Beginning with the Hardy Heron 8.04 development cycle, all open Ubuntu kernel bugs need to be reported against the "linux" kernel package. We are automatically migrating this bug to the new "linux" package. However, development has already began for the upcoming Intrepid Ibex 8.10 release. It would be helpful if you could test the upcoming release and verify if this is still an issue - http://www.ubuntu.com/testing . If the issue still exists, please update this report by changing the Status of the "linux" task from "Incomplete" to "New". We appreciate your patience and understanding as we make this transition. Thanks!

The Ubuntu Kernel Team is planning to move to the 2.6.27 kernel for the upcoming Intrepid Ibex 8.10 release. As a result, the kernel team would appreciate it if you could please test this newer 2.6.27 Ubuntu kernel. There are one of two ways you should be able to test:

1) If you are comfortable installing packages on your own, the linux-image-2.6.27-* package is currently available for you to install and test.

--or--

2) The upcoming Alpha5 for Intrepid Ibex 8.10 will contain this newer 2.6.27 Ubuntu kernel. Alpha5 is set to be released Thursday Sept 4. Please watch http://www.ubuntu.com/testing for Alpha5 to be announced. You should then be able to test via a LiveCD.

Please let us know immediately if this newer 2.6.27 kernel resolves the bug reported here or if the issue remains. More importantly, please open a new bug report for each new bug/regression introduced by the 2.6.27 kernel and tag the bug report with 'linux-2.6.27'. Also, please specifically note if the issue does or does not appear in the 2.6.26 kernel. Thanks again, we really appreicate your help and feedback.

Per a decision made by the Ubuntu Kernel Team, bugs will longer be assigned to the ubuntu-kernel-team in Launchpad as part of the bug triage process. The ubuntu-kernel-team is being unassigned from this bug report. Refer to https://wiki.ubuntu.com/KernelTeamBugPolicies for more information. Thanks.