From: Andrew Morton <akpm@linux-foundation.org>
To: linux-btrfs@vger.kernel.org
Cc: bugzilla-daemon@bugzilla.kernel.org,
bugme-daemon@bugzilla.kernel.org, fox@murder.cz
Subject: Re: [Bugme-new] [Bug 29302] New: Null pointer dereference with large max_sectors_kb
Date: Thu, 17 Feb 2011 15:37:19 -0800 [thread overview]
Message-ID: <20110217153719.9ecc67df.akpm@linux-foundation.org> (raw)
In-Reply-To: <bug-29302-10286@https.bugzilla.kernel.org/>
(switched to email. Please respond via emailed reply-to-all, not via the
bugzilla web interface).
On Thu, 17 Feb 2011 13:20:20 GMT
bugzilla-daemon@bugzilla.kernel.org wrote:
> https://bugzilla.kernel.org/show_bug.cgi?id=29302
>
> Summary: Null pointer dereference with large max_sectors_kb
> Product: IO/Storage
> Version: 2.5
> Kernel Version: 2.6.36 - 2.6.38-rc5
> Platform: All
> OS/Version: Linux
> Tree: Mainline
> Status: NEW
> Severity: normal
> Priority: P1
> Component: Block Layer
> AssignedTo: axboe@kernel.dk
> ReportedBy: fox@murder.cz
> Regression: No
>
>
> Created an attachment (id=48132)
> --> (https://bugzilla.kernel.org/attachment.cgi?id=48132)
> dmesg with error displayed.
>
> Hello,
> I'm not really sure I identified the problem product/component correctly, but
> this seems most appropriate.
>
>
> [140517]stg-bot ~ # echo 256 > /sys/block/sdb/queue/max_sectors_kb
> [140523]stg-bot ~ # mkfs.btrfs /dev/sdb
>
> WARNING! - Btrfs Btrfs v0.19 IS EXPERIMENTAL
> WARNING! - see http://btrfs.wiki.kernel.org before using
>
> fs created label (null) on /dev/sdb
> nodesize 4096 leafsize 4096 sectorsize 4096 size 2.73TB
> Btrfs Btrfs v0.19
> [140532]stg-bot ~ # mount /dev/sdb /mnt
> [140540]stg-bot ~ # umount /mnt
> [140543]stg-bot ~ # cat /sys/block/sdb/queue/max_hw_sectors_kb >
> /sys/block/sdb/queue/max_sectors_kb
> [140710]stg-bot ~ # mkfs.btrfs /dev/sdb
>
> WARNING! - Btrfs Btrfs v0.19 IS EXPERIMENTAL
> WARNING! - see http://btrfs.wiki.kernel.org before using
>
> fs created label (null) on /dev/sdb
> nodesize 4096 leafsize 4096 sectorsize 4096 size 2.73TB
> Btrfs Btrfs v0.19
> [140713]stg-bot ~ # mount /dev/sdb /mnt
> Killed
> [140715]stg-bot ~ #
>
> Now there is a bug in dmesg (output attached) and another attempt to mount the
> device kind of freezes it. The mount blocks, sync blocks, but i can read/write
> the device using dd. And if I, instead of trying to mount again, zero out first
> 1MB, mkfs.btrfs and mount, I get the bug again. Freeze again on second mount
> attempt after that.
>
> This happens on 2.6.36 and 2.6.37 with scst patches, 2.6.37 vanilla and on
> 2.6.38-rc5 it just freezes the first time I try to mount. No outuput in dmesg.
>
> The hardware is Dual Xeon E5620, 12GB ram, Areca 1880 with 3 arrays (testing on
> 3TB raid10 and 10TB raid6), SuperMicro X8DTU-F.
>
> If I left out any important info, please let me know ;).
>
A btrfs bug, I suspect.
> [ 605.109630] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
> [ 605.109928] IP: [<ffffffff81100a7a>] bio_add_page+0xa/0x40
> [ 605.110089] PGD 277d70067 PUD 277e0a067 PMD 0
> [ 605.110247] Oops: 0000 [#1] SMP
> [ 605.110394] last sysfs file: /sys/devices/system/cpu/cpu15/cache/index2/shared_cpu_map
> [ 605.110686] CPU 6
> [ 605.110698] Modules linked in: ip6table_filter ip6_tables nf_nat_tftp nf_nat_sip nf_nat_pptp nf_nat_proto_gre nf_nat_irc nf_nat_h323 nf_nat_ftp nf_nat_amanda nf_conntrack_amanda nf_conntrack_tftp nf_conntrack_sip nf_conntrack_proto_sctp nf_conntrack_pptp nf_conntrack_proto_gre nf_conntrack_netlink nf_conntrack_netbios_ns nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp xt_physdev xt_hashlimit nfs ib_iser libiscsi scsi_transport_iscsi ib_ucm ib_ipoib rdma_ucm rdma_cm ib_cm iw_cm ib_sa ib_addr ib_uverbs ib_umad mlx4_ib ib_mthca ib_mad ib_core i7core_edac edac_core mlx4_core iTCO_wdt iTCO_vendor_support
> [ 605.112285]
> [ 605.112419] Pid: 16666, comm: mount Not tainted 2.6.37stg #6 X8DTU/X8DTU
> [ 605.112586] RIP: 0010:[<ffffffff81100a7a>] [<ffffffff81100a7a>] bio_add_page+0xa/0x40
> [ 605.112879] RSP: 0000:ffff8801833b39b8 EFLAGS: 00010296
> [ 605.113035] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> [ 605.113207] RDX: 0000000000001000 RSI: ffffea000c3cd200 RDI: 0000000000000000
> [ 605.113382] RBP: ffff8801833b3ba0 R08: 0000000000000000 R09: 0000000000000000
> [ 605.113554] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
> [ 605.113723] R13: 0000000000000000 R14: 000000000000a000 R15: ffff88024a19ab98
> [ 605.113895] FS: 00007fbcfd971740(0000) GS:ffff880339c80000(0000) knlGS:0000000000000000
> [ 605.114188] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 605.114352] CR2: 0000000000000010 CR3: 00000001c17d5000 CR4: 00000000000006e0
> [ 605.114525] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 605.114695] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> [ 605.114864] Process mount (pid: 16666, threadinfo ffff8801833b2000, task ffff8801b8b48cf0)
> [ 605.115157] Stack:
> [ 605.115290] 0000000000000000 ffffffff81251384 0000000001400000 ffffea000c3cd200
> [ 605.115590] 0000000000000000 000000004a19ab88 ffff8801b966f380 0000100000000000
> [ 605.115884] ffffffff81255810 0000000000000000 0000000000000002 0000000001400000
> [ 605.116180] Call Trace:
> [ 605.116320] [<ffffffff81251384>] ? submit_extent_page+0x164/0x280
> [ 605.116488] [<ffffffff81255810>] ? end_bio_extent_readpage+0x0/0x210
> [ 605.116654] [<ffffffff81257241>] ? __extent_read_full_page+0x4e1/0x680
> [ 605.116820] [<ffffffff81255810>] ? end_bio_extent_readpage+0x0/0x210
> [ 605.116990] [<ffffffff8122c260>] ? btree_get_extent+0x0/0x1e0
> [ 605.117151] [<ffffffff81257660>] ? read_extent_buffer_pages+0x280/0x3c0
> [ 605.117320] [<ffffffff812d77ec>] ? radix_tree_insert+0x1bc/0x210
> [ 605.117488] [<ffffffff8122c260>] ? btree_get_extent+0x0/0x1e0
> [ 605.117651] [<ffffffff8122e945>] ? btree_read_extent_buffer_pages+0x55/0xb0
> [ 605.117820] [<ffffffff8122ea05>] ? read_tree_block+0x35/0x60
> [ 605.117980] [<ffffffff8122ffc2>] ? open_ctree+0xd22/0x1440
> [ 605.118140] [<ffffffff812118f0>] ? btrfs_set_super+0x0/0x20
> [ 605.118300] [<ffffffff81212302>] ? btrfs_mount+0x372/0x4e0
> [ 605.118465] [<ffffffff810d7c85>] ? vfs_kern_mount+0x75/0x1b0
> [ 605.118627] [<ffffffff810ee19e>] ? get_fs_type+0x3e/0xd0
> [ 605.118783] [<ffffffff810d7e33>] ? do_kern_mount+0x53/0x130
> [ 605.118942] [<ffffffff810f15b9>] ? do_mount+0x2d9/0x840
> [ 605.119100] [<ffffffff810ab7eb>] ? memdup_user+0x3b/0x80
> [ 605.119257] [<ffffffff810f1bba>] ? sys_mount+0x9a/0x100
> [ 605.119417] [<ffffffff81002d7b>] ? system_call_fastpath+0x16/0x1b
> [ 605.119579] Code: ff ff ff 44 29 e2 31 c0 41 89 57 08 e9 7b fe ff ff 48 83 63 18 f7 e9 44 ff ff ff 66 0f 1f 44 00 00 48 83 ec 08 48 89 f8 41 89 c8 <48> 8b 4f 10 48 8b 89 98 00 00 00 48 8b b9 f0 01 00 00 89 d1 44
> [ 605.120217] RIP [<ffffffff81100a7a>] bio_add_page+0xa/0x40
> [ 605.120384] RSP <ffff8801833b39b8>
> [ 605.120527] CR2: 0000000000000010
> [ 605.121058] ---[ end trace a5eba365422d1ba8 ]---
next parent reply other threads:[~2011-02-17 23:37 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <bug-29302-10286@https.bugzilla.kernel.org/>
2011-02-17 23:37 ` Andrew Morton [this message]
2011-02-18 17:43 ` [Bugme-new] [Bug 29302] New: Null pointer dereference with large max_sectors_kb David Sterba
2011-02-18 19:16 ` Chris Mason
2011-02-18 19:56 ` Andrew Morton
2011-02-18 20:18 ` Chris Mason
2011-02-20 11:06 ` Tomas Zvala
2011-02-21 15:08 ` Chris Mason
2011-02-28 12:26 ` Tomas Zvala
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110217153719.9ecc67df.akpm@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=bugme-daemon@bugzilla.kernel.org \
--cc=bugzilla-daemon@bugzilla.kernel.org \
--cc=fox@murder.cz \
--cc=linux-btrfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.