[Ocfs2-devel] NULL pointer dereference in __ocfs2_claim_clusters

[David Weber <wb@munzinger.de>]

Hi,

we are currently trying to use OCFS2 in Linux 3.11.0-rc3 as a VM storage.

When we try to discard free blocks from inside the guest we get a NULL Pointer 
dereference on the host:
[ 3452.936566] BUG: unable to handle kernel NULL pointer dereference at 
0000000000000020
[ 3452.937042] IP: [<ffffffffa00eb250>] 
ocfs2_duplicate_clusters_by_page+0x26/0x3cb [ocfs2]
[ 3452.937535] PGD 0 
[ 3452.937655] Oops: 0000 [#1] SMP 
[ 3452.937853] Modules linked in: vhost_net vhost tun drbd ebtable_nat 
ebtables ocfs2_stack_o2cb bridge stp llc kvm_intel kvm lru_cache dlm sctp 
libcrc32c ocfs2_dlm ocfs2_dlmfs ocfs2 ocfs2_stackglue ocfs2_nodemanager 
configfs igb [last unloaded: drbd]
[ 3452.939281] CPU: 0 PID: 3247 Comm: qemu-system-x86 Tainted: G          I  
3.11.0-rc3 #1
[ 3452.939754] Hardware name: Supermicro X8DTU/X8DTU, BIOS 1.0c    07/24/2009
[ 3452.940159] task: ffff88079df02620 ti: ffff88079162a000 task.ti: ffff88079162a000
[ 3452.940601] RIP: 0010:[<ffffffffa00eb250>]  [<ffffffffa00eb250>] 
ocfs2_duplicate_clusters_by_page+0x26/0x3cb [ocfs2]
[ 3452.941232] RSP: 0018:ffff88079162b9d8  EFLAGS: 00010296
[ 3452.941542] RAX: 00000000007e0101 RBX: ffff88079dd735c0 RCX: 000000000001f8b7
[ 3452.941965] RDX: 0000000000000026 RSI: 0000000000000000 RDI: ffff88079be98030
[ 3452.942389] RBP: ffff88079162ba68 R08: 000000000001ad0a R09: 0000000000000001
[ 3452.942836] R10: f84eb5df22f96c02 R11: 0000000000000000 R12: 
0000000000000001
[ 3452.943266] R13: 000000000001f8b7 R14: 0000000000000026 R15: 
0000000000000001
[ 3452.943687] FS:  00007f304b7fe700(0000) GS:ffff8807bfc00000(0000) 
knlGS:0000000000000000
[ 3452.944164] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 3452.944500] CR2: 0000000000000020 CR3: 000000079171a000 CR4: 
00000000000027e0
[ 3452.944920] Stack:
[ 3452.945032]  ffff88079162bb80 ffff88079162bb84 ffff88079162ba68 ffffffffa00fd4bc
[ 3452.945485]  0000000000000000 ffff88079d3f6000 ffff88079be98030 ffff88079bfd1ed8
[ 3452.945936]  000000000001f8b7 000000000001ad0a 0000000000000000 
0000000000000000
[ 3452.946388] Call Trace:
[ 3452.946535]  [<ffffffffa00fd4bc>] ? __ocfs2_claim_clusters+0x1f7/0x325 [ocfs2]
[ 3452.946967]  [<ffffffffa00ee0bf>] ocfs2_replace_cow+0x3f0/0xe18 [ocfs2]
[ 3452.947364]  [<ffffffffa00ef026>] ocfs2_refcount_cow+0x53f/0x668 [ocfs2]
[ 3452.947764]  [<ffffffffa00c921f>] ocfs2_cow_file_pos+0x11c/0x123 [ocfs2]
[ 3452.948164]  [<ffffffffa00c992f>] ocfs2_remove_inode_range+0xc6/0xd5b [ocfs2]
[ 3452.948593]  [<ffffffffa00d30ce>] ? ocfs2_read_inode_block_full+0x36/0x55 
[ocfs2]
[ 3452.949040]  [<ffffffffa00c3c89>] ? ocfs2_inode_lock_full_nested+0x515/0xaa8 
[ocfs2]
[ 3452.949503]  [<ffffffffa00d6ada>] ? ocfs2_extend_trans+0x1f9/0x1f9 [ocfs2]
[ 3452.949914]  [<ffffffffa00cbee1>] __ocfs2_change_file_space+0x3d0/0xaa3 [ocfs2]
[ 3452.950354]  [<ffffffffa00cc624>] ocfs2_fallocate+0x70/0x74 [ocfs2]
[ 3452.950727]  [<ffffffff8113b11b>] do_fallocate+0x106/0x14d
[ 3452.951050]  [<ffffffff8113b1a9>] SyS_fallocate+0x47/0x6b
[ 3452.951368]  [<ffffffff81664e12>] system_call_fastpath+0x16/0x1b
[ 3452.951720] Code: ff 0f 0b 0f 0b 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 
83 ec 68 48 89 7d a0 48 89 75 90 41 89 d6 89 4d b0 44 89 45 b8 45 89 cf <48> 
8b 46 20 48 89 45 98 48 89 c7 48 83 ef 48 e8 78 8e 02 00 49 
[ 3452.953241] RIP  [<ffffffffa00eb250>] 
ocfs2_duplicate_clusters_by_page+0x26/0x3cb [ocfs2]
[ 3452.953729]  RSP <ffff88079162b9d8>
[ 3452.953931] CR2: 0000000000000020
[ 3453.019391] ---[ end trace 08f73908d0d596c1 ]---

The filesystem was created with:
mkfs.ocfs2 -b 4K -C 1M -J block64 -L kvm-images -T vmstore /dev/drbd0

alice ocfs2 # gdb suballoc.o 
GNU gdb (Gentoo 7.5.1 p2) 7.5.1
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.gentoo.org/>...
Reading symbols from /usr/src/linux-3.11-rc3/fs/ocfs2/suballoc.o...done.
(gdb) list  *(__ocfs2_claim_clusters+0x1f7)
0x40bc is in __ocfs2_claim_clusters (fs/ocfs2/suballoc.c:2306).
2301                   && ac->ac_which != OCFS2_AC_USE_MAIN);
2302
2303            if (ac->ac_which == OCFS2_AC_USE_LOCAL) {
2304                    WARN_ON(min_clusters > 1);
2305
2306                    status = ocfs2_claim_local_alloc_bits(osb,
2307                                                          handle,
2308                                                          ac,
2309                                                          bits_wanted,
2310                                                          cluster_start,

Qemu version: 1.5.2
Guest OS: Ubuntu 13.10 snapshot (Linux 3.10)
Guest filesystem: ext4
Command run on the guest: 'fstrim -v /'

The disk configuration in libvirt looks like this:
    <disk type='file' device='disk'>
      <driver name='qemu' type='raw' cache='none' discard='unmap'/>
      <source file='/mnt/kvm-images/ubuntu2.img'/>
      <target dev='sda' bus='scsi'/>
      <address type='drive' controller='0' bus='0' target='0' unit='0'/>
    </disk>

and maps to such a qemu command line

-device virtio-scsi-pci,id=scsi0,bus=pci.0,addr=0x4 -drive file=/mnt/kvm-
images/ubuntu2.img,if=none,id=drive-
scsi0-0-0-0,format=raw,cache=none,discard=unmap -device scsi-
hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-
scsi0-0-0-0,id=scsi0-0-0-0,bootindex=1

Thanks in advance!

Cheers,
David