Re: [PATCH] SGI 882960: Busy inodes after unmount, oops

[Greg Banks <gnb@melbourne.sgi.com>]

[-- Attachment #1: Type: text/plain, Size: 1813 bytes --]

Olaf Kirch wrote:
> 
> Hi Greg,
> 
> On Thu, Feb 05, 2004 at 09:41:32AM +1100, Greg Banks wrote:
> > BTW (not directly related to this bug) I found by experiment that I
> > could umount an NFS mount when there were open file descriptors for
> > unlinked files in the mount,[...]
> 
> Then something else must be wrong big time.

Yes, I found that a surprising behaviour.

> > >  -      __rpc_execute notices the task is dead (no tk_action),
> > >         leaves the loop and invokes task->tk_exit == nfs_async_unlink_done
> >
> > No.  In a crash dump taken after the umount has completed, the dir dentry has
> > 1 leaked d_count for every async unlink present at umount, even though the
> > async unlink tasks have been cleaned up.  This indicates that task->tk_exit
> > is not being called but task->tk_release is, so the dput is not happening.
> 
> But then prune_dcache shouldn't touch these dentries at all, because their
> refcount is still 1. They would be leaked, but there would be no crash.

That makes sense.  I'll go back and recheck my forensics.

> > It's not entirely clear to me how __rpc_execute can do that, but the evidence
> > is that it does so.
> 
> Very strange... maybe we have a refcounting problem elsewhere, and the
> refcount was 2 before calling tk_exit? But somehow I doubt this... I
> think we'd see far more massive problems in this case.
> 
> Would you share your test case?

Sure, attached is a C program and a shell script wrapper.  You need to
adjust $SERVER and possibly $UDELAY in the shell script.  Then run the
shell script and watch /var/log/messages.

The C program is fairly generic, you can use it to test the other case
(umount allowed with open file descriptors) also.

Greg.
-- 
Greg Banks, R&D Software Engineer, SGI Australian Software Group.
I don't speak for SGI.

[-- Attachment #2: fmeh.sh --]
[-- Type: application/x-sh, Size: 673 bytes --]

[-- Attachment #3: dangle.c --]
[-- Type: text/plain, Size: 1923 bytes --]

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <signal.h>
#include <string.h>
#include <fcntl.h>

struct state
{
    const char **cmd;
    int fd;
    const char *path;
};


static void
do_one_command(const char *cmd, struct state *state)
{
    if (!strcmp(cmd, "unlink"))
    {
	fprintf(stderr, "dangle: unlink\n");
	unlink(state->path);
    }
    else if (!strncmp(cmd, "write", 5))
    {
	const char *data;

	data = cmd+5;
	if (!*data)
	    data = "X";
	fprintf(stderr, "dangle: write(\"%s\")\n", data);
	write(state->fd, data, strlen(data));
    }
    else if (!strcmp(cmd, "fsync"))
    {
	fprintf(stderr, "dangle: fsync\n");
	fsync(state->fd);
    }
    else if (!strcmp(cmd, "fdatasync"))
    {
	fprintf(stderr, "dangle: fdatasync\n");
	fdatasync(state->fd);
    }
    else if (!strcmp(cmd, "sigpause"))
    {
	fprintf(stderr, "dangle: sigpause\n");
	sigpause(0);
    }
    else if (!strncmp(cmd, "loop", 4))
    {
	int i, N;

	N = atoi(cmd+4);
	fprintf(stderr, "dangle: looping, N=%d\n", N);
	state->cmd++;
	if (N == 0)
	{
	    for (;;)
		do_one_command(*state->cmd, state);
	}
	else
	{
	    for (i = 0 ; i < N ; i++)
		do_one_command(*state->cmd, state);
	}
    }
    else
    {
	fprintf(stderr, "dangle: unknown command \"%s\"\n", cmd);
	exit(1);
    }
}


static void
do_commands(struct state *state)
{
    for ( ; *state->cmd != NULL ; state->cmd++)
    {
	do_one_command(*state->cmd, state);
    }
}



int
main(int argc, char **argv)
{
    struct state state;

    if (argc < 2)
    {
	fprintf(stderr, "Usage: dangle filename [command...]\n");
	exit(1);
    }
    state.path = argv[1];
    state.cmd = (const char **)argv+2;

    fprintf(stderr, "dangle: open(\"%s\")\n", state.path);
    state.fd = open(state.path, O_RDWR|O_CREAT, 0);
    if (state.fd < 0)
    {
	perror(state.path);
	exit(1);
    }

    do_commands(&state);

    fprintf(stderr, "dangle: exiting\n");
    return 0;
}