All of lore.kernel.org
 help / color / mirror / Atom feed
* jffs2 oops
@ 2011-06-20 11:58 Nikolai Zhubr
  0 siblings, 0 replies; 4+ messages in thread
From: Nikolai Zhubr @ 2011-06-20 11:58 UTC (permalink / raw)
  To: linux-kernel

Hello people,

I'm getting an oops in (or closely related to) JFFS2 filesystem in 
stable kernel 2.6.36.4 on ARM with real MTD memory and also in some 
2.6.34-12-desktop (opensuse 11.3) kernel on x86_64 with mtdram emulator.

The oops is fully reproducible and happens immediately on mount attempt. 
I think, the data was not even subject to sudden power failure or any 
such event. Just upon normal reboot it failed to mount.

The image (300Kb) can be found here:
http://n-a-zhubr.narod.ru/openwrt/jffs2oops.img.gz
(hopefully the link works for all, otherwise I can email it personally)
Note: the size of erase block is (intensionally) 256K, not 64.

Please CC me, I'm not subscribed.
Thank you.
Nikolai ZHUBR
===================================================================
JFFS2 error: (233) jffs2_link_node_ref: Adding new ref c59eaeec at 
(0x00000000-0x00000034) not immediately after previous 
(0x00000000-0x00000000)
kernel BUG at fs/jffs2/nodelist.c:644!
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c59ec000
[00000000] *pgd=059e8031, *pte=00000000, *ppte=00000000
Internal error: Oops: 817 [#1]
last sysfs file: /sys/kernel/uevent_seqnum
Modules linked in:
CPU: 0    Not tainted  (2.6.36.4 #50)

2.6.34-12-desktop:
kernel:[ 1192.811506] ------------[ cut here ]------------
kernel:[ 1192.811512] invalid opcode: 0000 [#1] PREEMPT SMP
kernel:[ 1192.811515] last sysfs file: /sys/devices/virtual/bdi/31:0/uevent
kernel:[ 1192.811628] Stack:
kernel:[ 1192.811640] Call Trace:
kernel:[ 1192.811805] Code: 8b b6 b0 02 00 00 41 83 e0 fc 46 8d 0c 01 48 
89 d9 83 e2 fc 01 d0 89 14 24 48 c7 c2 50 4f aa a0 89 44 24 08 31 c0 e8 
9e d7 a0 e0 <0f> 0b 0f 0b 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec 08

^ permalink raw reply	[flat|nested] 4+ messages in thread
* jffs2 oops
@ 2011-08-14 14:49 troy_ct
  0 siblings, 0 replies; 4+ messages in thread
From: troy_ct @ 2011-08-14 14:49 UTC (permalink / raw)
  To: linux-mtd


[-- Attachment #1.1: Type: text/plain, Size: 692 bytes --]

Hi,

I did a test like this(smp system):
mount -t jffs2 /dev/mtdblock1 /mnt
mount -t jffs2 /dev/mtdblock2 /tmp
Then I write data to /mnt/file1, /tmp/file2 simultaneously, It's very often to see
a oops says 'comprbuf is NULL in ./fs/jffs2/write.c, line 376'.

In the jffs2 file system menuconfig, I enable the option 'Advanced compression option for JFFS2'.
It turns out that thread A malloc and use the buffer in the jffs2_compressor_list,  at the same time thread B can also use the
same buffer because of spin_unlock(&jffs2_compressor_list_lock).
Thread B get the best buffer pointer and change the best pointer to NULL.  Thread A's best buffer pointer became NULL too, so oops happens.




[-- Attachment #1.2: Type: text/html, Size: 1061 bytes --]

[-- Attachment #2: 0001-jffs2-fix-bug-of-jffs2_compressor_list-s-race-condit.patch --]
[-- Type: application/octet-stream, Size: 1503 bytes --]

From d89804349bc8a73f7c22545ec696051e75d6ab4f Mon Sep 17 00:00:00 2001
From: troy_ct <troy_ct@163.com>
Date: Sun, 3 Jul 2011 01:27:14 +0800
Subject: [PATCH] jffs2: fix bug of jffs2_compressor_list's race condition

When we use JFFS2_COMPR_MODE_FAVOURLZO mode for jffs2, there
are race condition of jffs2_compressor_list, and buffers in the
list. This patch fixs it.

Signed-off-by: troy_ct <troy_ct@163.com>
---
 fs/jffs2/compr.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/fs/jffs2/compr.c b/fs/jffs2/compr.c
index de42470..bd97221 100644
--- a/fs/jffs2/compr.c
+++ b/fs/jffs2/compr.c
@@ -19,6 +19,8 @@ static DEFINE_SPINLOCK(jffs2_compressor_list_lock);
 /* Available compressors are on this list */
 static LIST_HEAD(jffs2_compressor_list);
 
+static DEFINE_MUTEX(compre_mutex);
+
 /* Actual compression mode */
 static int jffs2_compression_mode = JFFS2_COMPR_MODE_PRIORITY;
 
@@ -120,6 +122,7 @@ uint16_t jffs2_compress(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
 		break;
 	case JFFS2_COMPR_MODE_SIZE:
 	case JFFS2_COMPR_MODE_FAVOURLZO:
+		mutex_lock(&compre_mutex);
 		orig_slen = *datalen;
 		orig_dlen = *cdatalen;
 		spin_lock(&jffs2_compressor_list_lock);
@@ -176,6 +179,7 @@ uint16_t jffs2_compress(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
 			ret = best->compr;
 		}
 		spin_unlock(&jffs2_compressor_list_lock);
+		mutex_unlock(&compre_mutex);
 		break;
 	default:
 		printk(KERN_ERR "JFFS2: unknown compression mode.\n");
-- 
1.7.4.2


^ permalink raw reply related	[flat|nested] 4+ messages in thread
* JFFS2 oops
@ 2011-06-28 22:26 Nikolai Zhubr
  0 siblings, 0 replies; 4+ messages in thread
From: Nikolai Zhubr @ 2011-06-28 22:26 UTC (permalink / raw)
  To: linux-mtd

Hello people,

I'm getting an oops in (or related to) JFFS2 filesystem in stock kernel 
2.6.36.4 on ARM with a real MTD memory and I've found that it also 
happens on x86_64 opensuse 11.3 kernel 2.6.34-12-desktop with mtdram 
simulator if 256K erase-block size is specified.

The oops is fully reproducible and happens immediately on mount attempt. 
I think, the data was not even subject to sudden power failure or any 
such event. Just upon normal reboot it failed to mount.
Some logs are attached below.

The image (300Kb) causing this oops can be found here:
http://n-a-zhubr.narod.ru/openwrt/jffs2oops.img.gz
(hopefully the link works for all, otherwise I can email it personally 
to whoever is interested)
The size of erase block is set to 256K because my device of interest 
does have it this way.

Please CC me, I'm not subscribed.
Thank you.
Nikolai ZHUBR
===================================================================
JFFS2 error: (233) jffs2_link_node_ref: Adding new ref c59eaeec at 
(0x00000000-0x00000034) not immediately after previous 
(0x00000000-0x00000000)
kernel BUG at fs/jffs2/nodelist.c:644!
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c59ec000
[00000000] *pgd=059e8031, *pte=00000000, *ppte=00000000
Internal error: Oops: 817 [#1]
last sysfs file: /sys/kernel/uevent_seqnum
Modules linked in:
CPU: 0    Not tainted  (2.6.36.4 #50)
===================================================================
2.6.34-12-desktop:
kernel:[ 1192.811506] ------------[ cut here ]------------
kernel:[ 1192.811512] invalid opcode: 0000 [#1] PREEMPT SMP
kernel:[ 1192.811515] last sysfs file: /sys/devices/virtual/bdi/31:0/uevent
kernel:[ 1192.811628] Stack:
kernel:[ 1192.811640] Call Trace:
kernel:[ 1192.811805] Code: 8b b6 b0 02 00 00 41 83 e0 fc 46 8d 0c 01 48 
89 d9 83 e2 fc 01 d0 89 14 24 48 c7 c2 50 4f aa a0 89 44 24 08 31 c0 e8 
9e d7 a0 e0 <0f> 0b 0f 0b 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 48 83 
ec 08

^ permalink raw reply	[flat|nested] 4+ messages in thread
[parent not found: <20061006163319.GA15689@flint.arm.linux.org.uk>]
end of thread, other threads:[~2011-08-14 14:50 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-06-20 11:58 jffs2 oops Nikolai Zhubr
  -- strict thread matches above, loose matches on Subject: below --
2011-08-14 14:49 troy_ct
2011-06-28 22:26 JFFS2 oops Nikolai Zhubr
     [not found] <20061006163319.GA15689@flint.arm.linux.org.uk>
2006-10-06 18:52 ` Jffs2 Oops z l

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.