Hi, The metadata block reservation counter overflows with data write on ext4 (indirect block map) when its disk space is almost full. This overflow triggers following BUG_ON. Jan 14 09:36:48 TNESG9423 kernel: ------------[ cut here ]------------ Jan 14 09:36:48 TNESG9423 kernel: kernel BUG at fs/ext4/inode.c:2170! Jan 14 09:36:48 TNESG9423 kernel: invalid opcode: 0000 [#1] SMP Jan 14 09:36:48 TNESG9423 kernel: last sysfs file: /sys/kernel/mm/ksm/run Jan 14 09:36:48 TNESG9423 kernel: CPU 0 Jan 14 09:36:48 TNESG9423 kernel: Modules linked in: ip6table_filter ip6_tables ebtable_nat ebtables xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ipt_REJECT bridge stp llc autofs4 sunrpc p4_clockmod freq_table speedstep_lib ipv6 xt_physdev iptable_filter ip_tables nls_utf8 dm_mirror dm_region_hash dm_log dm_mod kvm_intel kvm uinput ppdev parport_pc parport sg pcspkr i2c_i801 iTCO_wdt iTCO_vendor_support snd_hda_codec_realtek snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore snd_page_alloc e1000e ext3 jbd sd_mod crc_t10dif sr_mod cdrom pata_via pata_acpi ata_generic ata_piix i915 drm_kms_helper drm i2c_algo_bit i2c_core video output [last unloaded: mperf] Jan 14 09:36:48 TNESG9423 kernel: Jan 14 09:36:48 TNESG9423 kernel: Pid: 937, comm: flush-8:0 Not tainted 2.6.37 #1 MS-7264BLM/PC-MJ18ABZR4 Jan 14 09:36:48 TNESG9423 kernel: RIP: 0010:[] [] ext4_da_block_invalidatepages+0x168/0x180 Jan 14 09:36:48 TNESG9423 kernel: RSP: 0018:ffff88007613f780 EFLAGS: 00010246 Jan 14 09:36:48 TNESG9423 kernel: RAX: 0010000000000024 RBX: 0000000000008cf2 RCX: 000000000000000e Jan 14 09:36:48 TNESG9423 kernel: RDX: 000000000000000e RSI: 0000000000000001 RDI: ffffea0000a70d30 Jan 14 09:36:48 TNESG9423 kernel: RBP: ffff88007613f850 R08: 0000000000000001 R09: 0000000000000002 Jan 14 09:36:48 TNESG9423 kernel: R10: ffffea0000a70d38 R11: ffff880035f01b58 R12: ffff88007613f7a0 Jan 14 09:36:48 TNESG9423 kernel: R13: ffff880065eecd68 R14: ffff88007613f7b8 R15: ffffea0000a70a58 Jan 14 09:36:48 TNESG9423 kernel: FS: 0000000000000000(0000) GS:ffff88007f400000(0000) knlGS:0000000000000000 Jan 14 09:36:48 TNESG9423 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b Jan 14 09:36:48 TNESG9423 kernel: CR2: 0000003680ae1560 CR3: 000000004da45000 CR4: 00000000000006f0 Jan 14 09:36:48 TNESG9423 kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 Jan 14 09:36:48 TNESG9423 kernel: DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Jan 14 09:36:48 TNESG9423 kernel: Process flush-8:0 (pid: 937, threadinfo ffff88007613e000, task ffff8800371b54e0) Jan 14 09:36:48 TNESG9423 kernel: Stack: Jan 14 09:36:48 TNESG9423 kernel: ffff88007613f7e0 ffffffff814ee3d6 0000000000000008 0000000e7613f7f0 Jan 14 09:36:48 TNESG9423 kernel: 000000000000000e 000000003741a4b9 ffffea0000a70a58 ffffea0000a70a90 Jan 14 09:36:48 TNESG9423 kernel: ffffea0000a70ac8 ffffea0000a70b00 ffffea0000a70b38 ffffea0000a70b70 Jan 14 09:36:48 TNESG9423 kernel: Call Trace: Jan 14 09:36:48 TNESG9423 kernel: [] ? printk+0x41/0x43 Jan 14 09:36:48 TNESG9423 kernel: [] mpage_da_map_and_submit+0x274/0x470 Jan 14 09:36:48 TNESG9423 kernel: [] mpage_add_bh_to_extent+0x6d/0xf0 Jan 14 09:36:48 TNESG9423 kernel: [] write_cache_pages_da+0x2d0/0x4a0 Jan 14 09:36:48 TNESG9423 kernel: [] ext4_da_writepages+0x2dc/0x650 Jan 14 09:36:48 TNESG9423 kernel: [] do_writepages+0x21/0x40 Jan 14 09:36:48 TNESG9423 kernel: [] __filemap_fdatawrite_range+0x5b/0x60 Jan 14 09:36:48 TNESG9423 kernel: [] filemap_fdatawrite_range+0x13/0x20 Jan 14 09:36:48 TNESG9423 kernel: [] jbd2_journal_begin_ordered_truncate+0x8e/0xb0 Jan 14 09:36:48 TNESG9423 kernel: [] ext4_evict_inode+0x23b/0x3b0 Jan 14 09:36:48 TNESG9423 kernel: [] evict+0x27/0xc0 Jan 14 09:36:48 TNESG9423 kernel: [] iput+0x1bb/0x2a0 Jan 14 09:36:48 TNESG9423 kernel: [] writeback_sb_inodes+0x104/0x180 Jan 14 09:36:48 TNESG9423 kernel: [] writeback_inodes_wb+0x9d/0x160 Jan 14 09:36:48 TNESG9423 kernel: [] wb_writeback+0x28b/0x400 Jan 14 09:36:48 TNESG9423 kernel: [] ? lock_timer_base+0x3c/0x70 Jan 14 09:36:48 TNESG9423 kernel: [] ? del_timer_sync+0x22/0x30 Jan 14 09:36:48 TNESG9423 kernel: [] wb_do_writeback+0x97/0x1e0 Jan 14 09:36:48 TNESG9423 kernel: [] bdi_writeback_thread+0xb2/0x270 Jan 14 09:36:48 TNESG9423 kernel: [] ? bdi_writeback_thread+0x0/0x270 Jan 14 09:36:48 TNESG9423 kernel: [] ? bdi_writeback_thread+0x0/0x270 Jan 14 09:36:48 TNESG9423 kernel: [] kthread+0x96/0xa0 Jan 14 09:36:48 TNESG9423 kernel: [] kernel_thread_helper+0x4/0x10 Jan 14 09:36:48 TNESG9423 kernel: [] ? kthread+0x0/0xa0 Jan 14 09:36:48 TNESG9423 kernel: [] ? kernel_thread_helper+0x0/0x10 Jan 14 09:36:48 TNESG9423 kernel: Code: a8 00 00 00 5b 41 5c 41 5d 41 5e 41 5f c9 c3 0f 1f 40 00 4c 89 e7 48 89 95 40 ff ff ff e8 01 1b f4 ff 48 8b 95 40 ff ff ff eb c9 <0f> 0b eb fe 0f 0b 66 90 eb fc 66 66 66 66 66 2e 0f 1f 84 00 00 Jan 14 09:36:48 TNESG9423 kernel: RIP [] ext4_da_block_invalidatepages+0x168/0x180 Jan 14 09:36:48 TNESG9423 kernel: RSP Jan 14 09:36:48 TNESG9423 kernel: ---[ end trace 0496eaed3b9ec629 ]--- To fix this, I referred to the patch which is for data blocks reservation counter (commit: ef627929781c98113e6ae93f159dd3c12a884ad8) and made a following patch which prints metadata block inconsistency and corrects it. My patch is trial, if you have better idea, feel free to fix this bug. # You can reproduce this problem with attached programs. # In my environment, this occurs in 1 minute. Signed-off-by: Akira Fujita --- fs/ext4/inode.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff -Nrup -X linux-2.6.37-org/Documentation/dontdiff linux-2.6.37-org/fs/ext4/inode.c linux-2.6.37/fs/ext4/inode.c --- linux-2.6.37-org/fs/ext4/inode.c 2011-01-17 15:47:59.000000000 +0900 +++ linux-2.6.37/fs/ext4/inode.c 2011-01-17 15:52:25.000000000 +0900 @@ -1127,6 +1127,16 @@ void ext4_da_update_reserve_space(struct used = ei->i_reserved_data_blocks; } + if (unlikely(ei->i_allocated_meta_blocks > + ei->i_reserved_meta_blocks)) { + ext4_msg(inode->i_sb, KERN_NOTICE, "%s: ino %lu, " + "meta blocks %d with only %d reserved meta blocks\n", + __func__, inode->i_ino, ei->i_allocated_meta_blocks, + ei->i_reserved_meta_blocks); + WARN_ON(1); + ei->i_allocated_meta_blocks = ei->i_reserved_meta_blocks; + } + /* Update per-inode reservations */ ei->i_reserved_data_blocks -= used; ei->i_reserved_meta_blocks -= ei->i_allocated_meta_blocks;