Kernel oops when accessing to mounted, but unplugged JFS

Kernel oops when accessing to mounted, but unplugged JFS

[Alexander Kolesen]

Hello.
I've built a kernel from
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6.git
(Date:   Fri Nov 19 19:46:45 2010 -0800)
and got a kernel oops when tried to access to unplugged,
but mounted external usb storage formatted with JFS.
 
Steps to reproduce:
 mkfs.jfs /dev/sdb1 (unpluggable USB hard drive)
 mount /dev/sdb1 /mnt/drive
 cd /mnt/drive
 touch test
 sync
 ..unplug a drive
 ls
  

Result:
   BUG: unable to handle kernel NULL pointer dereference at
   0000000000000020
   IP: __mark_inode_dirty

Then I got a kernel coredump. Here is a stack trace:

(gdb) bt
#0  __mark_inode_dirty (inode=0xffff880078fc1490, flags=<value optimized out>) at fs/fs-writeback.c:990
#1  0xffffffff810e4990 in mark_inode_dirty_sync (mnt=0xffff88007862fd00, dentry=<value optimized out>) at include/linux/fs.h:1687
#2  touch_atime (mnt=0xffff88007862fd00, dentry=<value optimized out>) at fs/inode.c:1505
#3  0xffffffff810dfeb4 in file_accessed (file=0xffff88006afed600, filler=0xffffffff810dfcf8 <filldir>, buf=0xffff88007762bf38) at include/linux/fs.h:1763
#4  vfs_readdir (file=0xffff88006afed600, filler=0xffffffff810dfcf8 <filldir>, buf=0xffff88007762bf38) at fs/readdir.c:41
#5  0xffffffff810e001a in sys_getdents (fd=<value optimized out>, dirent=0x1f61468, count=32768) at fs/readdir.c:214
#6  0xffffffff810279ab in ?? () at arch/x86/kernel/entry_64.S:479
#7  0x00007f8b23d1a4c5 in ?? ()
#8  0x00000000000002bb in ?? ()
#9  0x0000000000000000 in ?? ()

(gdb) p bdi
$1 = (struct backing_dev_info *) 0x0

(gdb) p inode->i_mapping->backing_dev_info 
$15 = (struct backing_dev_info *) 0xffff880078878d48

(gdb) p inode->i_sb->s_bdi
$16 = (struct backing_dev_info *) 0x0


I can't do git bisect because on n'th step my system became unbootable. 
But 2.6.35 doesn't fall.

Re: Kernel oops when accessing to mounted, but unplugged JFS

[Andi Kleen]

Alexander Kolesen <kolesen.a@gmail.com> writes:

[Rafael, a new regression]

> Hello.
> I've built a kernel from
> git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6.git
> (Date:   Fri Nov 19 19:46:45 2010 -0800)
> and got a kernel oops when tried to access to unplugged,
> but mounted external usb storage formatted with JFS.

Al seems to be the last person who touched it, maybe it's 
related to his changes, like this one. 

commit 152a08366671080f27b32e0c411ad620c5f88b57
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Sun Jul 25 00:46:55 2010 +0400

    new helper: mount_bdev()

    ... and switch of the obvious get_sb_bdev() users to ->mount()

    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>


>  
> Steps to reproduce:
>  mkfs.jfs /dev/sdb1 (unpluggable USB hard drive)
>  mount /dev/sdb1 /mnt/drive
>  cd /mnt/drive
>  touch test
>  sync
>  ..unplug a drive
>  ls
>   
>
> Result:
>    BUG: unable to handle kernel NULL pointer dereference at
>    0000000000000020
>    IP: __mark_inode_dirty
>
> Then I got a kernel coredump. Here is a stack trace:
>
> (gdb) bt
> #0  __mark_inode_dirty (inode=0xffff880078fc1490, flags=<value optimized out>) at fs/fs-writeback.c:990
> #1  0xffffffff810e4990 in mark_inode_dirty_sync (mnt=0xffff88007862fd00, dentry=<value optimized out>) at include/linux/fs.h:1687
> #2  touch_atime (mnt=0xffff88007862fd00, dentry=<value optimized out>) at fs/inode.c:1505
> #3  0xffffffff810dfeb4 in file_accessed (file=0xffff88006afed600, filler=0xffffffff810dfcf8 <filldir>, buf=0xffff88007762bf38) at include/linux/fs.h:1763
> #4  vfs_readdir (file=0xffff88006afed600, filler=0xffffffff810dfcf8 <filldir>, buf=0xffff88007762bf38) at fs/readdir.c:41
> #5  0xffffffff810e001a in sys_getdents (fd=<value optimized out>, dirent=0x1f61468, count=32768) at fs/readdir.c:214
> #6  0xffffffff810279ab in ?? () at arch/x86/kernel/entry_64.S:479
> #7  0x00007f8b23d1a4c5 in ?? ()
> #8  0x00000000000002bb in ?? ()
> #9  0x0000000000000000 in ?? ()
>
> (gdb) p bdi
> $1 = (struct backing_dev_info *) 0x0
>
> (gdb) p inode->i_mapping->backing_dev_info 
> $15 = (struct backing_dev_info *) 0xffff880078878d48
>
> (gdb) p inode->i_sb->s_bdi
> $16 = (struct backing_dev_info *) 0x0
>
>
> I can't do git bisect because on n'th step my system became unbootable. 
> But 2.6.35 doesn't fall.
>
>
> ------------------------------------------------------------------------------
> Beautiful is writing same markup. Internet Explorer 9 supports
> standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
> Spend less time writing and  rewriting code and more time creating great
> experiences on the web. Be a part of the beta today
> http://p.sf.net/sfu/msIE9-sfdev2dev

-- 
ak@linux.intel.com -- Speaking for myself only.