* [linux-next:master] [VFS/nfsd/cachefiles/ovl] 7ab96df840: WARNING:at_fs/dcache.c:#umount_check
@ 2025-11-25 13:48 kernel test robot
2025-11-26 10:42 ` Christian Brauner
0 siblings, 1 reply; 8+ messages in thread
From: kernel test robot @ 2025-11-25 13:48 UTC (permalink / raw)
To: NeilBrown
Cc: oe-lkp, lkp, Christian Brauner, Jeff Layton, Amir Goldstein,
netfs, linux-fsdevel, linux-nfs, linux-unionfs, linux-kernel,
oliver.sang
Hello,
kernel test robot noticed "WARNING:at_fs/dcache.c:#umount_check" on:
commit: 7ab96df840e60eb933abfe65fc5fe44e72f16dc0 ("VFS/nfsd/cachefiles/ovl: add start_creating() and end_creating()")
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
[test failed on linux-next/master d724c6f85e80a23ed46b7ebc6e38b527c09d64f5]
in testcase: filebench
version: filebench-x86_64-22620e6-1_20251009
with following parameters:
disk: 1SSD
fs: ext4
fs2: nfsv4
test: ratelimcopyfiles.f
cpufreq_governor: performance
config: x86_64-rhel-9.4
compiler: gcc-14
test machine: 192 threads 4 sockets Intel(R) Xeon(R) Platinum 9242 CPU @ 2.30GHz (Cascade Lake) with 176G memory
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202511252132.2c621407-lkp@intel.com
Unmount[ 252.448780][T17295] ------------[ cut here ]------------
[ 252.455068][T17295] WARNING: CPU: 114 PID: 17295 at fs/dcache.c:1590 umount_check (fs/dcache.c:1590 (discriminator 1) fs/dcache.c:1580 (discriminator 1))
m - /opt/rootfs.[ 252.540436][T17295] CPU: 114 UID: 0 PID: 17295 Comm: umount Tainted: G S 6.18.0-rc1-00004-g7ab96df840e6 #1 VOLUNTARY
[ 252.553273][T17295] Tainted: [S]=CPU_OUT_OF_SPEC
[ 252.558205][T17295] Hardware name: Intel Corporation ............/S9200WKBRD2, BIOS SE5C620.86B.0D.01.0552.060220191912 06/02/2019
[ 252.558206][T17295] RIP: 0010:umount_check (fs/dcache.c:1590 (discriminator 1) fs/dcache.c:1580 (discriminator 1))
[ 252.575407][T17295] Code: 8d 88 a0 03 00 00 48 8b 40 28 4c 8b 08 48 8b 46 30 48 85 c0 74 04 48 8b 50 40 51 48 c7 c7 88 3b ad 82 48 89 f1 e8 27 07 c0 ff <0f> 0b 58 31 c0 c3 cc cc cc cc 41 83 f8 01 75 bf eb aa 0f 1f 44 00
All code
========
0: 8d 88 a0 03 00 00 lea 0x3a0(%rax),%ecx
6: 48 8b 40 28 mov 0x28(%rax),%rax
a: 4c 8b 08 mov (%rax),%r9
d: 48 8b 46 30 mov 0x30(%rsi),%rax
11: 48 85 c0 test %rax,%rax
14: 74 04 je 0x1a
16: 48 8b 50 40 mov 0x40(%rax),%rdx
1a: 51 push %rcx
1b: 48 c7 c7 88 3b ad 82 mov $0xffffffff82ad3b88,%rdi
22: 48 89 f1 mov %rsi,%rcx
25: e8 27 07 c0 ff call 0xffffffffffc00751
2a:* 0f 0b ud2 <-- trapping instruction
2c: 58 pop %rax
2d: 31 c0 xor %eax,%eax
2f: c3 ret
30: cc int3
31: cc int3
32: cc int3
33: cc int3
34: 41 83 f8 01 cmp $0x1,%r8d
38: 75 bf jne 0xfffffffffffffff9
3a: eb aa jmp 0xffffffffffffffe6
3c: 0f .byte 0xf
3d: 1f (bad)
3e: 44 rex.R
...
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: 58 pop %rax
3: 31 c0 xor %eax,%eax
5: c3 ret
6: cc int3
7: cc int3
8: cc int3
9: cc int3
a: 41 83 f8 01 cmp $0x1,%r8d
e: 75 bf jne 0xffffffffffffffcf
10: eb aa jmp 0xffffffffffffffbc
12: 0f .byte 0xf
13: 1f (bad)
14: 44 rex.R
...
[ 252.575410][T17295] RSP: 0018:ffffc9003672bb88 EFLAGS: 00010282
[ 252.601300][T17295] RAX: 0000000000000000 RBX: ffff88ac4c0c55c0 RCX: 0000000000000027
[ 252.601301][T17295] RDX: ffff888c5009c1c8 RSI: 0000000000000001 RDI: ffff888c5009c1c0
[ 252.601303][T17295] RBP: ffff8881e925da40 R08: 0000000000000000 R09: ffffc9003672b958
[ 252.625337][T17295] R10: ffff88ac7fc33fa8 R11: 0000000000000003 R12: ffffffff81748d50
[ 252.625338][T17295] R13: ffff8881e925da40 R14: ffff88ac4c0c9200 R15: ffff88ac4c0c9280
[ 252.625339][T17295] FS: 00007ffff7bfb840(0000) GS:ffff888ccc272000(0000) knlGS:0000000000000000
[ 252.625340][T17295] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 252.625341][T17295] CR2: 00007ffff7ec97a0 CR3: 00000001ce11e005 CR4: 00000000007726f0
[ 252.625342][T17295] PKRU: 55555554
[ 252.625343][T17295] Call Trace:
[ 252.625345][T17295] <TASK>
[ 252.625348][T17295] d_walk (fs/dcache.c:1322)
[ 252.625353][T17295] shrink_dcache_for_umount (include/linux/spinlock.h:351 fs/dcache.c:601 fs/dcache.c:1606 fs/dcache.c:1621)
[ 252.625357][T17295] generic_shutdown_super (fs/super.c:621)
[ 252.689813][T17295] kill_block_super (fs/super.c:1723)
[ 252.689817][T17295] ext4_kill_sb (fs/ext4/super.c:7405) ext4
[ 252.699584][T17295] deactivate_locked_super (fs/super.c:434 fs/super.c:475)
Unmount[ 252.704921][T17295] cleanup_mnt (fs/namespace.c:242 fs/namespace.c:1328)
[ 252.704926][T17295] task_work_run (include/linux/sched.h:2092 kernel/task_work.c:229)
- Legacy Locks D[ 252.727385][T17295] ? __cond_resched (kernel/sched/core.c:7477)
irectory /run/lo[ 252.733357][T17295] ? generic_fillattr (fs/stat.c:99)
[ 252.739669][T17295] ? _copy_to_user (arch/x86/include/asm/uaccess_64.h:126 arch/x86/include/asm/uaccess_64.h:147 include/linux/uaccess.h:197 lib/usercopy.c:26)
[ 252.744854][T17295] ? cp_new_stat (fs/stat.c:506 (discriminator 1))
[ 252.744857][T17295] ? __do_sys_newfstatat (fs/stat.c:546 (discriminator 1))
[ 252.744861][T17295] ? do_syscall_64 (arch/x86/include/asm/jump_label.h:36 include/linux/context_tracking_state.h:108 include/linux/context_tracking.h:41 include/linux/irq-entry-common.h:261 include/linux/entry-common.h:212 arch/x86/entry/syscall_64.c:100)
[ 252.759380][T17295] ? clear_bhb_loop (arch/x86/entry/entry_64.S:1548)
[ 252.764099][T17295] ? clear_bhb_loop (arch/x86/entry/entry_64.S:1548)
[ 252.764101][T17295] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 252.774744][T17295] RIP: 0033:0x7ffff7e54217
[ 252.779199][T17295] Code: 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 b1 5b 0d 00 f7 d8 64 89 02 b8
All code
========
0: 0d 00 f7 d8 64 or $0x64d8f700,%eax
5: 89 02 mov %eax,(%rdx)
7: b8 ff ff ff ff mov $0xffffffff,%eax
c: c3 ret
d: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1)
13: 31 f6 xor %esi,%esi
15: e9 09 00 00 00 jmp 0x23
1a: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1)
21: 00 00
23: b8 a6 00 00 00 mov $0xa6,%eax
28: 0f 05 syscall
2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 01 ja 0x33
32: c3 ret
33: 48 8b 15 b1 5b 0d 00 mov 0xd5bb1(%rip),%rdx # 0xd5beb
3a: f7 d8 neg %eax
3c: 64 89 02 mov %eax,%fs:(%rdx)
3f: b8 .byte 0xb8
Code starting with the faulting instruction
===========================================
0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
6: 77 01 ja 0x9
8: c3 ret
9: 48 8b 15 b1 5b 0d 00 mov 0xd5bb1(%rip),%rdx # 0xd5bc1
10: f7 d8 neg %eax
12: 64 89 02 mov %eax,%fs:(%rdx)
15: b8 .byte 0xb8
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20251125/202511252132.2c621407-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [linux-next:master] [VFS/nfsd/cachefiles/ovl] 7ab96df840: WARNING:at_fs/dcache.c:#umount_check 2025-11-25 13:48 [linux-next:master] [VFS/nfsd/cachefiles/ovl] 7ab96df840: WARNING:at_fs/dcache.c:#umount_check kernel test robot @ 2025-11-26 10:42 ` Christian Brauner 2025-11-26 12:29 ` Amir Goldstein 0 siblings, 1 reply; 8+ messages in thread From: Christian Brauner @ 2025-11-26 10:42 UTC (permalink / raw) To: NeilBrown Cc: kernel test robot, oe-lkp, lkp, Jeff Layton, Amir Goldstein, netfs, linux-fsdevel, linux-nfs, linux-unionfs, linux-kernel On Tue, Nov 25, 2025 at 09:48:18PM +0800, kernel test robot wrote: > > Hello, > > kernel test robot noticed "WARNING:at_fs/dcache.c:#umount_check" on: > > commit: 7ab96df840e60eb933abfe65fc5fe44e72f16dc0 ("VFS/nfsd/cachefiles/ovl: add start_creating() and end_creating()") > https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master > > [test failed on linux-next/master d724c6f85e80a23ed46b7ebc6e38b527c09d64f5] Neil, can you please take a look at this soon? I plan on sending the batch of PRs for this cycle on Friday. > > in testcase: filebench > version: filebench-x86_64-22620e6-1_20251009 > with following parameters: > > disk: 1SSD > fs: ext4 > fs2: nfsv4 > test: ratelimcopyfiles.f > cpufreq_governor: performance > > > > config: x86_64-rhel-9.4 > compiler: gcc-14 > test machine: 192 threads 4 sockets Intel(R) Xeon(R) Platinum 9242 CPU @ 2.30GHz (Cascade Lake) with 176G memory > > (please refer to attached dmesg/kmsg for entire log/backtrace) > > > > If you fix the issue in a separate patch/commit (i.e. not just a new version of > the same patch/commit), kindly add following tags > | Reported-by: kernel test robot <oliver.sang@intel.com> > | Closes: https://lore.kernel.org/oe-lkp/202511252132.2c621407-lkp@intel.com > > > Unmount[ 252.448780][T17295] ------------[ cut here ]------------ > [ 252.455068][T17295] WARNING: CPU: 114 PID: 17295 at fs/dcache.c:1590 umount_check (fs/dcache.c:1590 (discriminator 1) fs/dcache.c:1580 (discriminator 1)) > m - /opt/rootfs.[ 252.540436][T17295] CPU: 114 UID: 0 PID: 17295 Comm: umount Tainted: G S 6.18.0-rc1-00004-g7ab96df840e6 #1 VOLUNTARY > [ 252.553273][T17295] Tainted: [S]=CPU_OUT_OF_SPEC > [ 252.558205][T17295] Hardware name: Intel Corporation ............/S9200WKBRD2, BIOS SE5C620.86B.0D.01.0552.060220191912 06/02/2019 > [ 252.558206][T17295] RIP: 0010:umount_check (fs/dcache.c:1590 (discriminator 1) fs/dcache.c:1580 (discriminator 1)) > [ 252.575407][T17295] Code: 8d 88 a0 03 00 00 48 8b 40 28 4c 8b 08 48 8b 46 30 48 85 c0 74 04 48 8b 50 40 51 48 c7 c7 88 3b ad 82 48 89 f1 e8 27 07 c0 ff <0f> 0b 58 31 c0 c3 cc cc cc cc 41 83 f8 01 75 bf eb aa 0f 1f 44 00 > All code > ======== > 0: 8d 88 a0 03 00 00 lea 0x3a0(%rax),%ecx > 6: 48 8b 40 28 mov 0x28(%rax),%rax > a: 4c 8b 08 mov (%rax),%r9 > d: 48 8b 46 30 mov 0x30(%rsi),%rax > 11: 48 85 c0 test %rax,%rax > 14: 74 04 je 0x1a > 16: 48 8b 50 40 mov 0x40(%rax),%rdx > 1a: 51 push %rcx > 1b: 48 c7 c7 88 3b ad 82 mov $0xffffffff82ad3b88,%rdi > 22: 48 89 f1 mov %rsi,%rcx > 25: e8 27 07 c0 ff call 0xffffffffffc00751 > 2a:* 0f 0b ud2 <-- trapping instruction > 2c: 58 pop %rax > 2d: 31 c0 xor %eax,%eax > 2f: c3 ret > 30: cc int3 > 31: cc int3 > 32: cc int3 > 33: cc int3 > 34: 41 83 f8 01 cmp $0x1,%r8d > 38: 75 bf jne 0xfffffffffffffff9 > 3a: eb aa jmp 0xffffffffffffffe6 > 3c: 0f .byte 0xf > 3d: 1f (bad) > 3e: 44 rex.R > ... > > Code starting with the faulting instruction > =========================================== > 0: 0f 0b ud2 > 2: 58 pop %rax > 3: 31 c0 xor %eax,%eax > 5: c3 ret > 6: cc int3 > 7: cc int3 > 8: cc int3 > 9: cc int3 > a: 41 83 f8 01 cmp $0x1,%r8d > e: 75 bf jne 0xffffffffffffffcf > 10: eb aa jmp 0xffffffffffffffbc > 12: 0f .byte 0xf > 13: 1f (bad) > 14: 44 rex.R > ... > [ 252.575410][T17295] RSP: 0018:ffffc9003672bb88 EFLAGS: 00010282 > [ 252.601300][T17295] RAX: 0000000000000000 RBX: ffff88ac4c0c55c0 RCX: 0000000000000027 > [ 252.601301][T17295] RDX: ffff888c5009c1c8 RSI: 0000000000000001 RDI: ffff888c5009c1c0 > [ 252.601303][T17295] RBP: ffff8881e925da40 R08: 0000000000000000 R09: ffffc9003672b958 > [ 252.625337][T17295] R10: ffff88ac7fc33fa8 R11: 0000000000000003 R12: ffffffff81748d50 > [ 252.625338][T17295] R13: ffff8881e925da40 R14: ffff88ac4c0c9200 R15: ffff88ac4c0c9280 > [ 252.625339][T17295] FS: 00007ffff7bfb840(0000) GS:ffff888ccc272000(0000) knlGS:0000000000000000 > [ 252.625340][T17295] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 252.625341][T17295] CR2: 00007ffff7ec97a0 CR3: 00000001ce11e005 CR4: 00000000007726f0 > [ 252.625342][T17295] PKRU: 55555554 > [ 252.625343][T17295] Call Trace: > [ 252.625345][T17295] <TASK> > [ 252.625348][T17295] d_walk (fs/dcache.c:1322) > [ 252.625353][T17295] shrink_dcache_for_umount (include/linux/spinlock.h:351 fs/dcache.c:601 fs/dcache.c:1606 fs/dcache.c:1621) > [ 252.625357][T17295] generic_shutdown_super (fs/super.c:621) > [ 252.689813][T17295] kill_block_super (fs/super.c:1723) > [ 252.689817][T17295] ext4_kill_sb (fs/ext4/super.c:7405) ext4 > [ 252.699584][T17295] deactivate_locked_super (fs/super.c:434 fs/super.c:475) > Unmount[ 252.704921][T17295] cleanup_mnt (fs/namespace.c:242 fs/namespace.c:1328) > [ 252.704926][T17295] task_work_run (include/linux/sched.h:2092 kernel/task_work.c:229) > - Legacy Locks D[ 252.727385][T17295] ? __cond_resched (kernel/sched/core.c:7477) > irectory /run/lo[ 252.733357][T17295] ? generic_fillattr (fs/stat.c:99) > [ 252.739669][T17295] ? _copy_to_user (arch/x86/include/asm/uaccess_64.h:126 arch/x86/include/asm/uaccess_64.h:147 include/linux/uaccess.h:197 lib/usercopy.c:26) > [ 252.744854][T17295] ? cp_new_stat (fs/stat.c:506 (discriminator 1)) > [ 252.744857][T17295] ? __do_sys_newfstatat (fs/stat.c:546 (discriminator 1)) > [ 252.744861][T17295] ? do_syscall_64 (arch/x86/include/asm/jump_label.h:36 include/linux/context_tracking_state.h:108 include/linux/context_tracking.h:41 include/linux/irq-entry-common.h:261 include/linux/entry-common.h:212 arch/x86/entry/syscall_64.c:100) > [ 252.759380][T17295] ? clear_bhb_loop (arch/x86/entry/entry_64.S:1548) > [ 252.764099][T17295] ? clear_bhb_loop (arch/x86/entry/entry_64.S:1548) > [ 252.764101][T17295] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) > [ 252.774744][T17295] RIP: 0033:0x7ffff7e54217 > [ 252.779199][T17295] Code: 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 b1 5b 0d 00 f7 d8 64 89 02 b8 > All code > ======== > 0: 0d 00 f7 d8 64 or $0x64d8f700,%eax > 5: 89 02 mov %eax,(%rdx) > 7: b8 ff ff ff ff mov $0xffffffff,%eax > c: c3 ret > d: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1) > 13: 31 f6 xor %esi,%esi > 15: e9 09 00 00 00 jmp 0x23 > 1a: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1) > 21: 00 00 > 23: b8 a6 00 00 00 mov $0xa6,%eax > 28: 0f 05 syscall > 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction > 30: 77 01 ja 0x33 > 32: c3 ret > 33: 48 8b 15 b1 5b 0d 00 mov 0xd5bb1(%rip),%rdx # 0xd5beb > 3a: f7 d8 neg %eax > 3c: 64 89 02 mov %eax,%fs:(%rdx) > 3f: b8 .byte 0xb8 > > Code starting with the faulting instruction > =========================================== > 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax > 6: 77 01 ja 0x9 > 8: c3 ret > 9: 48 8b 15 b1 5b 0d 00 mov 0xd5bb1(%rip),%rdx # 0xd5bc1 > 10: f7 d8 neg %eax > 12: 64 89 02 mov %eax,%fs:(%rdx) > 15: b8 .byte 0xb8 > > > The kernel config and materials to reproduce are available at: > https://download.01.org/0day-ci/archive/20251125/202511252132.2c621407-lkp@intel.com > > > > -- > 0-DAY CI Kernel Test Service > https://github.com/intel/lkp-tests/wiki > ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [linux-next:master] [VFS/nfsd/cachefiles/ovl] 7ab96df840: WARNING:at_fs/dcache.c:#umount_check 2025-11-26 10:42 ` Christian Brauner @ 2025-11-26 12:29 ` Amir Goldstein 2025-11-26 20:51 ` NeilBrown 2025-11-27 2:41 ` Oliver Sang 0 siblings, 2 replies; 8+ messages in thread From: Amir Goldstein @ 2025-11-26 12:29 UTC (permalink / raw) To: Christian Brauner, NeilBrown, Jeff Layton Cc: kernel test robot, oe-lkp, lkp, netfs, linux-fsdevel, linux-nfs, linux-unionfs, linux-kernel On Wed, Nov 26, 2025 at 11:42 AM Christian Brauner <brauner@kernel.org> wrote: > > On Tue, Nov 25, 2025 at 09:48:18PM +0800, kernel test robot wrote: > > > > Hello, > > > > kernel test robot noticed "WARNING:at_fs/dcache.c:#umount_check" on: > > > > commit: 7ab96df840e60eb933abfe65fc5fe44e72f16dc0 ("VFS/nfsd/cachefiles/ovl: add start_creating() and end_creating()") > > https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master > > > > [test failed on linux-next/master d724c6f85e80a23ed46b7ebc6e38b527c09d64f5] > > Neil, can you please take a look at this soon? > I plan on sending the batch of PRs for this cycle on Friday. > > > > > in testcase: filebench > > version: filebench-x86_64-22620e6-1_20251009 > > with following parameters: > > > > disk: 1SSD > > fs: ext4 > > fs2: nfsv4 > > test: ratelimcopyfiles.f > > cpufreq_governor: performance > > Test is copying to nfsv4 so that's the immediate suspect. WARN_ON is in unmount of ext4, but I suspect that nfs was loop mounted for the test. FWIW, nfsd_proc_create() looks very suspicious. nfsd_create_locked() does end_creating() internally (internal API change) but nfsd_create_locked() still does end_creating() regardless. Oliver, Can you test this handwritten change or need a patch/branch for testing: diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c index 28f03a6a3cc38..35618122705db 100644 --- a/fs/nfsd/nfsproc.c +++ b/fs/nfsd/nfsproc.c @@ -407,6 +407,7 @@ nfsd_proc_create(struct svc_rqst *rqstp) /* File doesn't exist. Create it and set attrs */ resp->status = nfsd_create_locked(rqstp, dirfhp, &attrs, type, rdev, newfhp); + goto out_write; } else if (type == S_IFREG) { dprintk("nfsd: existing %s, valid=%x, size=%ld\n", argp->name, attr->ia_valid, (long) attr->ia_size); Thanks, Amir. > > > > > > config: x86_64-rhel-9.4 > > compiler: gcc-14 > > test machine: 192 threads 4 sockets Intel(R) Xeon(R) Platinum 9242 CPU @ 2.30GHz (Cascade Lake) with 176G memory > > > > (please refer to attached dmesg/kmsg for entire log/backtrace) > > > > > > > > If you fix the issue in a separate patch/commit (i.e. not just a new version of > > the same patch/commit), kindly add following tags > > | Reported-by: kernel test robot <oliver.sang@intel.com> > > | Closes: https://lore.kernel.org/oe-lkp/202511252132.2c621407-lkp@intel.com > > > > > > Unmount[ 252.448780][T17295] ------------[ cut here ]------------ > > [ 252.455068][T17295] WARNING: CPU: 114 PID: 17295 at fs/dcache.c:1590 umount_check (fs/dcache.c:1590 (discriminator 1) fs/dcache.c:1580 (discriminator 1)) > > m - /opt/rootfs.[ 252.540436][T17295] CPU: 114 UID: 0 PID: 17295 Comm: umount Tainted: G S 6.18.0-rc1-00004-g7ab96df840e6 #1 VOLUNTARY > > [ 252.553273][T17295] Tainted: [S]=CPU_OUT_OF_SPEC > > [ 252.558205][T17295] Hardware name: Intel Corporation ............/S9200WKBRD2, BIOS SE5C620.86B.0D.01.0552.060220191912 06/02/2019 > > [ 252.558206][T17295] RIP: 0010:umount_check (fs/dcache.c:1590 (discriminator 1) fs/dcache.c:1580 (discriminator 1)) > > [ 252.575407][T17295] Code: 8d 88 a0 03 00 00 48 8b 40 28 4c 8b 08 48 8b 46 30 48 85 c0 74 04 48 8b 50 40 51 48 c7 c7 88 3b ad 82 48 89 f1 e8 27 07 c0 ff <0f> 0b 58 31 c0 c3 cc cc cc cc 41 83 f8 01 75 bf eb aa 0f 1f 44 00 > > All code > > ======== > > 0: 8d 88 a0 03 00 00 lea 0x3a0(%rax),%ecx > > 6: 48 8b 40 28 mov 0x28(%rax),%rax > > a: 4c 8b 08 mov (%rax),%r9 > > d: 48 8b 46 30 mov 0x30(%rsi),%rax > > 11: 48 85 c0 test %rax,%rax > > 14: 74 04 je 0x1a > > 16: 48 8b 50 40 mov 0x40(%rax),%rdx > > 1a: 51 push %rcx > > 1b: 48 c7 c7 88 3b ad 82 mov $0xffffffff82ad3b88,%rdi > > 22: 48 89 f1 mov %rsi,%rcx > > 25: e8 27 07 c0 ff call 0xffffffffffc00751 > > 2a:* 0f 0b ud2 <-- trapping instruction > > 2c: 58 pop %rax > > 2d: 31 c0 xor %eax,%eax > > 2f: c3 ret > > 30: cc int3 > > 31: cc int3 > > 32: cc int3 > > 33: cc int3 > > 34: 41 83 f8 01 cmp $0x1,%r8d > > 38: 75 bf jne 0xfffffffffffffff9 > > 3a: eb aa jmp 0xffffffffffffffe6 > > 3c: 0f .byte 0xf > > 3d: 1f (bad) > > 3e: 44 rex.R > > ... > > > > Code starting with the faulting instruction > > =========================================== > > 0: 0f 0b ud2 > > 2: 58 pop %rax > > 3: 31 c0 xor %eax,%eax > > 5: c3 ret > > 6: cc int3 > > 7: cc int3 > > 8: cc int3 > > 9: cc int3 > > a: 41 83 f8 01 cmp $0x1,%r8d > > e: 75 bf jne 0xffffffffffffffcf > > 10: eb aa jmp 0xffffffffffffffbc > > 12: 0f .byte 0xf > > 13: 1f (bad) > > 14: 44 rex.R > > ... > > [ 252.575410][T17295] RSP: 0018:ffffc9003672bb88 EFLAGS: 00010282 > > [ 252.601300][T17295] RAX: 0000000000000000 RBX: ffff88ac4c0c55c0 RCX: 0000000000000027 > > [ 252.601301][T17295] RDX: ffff888c5009c1c8 RSI: 0000000000000001 RDI: ffff888c5009c1c0 > > [ 252.601303][T17295] RBP: ffff8881e925da40 R08: 0000000000000000 R09: ffffc9003672b958 > > [ 252.625337][T17295] R10: ffff88ac7fc33fa8 R11: 0000000000000003 R12: ffffffff81748d50 > > [ 252.625338][T17295] R13: ffff8881e925da40 R14: ffff88ac4c0c9200 R15: ffff88ac4c0c9280 > > [ 252.625339][T17295] FS: 00007ffff7bfb840(0000) GS:ffff888ccc272000(0000) knlGS:0000000000000000 > > [ 252.625340][T17295] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > [ 252.625341][T17295] CR2: 00007ffff7ec97a0 CR3: 00000001ce11e005 CR4: 00000000007726f0 > > [ 252.625342][T17295] PKRU: 55555554 > > [ 252.625343][T17295] Call Trace: > > [ 252.625345][T17295] <TASK> > > [ 252.625348][T17295] d_walk (fs/dcache.c:1322) > > [ 252.625353][T17295] shrink_dcache_for_umount (include/linux/spinlock.h:351 fs/dcache.c:601 fs/dcache.c:1606 fs/dcache.c:1621) > > [ 252.625357][T17295] generic_shutdown_super (fs/super.c:621) > > [ 252.689813][T17295] kill_block_super (fs/super.c:1723) > > [ 252.689817][T17295] ext4_kill_sb (fs/ext4/super.c:7405) ext4 > > [ 252.699584][T17295] deactivate_locked_super (fs/super.c:434 fs/super.c:475) > > Unmount[ 252.704921][T17295] cleanup_mnt (fs/namespace.c:242 fs/namespace.c:1328) > > [ 252.704926][T17295] task_work_run (include/linux/sched.h:2092 kernel/task_work.c:229) > > - Legacy Locks D[ 252.727385][T17295] ? __cond_resched (kernel/sched/core.c:7477) > > irectory /run/lo[ 252.733357][T17295] ? generic_fillattr (fs/stat.c:99) > > [ 252.739669][T17295] ? _copy_to_user (arch/x86/include/asm/uaccess_64.h:126 arch/x86/include/asm/uaccess_64.h:147 include/linux/uaccess.h:197 lib/usercopy.c:26) > > [ 252.744854][T17295] ? cp_new_stat (fs/stat.c:506 (discriminator 1)) > > [ 252.744857][T17295] ? __do_sys_newfstatat (fs/stat.c:546 (discriminator 1)) > > [ 252.744861][T17295] ? do_syscall_64 (arch/x86/include/asm/jump_label.h:36 include/linux/context_tracking_state.h:108 include/linux/context_tracking.h:41 include/linux/irq-entry-common.h:261 include/linux/entry-common.h:212 arch/x86/entry/syscall_64.c:100) > > [ 252.759380][T17295] ? clear_bhb_loop (arch/x86/entry/entry_64.S:1548) > > [ 252.764099][T17295] ? clear_bhb_loop (arch/x86/entry/entry_64.S:1548) > > [ 252.764101][T17295] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) > > [ 252.774744][T17295] RIP: 0033:0x7ffff7e54217 > > [ 252.779199][T17295] Code: 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 b1 5b 0d 00 f7 d8 64 89 02 b8 > > All code > > ======== > > 0: 0d 00 f7 d8 64 or $0x64d8f700,%eax > > 5: 89 02 mov %eax,(%rdx) > > 7: b8 ff ff ff ff mov $0xffffffff,%eax > > c: c3 ret > > d: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1) > > 13: 31 f6 xor %esi,%esi > > 15: e9 09 00 00 00 jmp 0x23 > > 1a: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1) > > 21: 00 00 > > 23: b8 a6 00 00 00 mov $0xa6,%eax > > 28: 0f 05 syscall > > 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction > > 30: 77 01 ja 0x33 > > 32: c3 ret > > 33: 48 8b 15 b1 5b 0d 00 mov 0xd5bb1(%rip),%rdx # 0xd5beb > > 3a: f7 d8 neg %eax > > 3c: 64 89 02 mov %eax,%fs:(%rdx) > > 3f: b8 .byte 0xb8 > > > > Code starting with the faulting instruction > > =========================================== > > 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax > > 6: 77 01 ja 0x9 > > 8: c3 ret > > 9: 48 8b 15 b1 5b 0d 00 mov 0xd5bb1(%rip),%rdx # 0xd5bc1 > > 10: f7 d8 neg %eax > > 12: 64 89 02 mov %eax,%fs:(%rdx) > > 15: b8 .byte 0xb8 > > > > > > The kernel config and materials to reproduce are available at: > > https://download.01.org/0day-ci/archive/20251125/202511252132.2c621407-lkp@intel.com > > > > > > > > -- > > 0-DAY CI Kernel Test Service > > https://github.com/intel/lkp-tests/wiki > > ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [linux-next:master] [VFS/nfsd/cachefiles/ovl] 7ab96df840: WARNING:at_fs/dcache.c:#umount_check 2025-11-26 12:29 ` Amir Goldstein @ 2025-11-26 20:51 ` NeilBrown 2025-11-27 4:58 ` Oliver Sang 2025-11-27 10:53 ` Christian Brauner 2025-11-27 2:41 ` Oliver Sang 1 sibling, 2 replies; 8+ messages in thread From: NeilBrown @ 2025-11-26 20:51 UTC (permalink / raw) To: Amir Goldstein Cc: Christian Brauner, Jeff Layton, kernel test robot, oe-lkp, lkp, netfs, linux-fsdevel, linux-nfs, linux-unionfs, linux-kernel On Wed, 26 Nov 2025, Amir Goldstein wrote: > On Wed, Nov 26, 2025 at 11:42 AM Christian Brauner <brauner@kernel.org> wrote: > > > > On Tue, Nov 25, 2025 at 09:48:18PM +0800, kernel test robot wrote: > > > > > > Hello, > > > > > > kernel test robot noticed "WARNING:at_fs/dcache.c:#umount_check" on: > > > > > > commit: 7ab96df840e60eb933abfe65fc5fe44e72f16dc0 ("VFS/nfsd/cachefiles/ovl: add start_creating() and end_creating()") > > > https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master > > > > > > [test failed on linux-next/master d724c6f85e80a23ed46b7ebc6e38b527c09d64f5] > > > > Neil, can you please take a look at this soon? > > I plan on sending the batch of PRs for this cycle on Friday. > > > > > > > > in testcase: filebench > > > version: filebench-x86_64-22620e6-1_20251009 > > > with following parameters: > > > > > > disk: 1SSD > > > fs: ext4 > > > fs2: nfsv4 > > > test: ratelimcopyfiles.f > > > cpufreq_governor: performance > > > > > Test is copying to nfsv4 so that's the immediate suspect. > WARN_ON is in unmount of ext4, but I suspect that nfs > was loop mounted for the test. > > FWIW, nfsd_proc_create() looks very suspicious. > > nfsd_create_locked() does end_creating() internally (internal API change) > but nfsd_create_locked() still does end_creating() regardless. Thanks for looking at this Amir. That omission in nfsproc.c is certainly part of the problem but not all of it. By skipping the end_creating() there, we avoid a duplicate unlock, but also lose a dput() which we need. Both callers of nfsd_create_locked() have the same problem. I think this should fix it. The resulting code is a bit ugly but I can fix that with the nfsd team once this gets upstream. (FYI nfsd_proc_create() is only used for NFSv2 and as it was an nfsv4 test, that could wouldn't have been run) Thanks, NeilBrown diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c index 28f03a6a3cc3..481e789a7697 100644 --- a/fs/nfsd/nfsproc.c +++ b/fs/nfsd/nfsproc.c @@ -407,6 +407,9 @@ nfsd_proc_create(struct svc_rqst *rqstp) /* File doesn't exist. Create it and set attrs */ resp->status = nfsd_create_locked(rqstp, dirfhp, &attrs, type, rdev, newfhp); + /* nfsd_create_locked() unlocked the parent */ + dput(dchild); + goto out_write; } else if (type == S_IFREG) { dprintk("nfsd: existing %s, valid=%x, size=%ld\n", argp->name, attr->ia_valid, (long) attr->ia_size); diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index 145f1c8d124d..4688f3fd59e2 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -1633,16 +1633,14 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, return nfserrno(host_err); err = fh_compose(resfhp, fhp->fh_export, dchild, fhp); - /* - * We unconditionally drop our ref to dchild as fh_compose will have - * already grabbed its own ref for it. - */ if (err) goto out_unlock; err = fh_fill_pre_attrs(fhp); if (err != nfs_ok) goto out_unlock; err = nfsd_create_locked(rqstp, fhp, attrs, type, rdev, resfhp); + /* nfsd_create_locked() unlocked the parent */ + dput(dchild); return err; out_unlock: ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [linux-next:master] [VFS/nfsd/cachefiles/ovl] 7ab96df840: WARNING:at_fs/dcache.c:#umount_check 2025-11-26 20:51 ` NeilBrown @ 2025-11-27 4:58 ` Oliver Sang 2025-11-27 10:53 ` Christian Brauner 1 sibling, 0 replies; 8+ messages in thread From: Oliver Sang @ 2025-11-27 4:58 UTC (permalink / raw) To: NeilBrown Cc: Amir Goldstein, Christian Brauner, Jeff Layton, oe-lkp, lkp, netfs, linux-fsdevel, linux-nfs, linux-unionfs, linux-kernel, oliver.sang hi, NeilBrown, On Thu, Nov 27, 2025 at 07:51:18AM +1100, NeilBrown wrote: > On Wed, 26 Nov 2025, Amir Goldstein wrote: > > On Wed, Nov 26, 2025 at 11:42 AM Christian Brauner <brauner@kernel.org> wrote: > > > > > > On Tue, Nov 25, 2025 at 09:48:18PM +0800, kernel test robot wrote: > > > > > > > > Hello, > > > > > > > > kernel test robot noticed "WARNING:at_fs/dcache.c:#umount_check" on: > > > > > > > > commit: 7ab96df840e60eb933abfe65fc5fe44e72f16dc0 ("VFS/nfsd/cachefiles/ovl: add start_creating() and end_creating()") > > > > https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master > > > > > > > > [test failed on linux-next/master d724c6f85e80a23ed46b7ebc6e38b527c09d64f5] > > > > > > Neil, can you please take a look at this soon? > > > I plan on sending the batch of PRs for this cycle on Friday. > > > > > > > > > > > in testcase: filebench > > > > version: filebench-x86_64-22620e6-1_20251009 > > > > with following parameters: > > > > > > > > disk: 1SSD > > > > fs: ext4 > > > > fs2: nfsv4 > > > > test: ratelimcopyfiles.f > > > > cpufreq_governor: performance > > > > > > > > Test is copying to nfsv4 so that's the immediate suspect. > > WARN_ON is in unmount of ext4, but I suspect that nfs > > was loop mounted for the test. > > > > FWIW, nfsd_proc_create() looks very suspicious. > > > > nfsd_create_locked() does end_creating() internally (internal API change) > > but nfsd_create_locked() still does end_creating() regardless. > > Thanks for looking at this Amir. That omission in nfsproc.c is > certainly part of the problem but not all of it. > By skipping the end_creating() there, we avoid a duplicate unlock, but > also lose a dput() which we need. Both callers of nfsd_create_locked() > have the same problem. > I think this should fix it. The resulting code is a bit ugly but I can > fix that with the nfsd team once this gets upstream. > > (FYI nfsd_proc_create() is only used for NFSv2 and as it was an nfsv4 test, > that could wouldn't have been run) > > Thanks, > NeilBrown we tested below patch, confirmed it could fix the issues in our original reports. thanks! Tested-by: kernel test robot <oliver.sang@intel.com> > > diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c > index 28f03a6a3cc3..481e789a7697 100644 > --- a/fs/nfsd/nfsproc.c > +++ b/fs/nfsd/nfsproc.c > @@ -407,6 +407,9 @@ nfsd_proc_create(struct svc_rqst *rqstp) > /* File doesn't exist. Create it and set attrs */ > resp->status = nfsd_create_locked(rqstp, dirfhp, &attrs, type, > rdev, newfhp); > + /* nfsd_create_locked() unlocked the parent */ > + dput(dchild); > + goto out_write; > } else if (type == S_IFREG) { > dprintk("nfsd: existing %s, valid=%x, size=%ld\n", > argp->name, attr->ia_valid, (long) attr->ia_size); > diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c > index 145f1c8d124d..4688f3fd59e2 100644 > --- a/fs/nfsd/vfs.c > +++ b/fs/nfsd/vfs.c > @@ -1633,16 +1633,14 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, > return nfserrno(host_err); > > err = fh_compose(resfhp, fhp->fh_export, dchild, fhp); > - /* > - * We unconditionally drop our ref to dchild as fh_compose will have > - * already grabbed its own ref for it. > - */ > if (err) > goto out_unlock; > err = fh_fill_pre_attrs(fhp); > if (err != nfs_ok) > goto out_unlock; > err = nfsd_create_locked(rqstp, fhp, attrs, type, rdev, resfhp); > + /* nfsd_create_locked() unlocked the parent */ > + dput(dchild); > return err; > > out_unlock: ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [linux-next:master] [VFS/nfsd/cachefiles/ovl] 7ab96df840: WARNING:at_fs/dcache.c:#umount_check 2025-11-26 20:51 ` NeilBrown 2025-11-27 4:58 ` Oliver Sang @ 2025-11-27 10:53 ` Christian Brauner 2025-11-27 11:03 ` NeilBrown 1 sibling, 1 reply; 8+ messages in thread From: Christian Brauner @ 2025-11-27 10:53 UTC (permalink / raw) To: NeilBrown Cc: Amir Goldstein, Jeff Layton, kernel test robot, oe-lkp, lkp, netfs, linux-fsdevel, linux-nfs, linux-unionfs, linux-kernel On Thu, Nov 27, 2025 at 07:51:18AM +1100, NeilBrown wrote: > On Wed, 26 Nov 2025, Amir Goldstein wrote: > > On Wed, Nov 26, 2025 at 11:42 AM Christian Brauner <brauner@kernel.org> wrote: > > > > > > On Tue, Nov 25, 2025 at 09:48:18PM +0800, kernel test robot wrote: > > > > > > > > Hello, > > > > > > > > kernel test robot noticed "WARNING:at_fs/dcache.c:#umount_check" on: > > > > > > > > commit: 7ab96df840e60eb933abfe65fc5fe44e72f16dc0 ("VFS/nfsd/cachefiles/ovl: add start_creating() and end_creating()") > > > > https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master > > > > > > > > [test failed on linux-next/master d724c6f85e80a23ed46b7ebc6e38b527c09d64f5] > > > > > > Neil, can you please take a look at this soon? > > > I plan on sending the batch of PRs for this cycle on Friday. > > > > > > > > > > > in testcase: filebench > > > > version: filebench-x86_64-22620e6-1_20251009 > > > > with following parameters: > > > > > > > > disk: 1SSD > > > > fs: ext4 > > > > fs2: nfsv4 > > > > test: ratelimcopyfiles.f > > > > cpufreq_governor: performance > > > > > > > > Test is copying to nfsv4 so that's the immediate suspect. > > WARN_ON is in unmount of ext4, but I suspect that nfs > > was loop mounted for the test. > > > > FWIW, nfsd_proc_create() looks very suspicious. > > > > nfsd_create_locked() does end_creating() internally (internal API change) > > but nfsd_create_locked() still does end_creating() regardless. > > Thanks for looking at this Amir. That omission in nfsproc.c is > certainly part of the problem but not all of it. > By skipping the end_creating() there, we avoid a duplicate unlock, but > also lose a dput() which we need. Both callers of nfsd_create_locked() > have the same problem. > I think this should fix it. The resulting code is a bit ugly but I can > fix that with the nfsd team once this gets upstream. > > (FYI nfsd_proc_create() is only used for NFSv2 and as it was an nfsv4 test, > that could wouldn't have been run) > > Thanks, > NeilBrown > > diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c > index 28f03a6a3cc3..481e789a7697 100644 > --- a/fs/nfsd/nfsproc.c > +++ b/fs/nfsd/nfsproc.c > @@ -407,6 +407,9 @@ nfsd_proc_create(struct svc_rqst *rqstp) > /* File doesn't exist. Create it and set attrs */ > resp->status = nfsd_create_locked(rqstp, dirfhp, &attrs, type, > rdev, newfhp); > + /* nfsd_create_locked() unlocked the parent */ > + dput(dchild); > + goto out_write; > } else if (type == S_IFREG) { > dprintk("nfsd: existing %s, valid=%x, size=%ld\n", > argp->name, attr->ia_valid, (long) attr->ia_size); > diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c > index 145f1c8d124d..4688f3fd59e2 100644 > --- a/fs/nfsd/vfs.c > +++ b/fs/nfsd/vfs.c > @@ -1633,16 +1633,14 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, > return nfserrno(host_err); > > err = fh_compose(resfhp, fhp->fh_export, dchild, fhp); > - /* > - * We unconditionally drop our ref to dchild as fh_compose will have > - * already grabbed its own ref for it. > - */ > if (err) > goto out_unlock; > err = fh_fill_pre_attrs(fhp); > if (err != nfs_ok) > goto out_unlock; > err = nfsd_create_locked(rqstp, fhp, attrs, type, rdev, resfhp); > + /* nfsd_create_locked() unlocked the parent */ > + dput(dchild); > return err; > > out_unlock: Thanks for the quick fix. I've added a patch to vfs-6.19.directory.unlocking which I attributed to you. It'd be easier if you just shoot something I can apply directly next time. :) ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [linux-next:master] [VFS/nfsd/cachefiles/ovl] 7ab96df840: WARNING:at_fs/dcache.c:#umount_check 2025-11-27 10:53 ` Christian Brauner @ 2025-11-27 11:03 ` NeilBrown 0 siblings, 0 replies; 8+ messages in thread From: NeilBrown @ 2025-11-27 11:03 UTC (permalink / raw) To: Christian Brauner Cc: Amir Goldstein, Jeff Layton, kernel test robot, oe-lkp, lkp, netfs, linux-fsdevel, linux-nfs, linux-unionfs, linux-kernel On Thu, 27 Nov 2025, Christian Brauner wrote: > On Thu, Nov 27, 2025 at 07:51:18AM +1100, NeilBrown wrote: > > On Wed, 26 Nov 2025, Amir Goldstein wrote: > > > On Wed, Nov 26, 2025 at 11:42 AM Christian Brauner <brauner@kernel.org> wrote: > > > > > > > > On Tue, Nov 25, 2025 at 09:48:18PM +0800, kernel test robot wrote: > > > > > > > > > > Hello, > > > > > > > > > > kernel test robot noticed "WARNING:at_fs/dcache.c:#umount_check" on: > > > > > > > > > > commit: 7ab96df840e60eb933abfe65fc5fe44e72f16dc0 ("VFS/nfsd/cachefiles/ovl: add start_creating() and end_creating()") > > > > > https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master > > > > > > > > > > [test failed on linux-next/master d724c6f85e80a23ed46b7ebc6e38b527c09d64f5] > > > > > > > > Neil, can you please take a look at this soon? > > > > I plan on sending the batch of PRs for this cycle on Friday. > > > > > > > > > > > > > > in testcase: filebench > > > > > version: filebench-x86_64-22620e6-1_20251009 > > > > > with following parameters: > > > > > > > > > > disk: 1SSD > > > > > fs: ext4 > > > > > fs2: nfsv4 > > > > > test: ratelimcopyfiles.f > > > > > cpufreq_governor: performance > > > > > > > > > > > Test is copying to nfsv4 so that's the immediate suspect. > > > WARN_ON is in unmount of ext4, but I suspect that nfs > > > was loop mounted for the test. > > > > > > FWIW, nfsd_proc_create() looks very suspicious. > > > > > > nfsd_create_locked() does end_creating() internally (internal API change) > > > but nfsd_create_locked() still does end_creating() regardless. > > > > Thanks for looking at this Amir. That omission in nfsproc.c is > > certainly part of the problem but not all of it. > > By skipping the end_creating() there, we avoid a duplicate unlock, but > > also lose a dput() which we need. Both callers of nfsd_create_locked() > > have the same problem. > > I think this should fix it. The resulting code is a bit ugly but I can > > fix that with the nfsd team once this gets upstream. > > > > (FYI nfsd_proc_create() is only used for NFSv2 and as it was an nfsv4 test, > > that could wouldn't have been run) > > > > Thanks, > > NeilBrown > > > > diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c > > index 28f03a6a3cc3..481e789a7697 100644 > > --- a/fs/nfsd/nfsproc.c > > +++ b/fs/nfsd/nfsproc.c > > @@ -407,6 +407,9 @@ nfsd_proc_create(struct svc_rqst *rqstp) > > /* File doesn't exist. Create it and set attrs */ > > resp->status = nfsd_create_locked(rqstp, dirfhp, &attrs, type, > > rdev, newfhp); > > + /* nfsd_create_locked() unlocked the parent */ > > + dput(dchild); > > + goto out_write; > > } else if (type == S_IFREG) { > > dprintk("nfsd: existing %s, valid=%x, size=%ld\n", > > argp->name, attr->ia_valid, (long) attr->ia_size); > > diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c > > index 145f1c8d124d..4688f3fd59e2 100644 > > --- a/fs/nfsd/vfs.c > > +++ b/fs/nfsd/vfs.c > > @@ -1633,16 +1633,14 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, > > return nfserrno(host_err); > > > > err = fh_compose(resfhp, fhp->fh_export, dchild, fhp); > > - /* > > - * We unconditionally drop our ref to dchild as fh_compose will have > > - * already grabbed its own ref for it. > > - */ > > if (err) > > goto out_unlock; > > err = fh_fill_pre_attrs(fhp); > > if (err != nfs_ok) > > goto out_unlock; > > err = nfsd_create_locked(rqstp, fhp, attrs, type, rdev, resfhp); > > + /* nfsd_create_locked() unlocked the parent */ > > + dput(dchild); > > return err; > > > > out_unlock: > > Thanks for the quick fix. I've added a patch to > vfs-6.19.directory.unlocking which I attributed to you. > It'd be easier if you just shoot something I can apply directly next > time. :) > Thanks looks good ( on vfs-6.19.directory.locking of course not unlocking :-) Though I prefer Signed-off-by: NeilBrown <neil@brown.name> (I received mail at that address but cannot send it because of SPF silliness at brown.name). I'll make sure it is a properly formatted patch if there is a next time. Thanks, NeilBrown ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [linux-next:master] [VFS/nfsd/cachefiles/ovl] 7ab96df840: WARNING:at_fs/dcache.c:#umount_check 2025-11-26 12:29 ` Amir Goldstein 2025-11-26 20:51 ` NeilBrown @ 2025-11-27 2:41 ` Oliver Sang 1 sibling, 0 replies; 8+ messages in thread From: Oliver Sang @ 2025-11-27 2:41 UTC (permalink / raw) To: Amir Goldstein Cc: Christian Brauner, NeilBrown, Jeff Layton, oe-lkp, lkp, netfs, linux-fsdevel, linux-nfs, linux-unionfs, linux-kernel, oliver.sang hi, Amir, On Wed, Nov 26, 2025 at 01:29:57PM +0100, Amir Goldstein wrote: > On Wed, Nov 26, 2025 at 11:42 AM Christian Brauner <brauner@kernel.org> wrote: > > > > On Tue, Nov 25, 2025 at 09:48:18PM +0800, kernel test robot wrote: > > > > > > Hello, > > > > > > kernel test robot noticed "WARNING:at_fs/dcache.c:#umount_check" on: > > > > > > commit: 7ab96df840e60eb933abfe65fc5fe44e72f16dc0 ("VFS/nfsd/cachefiles/ovl: add start_creating() and end_creating()") > > > https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master > > > > > > [test failed on linux-next/master d724c6f85e80a23ed46b7ebc6e38b527c09d64f5] > > > > Neil, can you please take a look at this soon? > > I plan on sending the batch of PRs for this cycle on Friday. > > > > > > > > in testcase: filebench > > > version: filebench-x86_64-22620e6-1_20251009 > > > with following parameters: > > > > > > disk: 1SSD > > > fs: ext4 > > > fs2: nfsv4 > > > test: ratelimcopyfiles.f > > > cpufreq_governor: performance > > > > > Test is copying to nfsv4 so that's the immediate suspect. > WARN_ON is in unmount of ext4, but I suspect that nfs > was loop mounted for the test. > > FWIW, nfsd_proc_create() looks very suspicious. > > nfsd_create_locked() does end_creating() internally (internal API change) > but nfsd_create_locked() still does end_creating() regardless. > > Oliver, > > Can you test this handwritten change or need a patch/branch for testing: thanks for the patch! but it cannot solved the issues we reported. since we are now testing refined patch from NeilBrown, I won't supply more detail such like dmesg here. if you still want it, please let us know. thanks! > > diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c > index 28f03a6a3cc38..35618122705db 100644 > --- a/fs/nfsd/nfsproc.c > +++ b/fs/nfsd/nfsproc.c > @@ -407,6 +407,7 @@ nfsd_proc_create(struct svc_rqst *rqstp) > /* File doesn't exist. Create it and set attrs */ > resp->status = nfsd_create_locked(rqstp, dirfhp, &attrs, type, > rdev, newfhp); > + goto out_write; > } else if (type == S_IFREG) { > dprintk("nfsd: existing %s, valid=%x, size=%ld\n", > argp->name, attr->ia_valid, (long) attr->ia_size); > > > Thanks, > Amir. > ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2025-11-27 11:03 UTC | newest] Thread overview: 8+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-11-25 13:48 [linux-next:master] [VFS/nfsd/cachefiles/ovl] 7ab96df840: WARNING:at_fs/dcache.c:#umount_check kernel test robot 2025-11-26 10:42 ` Christian Brauner 2025-11-26 12:29 ` Amir Goldstein 2025-11-26 20:51 ` NeilBrown 2025-11-27 4:58 ` Oliver Sang 2025-11-27 10:53 ` Christian Brauner 2025-11-27 11:03 ` NeilBrown 2025-11-27 2:41 ` Oliver Sang
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).