Corruption in "b_assoc_buffer" list of bufferhead structure.

[srinivasa <srinivasa@in.ibm.com>]

Hi
  I have got a oops  in which "b_assoc_buffer" list of bufferhead is 
getting corrupted with strange values. It looks like a race problem 
,which is not reproducable at everytime. 
When I looked in to the code,I found that  "b_assoc_buffer" list is 
protected by a spinlock on "private_lock" of struct address_space. But 
there is one situation,where I suspect the chance of corruption. that is 
in try_to_free_buffers() of fs/buffer.c
When mapping becomes NULL, there is no lock protection and if 2 or more 
processors passes this condition and executes drop_buffers() 
simultaneously, there may be a chance of list corruption.

So could somebody please explain whether this situation exists or not?
======================================================================

int try_to_free_buffers(struct page *page)
{
        struct address_space * const mapping = page->mapping;
        struct buffer_head *buffers_to_free = NULL;
        int ret = 0;

        BUG_ON(!PageLocked(page));
        if (PageWriteback(page))
                return 0;

        if (mapping == NULL) {      /* can this still happen? */ <<<<here is my doubt>>>>>>
                ret = drop_buffers(page, &buffers_to_free);
                goto out;
        }

        spin_lock(&mapping->private_lock);
        ret = drop_buffers(page, &buffers_to_free);
        if (ret) {
                /*
                 * If the filesystem writes its buffers by hand (eg ext3)
                 * then we can have clean buffers against a dirty page.  We
                 * clean the page here; otherwise later reattachment of
buffers
                 * could encounter a non-uptodate page, which is
unresolvable.
                 * This only applies in the rare case where
try_to_free_buffers
                 * succeeds but the page is not freed.
                 */
                clear_page_dirty(page);
        }
        spin_unlock(&mapping->private_lock);
=========================================================================================


Thanks
Srinivasa DS