2.6.38.8: quota check oops

2.6.38.8: quota check oops

[Arkadiusz Miskiewicz]

quota check code (mount with user+group quota) likes to oops
for me (usually after system hang and hard reset). 

This is on 2.6.38.8 on top of raid10 soft raid. Mount without
quota succeeds without a problem.

[   73.348316] XFS mounting filesystem md3
[   73.612588] Starting XFS recovery on filesystem: md3 (logdev: internal)
[   99.974344] device-mapper: uevent: version 1.0.3
[   99.990186] device-mapper: ioctl: 4.19.1-ioctl (2011-01-07) initialised: dm-devel@redhat.com
[  103.323836] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
[  103.345648] IP: [<ffffffff8145353c>] mutex_lock+0x1c/0x40
[  103.353261] PGD 10a90d067 PUD 106ef8067 PMD 0
[  103.353261] Oops: 0002 [#1] SMP
[  103.353261] last sysfs file: /sys/devices/system/cpu/online
[  103.353261] CPU 0
[  103.353261] Modules linked in: dm_mod ipmi_watchdog ipmi_si ipmi_devintf ipmi_msghandler xt_tcpudp nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ipt_REJECT iptable_filter 
xt_CLASSIFY iptable_mangle ip_tables x_tables sch_sfq forcedeth ext3 jbd mbcache raid456 async_raid6_recov async_pq raid6_pq async_xor xor async_memcpy async_tx raid1 usbhid hid ohci_hcd 
ssb mmc_core pcmcia pcmcia_core ehci_hcd usbcore xfs exportfs sd_mod crc_t10dif sata_nv libata scsi_mod raid10 md_mod [last unloaded: scsi_wait_scan]
[  103.442036]
[  103.442036] Pid: 12308, xid: #0, comm: xfssyncd/md3 Not tainted 2.6.38.8-1 #1 Supermicro H8DMU/H8DMU
[  103.442036] RIP: 0010:[<ffffffff8145353c>]  [<ffffffff8145353c>] mutex_lock+0x1c/0x40
[  103.442036] RSP: 0018:ffff88010d267dd0  EFLAGS: 00010246
[  103.442036] RAX: 0000000000000000 RBX: 0000000000000020 RCX: 0000000000000017
[  103.442036] RDX: ffff88010baf5bb8 RSI: 0000000000000002 RDI: 0000000000000020
[  103.442036] RBP: ffff88010d267de0 R08: 0000000000000000 R09: ffff8801138c8f88
[  103.442036] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000002
[  103.442036] R13: 0000000000000010 R14: 0000000000000000 R15: 0000000000000020
[  103.442036] FS:  00007f0013df1700(0000) GS:ffff8800dfc00000(0000) knlGS:0000000000000000
[  103.442036] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  103.442036] CR2: 0000000000000020 CR3: 000000010aa25000 CR4: 00000000000006f0
[  103.442036] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  103.442036] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  103.442036] Process xfssyncd/md3 (pid: 12308, threadinfo ffff88010baf5bb8, task ffff88010baf57c0)
[  103.442036] Stack:
[  103.442036]  ffff88010c67f000 0000000000000002 ffff88010d267e40 ffffffffa00d7727
[  103.442036]  ffffffffffffffff 000000000c67f000 ffff880100000002 ffff88010c67f000
[  103.442036]  ffff88010d267e90 ffff88010c67f000 ffff88010c67f3a0 ffff88010c67f3b0
[  103.442036] Call Trace:
[  103.442036]  [<ffffffffa00d7727>] xfs_qm_sync+0x57/0x1a0 [xfs]
[  103.442036]  [<ffffffffa013b3c5>] xfs_reclaim_inodes+0x65/0x130 [xfs]
[  103.442036]  [<ffffffffa013a16a>] xfsaild_stop+0x31a/0xc80 [xfs]
[  103.442036]  [<ffffffffa013a000>] ? xfsaild_stop+0x1b0/0xc80 [xfs]
[  103.442036]  [<ffffffff8106d466>] kthread+0x96/0xa0
[  103.442036]  [<ffffffff81003a94>] kernel_thread_helper+0x4/0x10
[  103.442036]  [<ffffffff8106d3d0>] ? kthread+0x0/0xa0
[  103.442036]  [<ffffffff81003a90>] ? kernel_thread_helper+0x0/0x10
[  103.442036] Code: eb dc 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 48 83 ec 10 48 89 1c 24 48 89 fb 4c 89 64 24 08 e8 17 f1 ff ff 48 89 df <f0> ff 0f 79 05 e8 6a fa ff ff 65 48 8b 04 25 c0 a5 00 00 4c 8b
[  103.442036] RIP  [<ffffffff8145353c>] mutex_lock+0x1c/0x40
[  103.442036]  RSP <ffff88010d267dd0>
[  103.442036] CR2: 0000000000000020
[  104.180623] ---[ end trace dd9b675aa2dba8c5 ]---

-- 
Arkadiusz Miśkiewicz        PLD/Linux Team
arekm / maven.pl            http://ftp.pld-linux.org/

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: 2.6.38.8: quota check oops

[Christoph Hellwig]

On Wed, Jul 06, 2011 at 08:32:03AM +0200, Arkadiusz Miskiewicz wrote:
> 
> quota check code (mount with user+group quota) likes to oops
> for me (usually after system hang and hard reset). 
> 
> This is on 2.6.38.8 on top of raid10 soft raid. Mount without
> quota succeeds without a problem.

Looking over the oops mutex_lock is dereferencing a member at offset
0x20 of a structure that unexpectly is a NULL pointer.  The only
mutex_lock calls in xfs_qm_sync are on qi_dqlist_lock, which happens
to be exactly at the offset 0x20 that the oops is complaining about.

So the quick patch below should prevent the OOPS for you and print
a warnings instead, although I'll have to dig a bit deeper to figure
out the root cause.

Index: linux-2.6/fs/xfs/quota/xfs_qm.c
===================================================================
--- linux-2.6.orig/fs/xfs/quota/xfs_qm.c	2011-07-07 15:02:25.206920700 +0200
+++ linux-2.6/fs/xfs/quota/xfs_qm.c	2011-07-07 15:03:59.576915891 +0200
@@ -939,6 +939,11 @@ xfs_qm_sync(
 	restarts = 0;
 
   again:
+ 	if (!q) {
+		printk("XFS: %s called without valid quotainfo\n", __func__);
+		dump_stack();
+		return 0;
+	}
 	mutex_lock(&q->qi_dqlist_lock);
 	/*
 	 * dqpurge_all() also takes the mplist lock and iterate thru all dquots
@@ -1003,6 +1008,12 @@ xfs_qm_sync(
 		else if (error)
 			return error;
 
+ 		if (!q) {
+			printk("XFS: %s called without valid quotainfo (2)\n",
+				__func__);
+			dump_stack();
+			return 0;
+		}
 		mutex_lock(&q->qi_dqlist_lock);
 		if (recl != q->qi_dqreclaims) {
 			if (++restarts >= XFS_QM_SYNC_MAX_RESTARTS)

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs