nbd oops on unload.

nbd oops on unload.

[Dave Jones]

modprobe nbd ; rmmod nbd  was enough to reproduce this one..
(2.6.3rc4)

		Dave

nbd: registered device at major 43
Unable to handle kernel paging request at virtual address 6b6b6baf
 printing eip:
c01d3206
*pde = 00000000
Oops: 0000 [#2]
CPU:    0
EIP:    0060:[<c01d3206>]    Not tainted
EFLAGS: 00010202
EIP is at kobject_hotplug+0x24/0x30
eax: c02e9ff3   ebx: c36530d4   ecx: c36530d4   edx: 6b6b6b6b
esi: c1f4f190   edi: 00000000   ebp: 00000000   esp: c44c5f24
ds: 007b   es: 007b   ss: 0068
Process rmmod (pid: 7597, threadinfo=c44c4000 task=c40b4650)
Stack: c01d3486 c36530d4 c01d349d c3653084 c0224536 c3653084 c02276d0 c1f4f190
       c7c103dc c022857a c1f4f190 c0191001 c1f4f190 c7c12990 c7c0e4a4 c7c0fd80
       00000000 c031acd8 c013a805 0064626e 00000000 c2cd62d8 c2cd62d8 b80d1000
Call Trace:
 [<c01d3486>] kobject_del+0xf/0x1e
 [<c01d349d>] kobject_unregister+0x8/0x10
 [<c0224536>] elv_unregister_queue+0xf/0x1d
 [<c02276d0>] blk_unregister_queue+0x1b/0x36
 [<c022857a>] unlink_gendisk+0x8/0x19
 [<c0191001>] del_gendisk+0x45/0xc8
 [<c7c0e4a4>] nbd_cleanup+0x26/0x55 [nbd]
 [<c013a805>] sys_delete_module+0x168/0x18a
 [<c014ff4d>] unmap_vma_list+0xe/0x17
 [<c01503f9>] do_munmap+0x17d/0x189
 [<c010b697>] syscall_call+0x7/0xb
 
Code: 83 7a 44 00 74 05 e9 9f fd ff ff c3 53 31 d2 89 c3 c7 40 18

Re: nbd oops on unload.

[Paul Clements]

Dave Jones wrote:
> 
> modprobe nbd ; rmmod nbd  was enough to reproduce this one..
> (2.6.3rc4)

hmmm...I'll look into it...out of curiosity, are you using any "unusual"
kernel config options? I've done the same test myself many times and
have not seen any problems...

--
Paul



>                 Dave
> 
> nbd: registered device at major 43
> Unable to handle kernel paging request at virtual address 6b6b6baf
>  printing eip:
> c01d3206
> *pde = 00000000
> Oops: 0000 [#2]
> CPU:    0
> EIP:    0060:[<c01d3206>]    Not tainted
> EFLAGS: 00010202
> EIP is at kobject_hotplug+0x24/0x30
> eax: c02e9ff3   ebx: c36530d4   ecx: c36530d4   edx: 6b6b6b6b
> esi: c1f4f190   edi: 00000000   ebp: 00000000   esp: c44c5f24
> ds: 007b   es: 007b   ss: 0068
> Process rmmod (pid: 7597, threadinfo=c44c4000 task=c40b4650)
> Stack: c01d3486 c36530d4 c01d349d c3653084 c0224536 c3653084 c02276d0 c1f4f190
>        c7c103dc c022857a c1f4f190 c0191001 c1f4f190 c7c12990 c7c0e4a4 c7c0fd80
>        00000000 c031acd8 c013a805 0064626e 00000000 c2cd62d8 c2cd62d8 b80d1000
> Call Trace:
>  [<c01d3486>] kobject_del+0xf/0x1e
>  [<c01d349d>] kobject_unregister+0x8/0x10
>  [<c0224536>] elv_unregister_queue+0xf/0x1d
>  [<c02276d0>] blk_unregister_queue+0x1b/0x36
>  [<c022857a>] unlink_gendisk+0x8/0x19
>  [<c0191001>] del_gendisk+0x45/0xc8
>  [<c7c0e4a4>] nbd_cleanup+0x26/0x55 [nbd]
>  [<c013a805>] sys_delete_module+0x168/0x18a
>  [<c014ff4d>] unmap_vma_list+0xe/0x17
>  [<c01503f9>] do_munmap+0x17d/0x189
>  [<c010b697>] syscall_call+0x7/0xb
> 
> Code: 83 7a 44 00 74 05 e9 9f fd ff ff c3 53 31 d2 89 c3 c7 40 18
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/

Re: nbd oops on unload.

[Jens Axboe]

On Wed, Feb 18 2004, Paul Clements wrote:
> Dave Jones wrote:
> > 
> > modprobe nbd ; rmmod nbd  was enough to reproduce this one..
> > (2.6.3rc4)
> 
> hmmm...I'll look into it...out of curiosity, are you using any "unusual"
> kernel config options? I've done the same test myself many times and
> have not seen any problems...

It looks like 'the usual' 'several devices sharing a queue' oops on
unload.

-- 
Jens Axboe

Re: nbd oops on unload.

[Paul Clements]

Jens Axboe wrote:
> 
> On Wed, Feb 18 2004, Paul Clements wrote:
> > Dave Jones wrote:
> > >
> > > modprobe nbd ; rmmod nbd  was enough to reproduce this one..
> > > (2.6.3rc4)
> >
> > hmmm...I'll look into it...out of curiosity, are you using any "unusual"
> > kernel config options? I've done the same test myself many times and
> > have not seen any problems...
> 
> It looks like 'the usual' 'several devices sharing a queue' oops on
> unload.

Ahh, cleanup was being done in the wrong order.

Patch coming shortly...

--
Paul

Re: nbd oops on unload. [PATCH x2]

[Paul Clements]

[-- Attachment #1: Type: text/plain, Size: 403 bytes --]

Paul Clements wrote:

> Dave Jones wrote:
> > modprobe nbd ; rmmod nbd  was enough to reproduce this one..
> > (2.6.3rc4)

> Ahh, cleanup was being done in the wrong order.
> 
> Patch coming shortly...

Here it is, as well as another to fix some return codes (so nbd-client
can exit with the proper error code, rather than 0, when an error
occurs).

Tested against 2.6.3-rc2. Please apply.

Thanks,
Paul

[-- Attachment #2: nbd_cleanup_fix_2_6_3.diff --]
[-- Type: text/x-patch, Size: 691 bytes --]

--- 2_6_3_rc2/drivers/block/nbd.c.ERROR_RETURN_FIXES	Wed Feb 18 12:32:42 2004
+++ 2_6_3_rc2/drivers/block/nbd.c	Wed Feb 18 12:44:50 2004
@@ -751,8 +751,7 @@ static int __init nbd_init(void)
 	return 0;
 out:
 	while (i--) {
-		if (nbd_dev[i].disk->queue)
-			blk_cleanup_queue(nbd_dev[i].disk->queue);
+		blk_cleanup_queue(nbd_dev[i].disk->queue);
 		put_disk(nbd_dev[i].disk);
 	}
 	return err;
@@ -764,9 +763,8 @@ static void __exit nbd_cleanup(void)
 	for (i = 0; i < MAX_NBD; i++) {
 		struct gendisk *disk = nbd_dev[i].disk;
 		if (disk) {
-			if (disk->queue)
-				blk_cleanup_queue(disk->queue);
 			del_gendisk(disk);
+			blk_cleanup_queue(disk->queue);
 			put_disk(disk);
 		}
 	}

[-- Attachment #3: nbd_error_return_fixes_2_6_3.diff --]
[-- Type: text/x-patch, Size: 2186 bytes --]

--- 2_6_3_rc2/drivers/block/nbd.c.PRISTINE	Tue Feb 17 13:46:40 2004
+++ 2_6_3_rc2/drivers/block/nbd.c	Wed Feb 18 12:29:15 2004
@@ -221,6 +221,8 @@ static int sock_xmit(struct socket *sock
 			printk(KERN_ERR "nbd: %s - sock=%p at buf=%p, size=%d returned %d.\n",
 			       send? "send": "receive", sock, buf, size, result);
 #endif
+			if (result == 0)
+				result = -EPIPE; /* short read */
 			break;
 		}
 		size -= result;
@@ -309,7 +311,7 @@ void nbd_send_req(struct nbd_device *lo,
 	up(&lo->tx_lock);
 	return;
 
-      error_out:
+error_out:
 	up(&lo->tx_lock);
 	req->errors++;
 }
@@ -358,23 +360,22 @@ struct request *nbd_read_stat(struct nbd
 	if (result <= 0) {
 		printk(KERN_ERR "%s: Receive control failed (result %d)\n",
 				lo->disk->disk_name, result);
-		lo->harderror = result;
-		return NULL;
+		goto harderror;
 	}
 	req = nbd_find_request(lo, reply.handle);
 	if (req == NULL) {
 		printk(KERN_ERR "%s: Unexpected reply (%p)\n",
 				lo->disk->disk_name, reply.handle);
-		lo->harderror = result;
-		return NULL;
+		result = -EBADR;
+		goto harderror;
 	}
 
 	if (ntohl(reply.magic) != NBD_REPLY_MAGIC) {
 		printk(KERN_ERR "%s: Wrong magic (0x%lx)\n",
 				lo->disk->disk_name,
 				(unsigned long)ntohl(reply.magic));
-		lo->harderror = result;
-		return NULL;
+		result = -EPROTO;
+		goto harderror;
 	}
 	if (ntohl(reply.error)) {
 		printk(KERN_ERR "%s: Other side returned error (%d)\n",
@@ -396,8 +397,7 @@ struct request *nbd_read_stat(struct nbd
 					printk(KERN_ERR "%s: Receive data failed (result %d)\n",
 							lo->disk->disk_name,
 							result);
-					lo->harderror = result;
-					return NULL;
+					goto harderror;
 				}
 				dprintk(DBG_RX, "%s: request %p: got %d bytes data\n",
 					lo->disk->disk_name, req, bvec->bv_len);
@@ -405,6 +405,9 @@ struct request *nbd_read_stat(struct nbd
 		}
 	}
 	return req;
+harderror:
+	lo->harderror = result;
+	return NULL;
 }
 
 void nbd_do_it(struct nbd_device *lo)
@@ -416,8 +419,6 @@ void nbd_do_it(struct nbd_device *lo)
 #endif
 	while ((req = nbd_read_stat(lo)) != NULL)
 		nbd_end_request(req);
-	printk(KERN_NOTICE "%s: req should never be null\n",
-			lo->disk->disk_name);
 	return;
 }