[2.6.20.4] BUG: dentry xattrs still in use in shrink_dcache_for_umount() with reiserfs

[2.6.20.4] BUG: dentry xattrs still in use in shrink_dcache_for_umount() with reiserfs

[Andrea Righi]

[-- Attachment #1: Type: text/plain, Size: 2553 bytes --]

I can reproduce the problem umounting my /var (reiserfs), but it doesn't
occur with /usr or /opt, that are reiserfs too.

It seems very similar to this issue: 
ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.18-rc3/2.6.18-rc3-mm2/hot-fixes/reiserfs-make-sure-all-dentries-refs-are-released-before-calling-kill_block_super-try-2.patch

How the xattrs->d_count can be 1 if the dentry is explicitly released
in reiserfs_kill_sb(), before calling kill_super_block()?

(config attached)

-Andrea

BUG: Dentry dfcd2570{i=21bc,n=xattrs} still in use (1) [unmount of reiserfs dm-4]
------------[ cut here ]------------
kernel BUG at fs/dcache.c:623!
invalid opcode: 0000 [#1]
PREEMPT
Modules linked in: fuse hdaps ipt_TCPMSS xt_tcpudp ipt_LOG xt_limit cpufreq_ondemand cpufreq_powersave cpufreq_userspace speedstep_centrino ibm_acpi backlight button battery ac snd_pcm_oss snd_mixer_oss snd_seq snd_seq_device xt_state ipt_REJECT usbhid iptable_mangle iptable_nat nf_nat iptable_filter nf_conntrack_ipv4 nf_conntrack nfnetlink ip_tables x_tables hci_usb bluetooth ehci_hcd uhci_hcd usbcore snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm snd_timer snd_page_alloc tg3 reiserfs dm_snapshot dm_mod fan thermal processor sr_mod cdrom ata_piix ahci
CPU:    0
EIP:    0060:[<c0173d86>]    Not tainted VLI
EFLAGS: 00010286   (2.6.20.4 #8)
EIP is at shrink_dcache_for_umount_subtree+0x236/0x270
eax: 00000055   ebx: dfcd25c8   ecx: ffffffff   edx: 00000000
esi: dfcd2570   edi: f5afad24   ebp: 000021bc   esp: f6bd9ed0
ds: 007b   es: 007b   ss: 0068
Process umount (pid: 6659, ti=f6bd8000 task=f6374a70 task.ti=f6bd8000)
Stack: c038f488 dfcd2570 000021bc dfcd25c8 00000001 f8bee08b f5afad24 f5afac00
       f5afac00 f6bd9f40 dfff4ac0 c0173de5 f8bf92e0 f5afac00 c0164208 c1a32c80
       f5afac00 c1a32c80 f5afac00 c0164325 f5afac00 f8bf92a0 c0164545 00000000
Call Trace:
 [<c0173de5>] shrink_dcache_for_umount+0x25/0x50
 [<c0164208>] generic_shutdown_super+0x18/0x110
 [<c0164325>] kill_block_super+0x25/0x40
 [<c0164545>] deactivate_super+0x55/0x80
 [<c017994a>] sys_umount+0x4a/0x210
 [<c01535b9>] unmap_region+0xb9/0x120
 [<c0115fd7>] do_page_fault+0x327/0x650
 [<c0179b25>] sys_oldumount+0x15/0x20
 [<c0102fa0>] sysenter_past_esp+0x5d/0x81
 =======================
Code: 8b 00 74 03 8b 6a 20 89 7c 24 18 89 4c 24 10 89 5c 24 0c 89 6c 24 08 89 74 24 04 89 44 24 14 c7 04 24 88 f4 38 c0 e8 ea 87 fa ff <0f> 0b eb fe 0f 0b eb fe 83 c4 1c 5b 5e 5f 5d e9 16 bf 1c 00 e8
EIP: [<c0173d86>] shrink_dcache_for_umount_subtree+0x236/0x270 SS:ESP 0068:f6bd9ed0



[-- Attachment #2: config.gz --]
[-- Type: application/x-gzip, Size: 12185 bytes --]

Re: [2.6.20.4] BUG: dentry xattrs still in use in shrink_dcache_for_umount() with reiserfs

[Andrea Righi]

FYI, this bug occurs also in 2.6.20.7 vanilla...

Honestly I don't know if I'm doing nasty things there, but I tested the
following patch and it seems to fix the problem (at least for my case).

It explicitly invalidates all the dentries in the reiserfs "private" dir
and releases all the valid xattrs references before calling
kill_block_super().

Signed-off-by: Andrea Righi <a.righi@cineca.it>

--- linux-2.6.20.7/include/linux/reiserfs_xattr.h.orig	2007-04-14 22:00:38.000000000 +0200
+++ linux-2.6.20.7/include/linux/reiserfs_xattr.h	2007-04-14 22:12:43.000000000 +0200
@@ -7,6 +7,9 @@
 /* Magic value in header */
 #define REISERFS_XATTR_MAGIC 0x52465841	/* "RFXA" */
 
+#define PRIVROOT_NAME ".reiserfs_priv"
+#define XAROOT_NAME   "xattrs"
+
 struct reiserfs_xattr_header {
 	__le32 h_magic;		/* magic number for identification */
 	__le32 h_hash;		/* hash of the value */
--- linux-2.6.20.7/fs/reiserfs/xattr.c.orig	2007-04-14 18:53:02.000000000 +0200
+++ linux-2.6.20.7/fs/reiserfs/xattr.c	2007-04-14 22:12:43.000000000 +0200
@@ -48,8 +48,6 @@
 
 #define FL_READONLY 128
 #define FL_DIR_SEM_HELD 256
-#define PRIVROOT_NAME ".reiserfs_priv"
-#define XAROOT_NAME   "xattrs"
 
 static struct reiserfs_xattr_handler *find_xattr_handler_prefix(const char
 								*prefix);
--- linux-2.6.20.7/fs/reiserfs/super.c.orig	2007-04-14 18:53:06.000000000 +0200
+++ linux-2.6.20.7/fs/reiserfs/super.c	2007-04-14 22:47:06.000000000 +0200
@@ -432,17 +432,30 @@ int remove_save_link(struct inode *inode
 
 static void reiserfs_kill_sb(struct super_block *s)
 {
+	struct dentry *priv;
+
 	if (REISERFS_SB(s)) {
-		if (REISERFS_SB(s)->xattr_root) {
-			d_invalidate(REISERFS_SB(s)->xattr_root);
-			dput(REISERFS_SB(s)->xattr_root);
-			REISERFS_SB(s)->xattr_root = NULL;
-		}
+		priv = REISERFS_SB(s)->priv_root;
+		if (priv) {
+			struct dentry *loop, *tmp;
 
-		if (REISERFS_SB(s)->priv_root) {
-			d_invalidate(REISERFS_SB(s)->priv_root);
-			dput(REISERFS_SB(s)->priv_root);
 			REISERFS_SB(s)->priv_root = NULL;
+#ifdef CONFIG_REISERFS_FS_XATTR
+			REISERFS_SB(s)->xattr_root = NULL;
+
+			list_for_each_entry_safe(loop, tmp,
+						 &priv->d_subdirs,
+						 d_u.d_child) {
+				d_invalidate(loop);
+				if (!strcmp(loop->d_name.name, XAROOT_NAME)) {
+					if (loop->d_inode) {
+						dput(loop);
+					}
+				}
+			}
+#endif
+			d_invalidate(priv);
+			dput(priv);
 		}
 	}