Re: Oops in 2.6.13-rc5-git-current (0d317fb72fe3cf0f611608cf3a3015bbe6cd2a66)

2005-08-07 Thread Ryan Anderson
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Alexander Nyberg wrote:
> (akpm: a fix for this needs to go into 2.6.13, inotify + nfs 
> trivially oopses otherwise, even if inotify isn't actively used)

This patch seems to have fixed it for me.

I upgraded to fdbd22dad31982b64a4e663fd056a8a7cfac9607 and applied this
patch on top of it, and I can't retrigger the oops.  (It seemed rather
easy to hit on the other kernel)

So, I guess:

Seems-to-fix-it: Ryan Anderson <[EMAIL PROTECTED]>

> It looks like the following sequence is done in the wrong order.
> When vfs_unlink() is called from sys_unlink() it has taken a ref
> on the inode and sys_unlink() does the last iput() but when called
> from other callsites vfs_unlink() might do the last iput() and
> free inode, so inotify_inode_queue_event() will receive an already
> freed object and dereference an already freed object.
> 
> Signed-off-by: Alexander Nyberg <[EMAIL PROTECTED]>
> 
> Index: mm/fs/namei.c
> ===
> --- mm.orig/fs/namei.c2005-08-07 12:06:16.0 +0200
> +++ mm/fs/namei.c 2005-08-07 18:17:20.0 +0200
> @@ -1869,8 +1869,8 @@
>   /* We don't d_delete() NFS sillyrenamed files--they still exist. */
>   if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
>   struct inode *inode = dentry->d_inode;
> - d_delete(dentry);
>   fsnotify_unlink(dentry, inode, dir);
> + d_delete(dentry);
>   }
>  
>   return error;
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to [EMAIL PROTECTED]
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFC9pgyfhVDhkBuUKURAjbSAKCavd7s4zdk/uce1TZ0CX018RGRmgCfXWFI
XjAPhBcEoLyJDWnjk9oI+XI=
=NMc4
-END PGP SIGNATURE-
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: Oops in 2.6.13-rc5-git-current (0d317fb72fe3cf0f611608cf3a3015bbe6cd2a66)

2005-08-07 Thread Alexander Nyberg
> Unable to handle kernel paging request at virtual address 6b6b6b6b
>  printing eip:
> c0188d15
> *pde = 
> Oops:  [#1]
> PREEMPT 
> CPU:0
> EIP:0060:[inotify_inode_queue_event+85/336]Not tainted VLI
> EFLAGS: 00010206   (2.6.13-rc5-g0d317fb7) 
> EIP is at inotify_inode_queue_event+0x55/0x150
> eax: 6b6b6b6b   ebx: 6b6b6b63   ecx:    edx: 0066
> esi: c3effe34   edi: ce8c76ac   ebp: d4bb864c   esp: d8655eb0
> ds: 007b   es: 007b   ss: 0068
> Process nfsd (pid: 3750, threadinfo=d8654000 task=d6155020)
> Stack: 0286 0286  0400 d4bb8760 d4bb8768  
> c3effe34 
>ce8c76ac d4bb864c c0170626  c3effe34 d6608ad4 db74b17c 
> c3effe34 
>e0cfe9a4 0013 e0d01b34 c0dd91b4 ce8c76ac c000 d66092dc 
> d66093c4 
> Call Trace:
>  [vfs_unlink+358/560] vfs_unlink+0x166/0x230
>  [pg0+544348580/1067586560] nfsd_unlink+0x104/0x230 [nfsd]
>  [pg0+544361268/1067586560] nfsd_cache_lookup+0x1c4/0x3c0 [nfsd]
>  [pg0+544371728/1067586560] nfsd3_proc_remove+0x80/0xc0 [nfsd]
>  [pg0+544381018/1067586560] nfs3svc_decode_diropargs+0x8a/0x100 [nfsd]
>  [pg0+544380880/1067586560] nfs3svc_decode_diropargs+0x0/0x100 [nfsd]
>  [pg0+544321698/1067586560] nfsd_dispatch+0x82/0x1f0 [nfsd]
>  [svc_authenticate+112/336] svc_authenticate+0x70/0x150
>  [svc_process+960/1648] svc_process+0x3c0/0x670
>  [pg0+544323105/1067586560] nfsd+0x1a1/0x350 [nfsd]
>  [ret_from_fork+6/20] ret_from_fork+0x6/0x14
>  [pg0+544322688/1067586560] nfsd+0x0/0x350 [nfsd]
>  [kernel_thread_helper+5/16] kernel_thread_helper+0x5/0x10

(akpm: a fix for this needs to go into 2.6.13, inotify + nfs 
trivially oopses otherwise, even if inotify isn't actively used)

It looks like the following sequence is done in the wrong order.
When vfs_unlink() is called from sys_unlink() it has taken a ref
on the inode and sys_unlink() does the last iput() but when called
from other callsites vfs_unlink() might do the last iput() and
free inode, so inotify_inode_queue_event() will receive an already
freed object and dereference an already freed object.

Signed-off-by: Alexander Nyberg <[EMAIL PROTECTED]>

Index: mm/fs/namei.c
===
--- mm.orig/fs/namei.c  2005-08-07 12:06:16.0 +0200
+++ mm/fs/namei.c   2005-08-07 18:17:20.0 +0200
@@ -1869,8 +1869,8 @@
/* We don't d_delete() NFS sillyrenamed files--they still exist. */
if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
struct inode *inode = dentry->d_inode;
-   d_delete(dentry);
fsnotify_unlink(dentry, inode, dir);
+   d_delete(dentry);
}
 
return error;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: Oops in 2.6.13-rc5-git-current (0d317fb72fe3cf0f611608cf3a3015bbe6cd2a66)

2005-08-07 Thread Ryan Anderson
(Snipping the oops down a bit in size)

On Sun, Aug 07, 2005 at 07:08:05PM +0200, Alexander Nyberg wrote:
> On Sat, Aug 06, 2005 at 11:56:30PM -0400 Ryan Anderson wrote:
> > Unable to handle kernel paging request at virtual address 6b6b6b6b

> > EIP is at inotify_inode_queue_event+0x55/0x150

> > Call Trace:
> >  [vfs_unlink+358/560] vfs_unlink+0x166/0x230
> >  [pg0+544348580/1067586560] nfsd_unlink+0x104/0x230 [nfsd]
> >  [pg0+544361268/1067586560] nfsd_cache_lookup+0x1c4/0x3c0 [nfsd]
> >  [pg0+544371728/1067586560] nfsd3_proc_remove+0x80/0xc0 [nfsd]
> >  [pg0+544381018/1067586560] nfs3svc_decode_diropargs+0x8a/0x100 [nfsd]
> >  [pg0+544380880/1067586560] nfs3svc_decode_diropargs+0x0/0x100 [nfsd]
> >  [pg0+544321698/1067586560] nfsd_dispatch+0x82/0x1f0 [nfsd]
> >  [svc_authenticate+112/336] svc_authenticate+0x70/0x150
> >  [svc_process+960/1648] svc_process+0x3c0/0x670
> >  [pg0+544323105/1067586560] nfsd+0x1a1/0x350 [nfsd]
> >  [ret_from_fork+6/20] ret_from_fork+0x6/0x14
> >  [pg0+544322688/1067586560] nfsd+0x0/0x350 [nfsd]
> >  [kernel_thread_helper+5/16] kernel_thread_helper+0x5/0x10
> 
> (the long-aged vfs veteran steps into the picture...)
> 
> It looks like the following sequence is done in the wrong order.
> When vfs_unlink() is called from sys_unlink() it has taken a ref
> on the inode and sys_unlink() does the last iput() but when called
> from other callsites vfs_unlink() might do the last iput()
> 
> Can you reproduce with this patch? It should happen with some nfs
> activity, I'll try to set up a scenario myself.

I'll try after I get a new hard drive in and let the RAID rebuild.

It seems like a very big coincidence that this happened *right* as a
drive was failing though - or is that just a bizarre coincidence?

-- 

Ryan Anderson
  sometimes Pug Majere
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: Oops in 2.6.13-rc5-git-current (0d317fb72fe3cf0f611608cf3a3015bbe6cd2a66)

2005-08-07 Thread Alexander Nyberg
On Sat, Aug 06, 2005 at 11:56:30PM -0400 Ryan Anderson wrote:

> 
> Unable to handle kernel paging request at virtual address 6b6b6b6b
>  printing eip:
> c0188d15
> *pde = 
> Oops:  [#1]
> PREEMPT 
> Modules linked in: ppp_deflate bsd_comp ppp_async ppp_generic slhc radeon 
> esp6 ah6 wp512 tgr192 tea khazad michael_mic cast6 cast5 arc4 anubis nfsd 
> exportfs lp binfmt_misc ipv6 tsdev evdev analog parport_pc parport 8250_pnp 
> 8250 serial_core via_agp serpent aes_i586 crypto_null snd_via82xx gameport 
> snd_ac97_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc 
> snd_mpu401_uart snd_rawmidi snd_seq_device snd soundcore uhci_hcd via_ircc 
> irda dm_mod r8169 raid5 xor tulip via drm agpgart cpuid smbfs usbkbd usbcore 
> trm290 triflex sc1200 ns87415 it821x cy82c693 cs5530 cs5520 atiixp raid1 
> md_mod
> CPU:0
> EIP:0060:[inotify_inode_queue_event+85/336]Not tainted VLI
> EFLAGS: 00010206   (2.6.13-rc5-g0d317fb7) 
> EIP is at inotify_inode_queue_event+0x55/0x150
> eax: 6b6b6b6b   ebx: 6b6b6b63   ecx:    edx: 0066
> esi: c3effe34   edi: ce8c76ac   ebp: d4bb864c   esp: d8655eb0
> ds: 007b   es: 007b   ss: 0068
> Process nfsd (pid: 3750, threadinfo=d8654000 task=d6155020)
> Stack: 0286 0286  0400 d4bb8760 d4bb8768  
> c3effe34 
>ce8c76ac d4bb864c c0170626  c3effe34 d6608ad4 db74b17c 
> c3effe34 
>e0cfe9a4 0013 e0d01b34 c0dd91b4 ce8c76ac c000 d66092dc 
> d66093c4 
> Call Trace:
>  [vfs_unlink+358/560] vfs_unlink+0x166/0x230
>  [pg0+544348580/1067586560] nfsd_unlink+0x104/0x230 [nfsd]
>  [pg0+544361268/1067586560] nfsd_cache_lookup+0x1c4/0x3c0 [nfsd]
>  [pg0+544371728/1067586560] nfsd3_proc_remove+0x80/0xc0 [nfsd]
>  [pg0+544381018/1067586560] nfs3svc_decode_diropargs+0x8a/0x100 [nfsd]
>  [pg0+544380880/1067586560] nfs3svc_decode_diropargs+0x0/0x100 [nfsd]
>  [pg0+544321698/1067586560] nfsd_dispatch+0x82/0x1f0 [nfsd]
>  [svc_authenticate+112/336] svc_authenticate+0x70/0x150
>  [svc_process+960/1648] svc_process+0x3c0/0x670
>  [pg0+544323105/1067586560] nfsd+0x1a1/0x350 [nfsd]
>  [ret_from_fork+6/20] ret_from_fork+0x6/0x14
>  [pg0+544322688/1067586560] nfsd+0x0/0x350 [nfsd]
>  [kernel_thread_helper+5/16] kernel_thread_helper+0x5/0x10

(the long-aged vfs veteran steps into the picture...)

It looks like the following sequence is done in the wrong order.
When vfs_unlink() is called from sys_unlink() it has taken a ref
on the inode and sys_unlink() does the last iput() but when called
from other callsites vfs_unlink() might do the last iput()

Can you reproduce with this patch? It should happen with some nfs
activity, I'll try to set up a scenario myself.

Index: mm/fs/namei.c
===
--- mm.orig/fs/namei.c  2005-08-07 12:06:16.0 +0200
+++ mm/fs/namei.c   2005-08-07 18:17:20.0 +0200
@@ -1869,8 +1869,8 @@
/* We don't d_delete() NFS sillyrenamed files--they still exist. */
if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
struct inode *inode = dentry->d_inode;
-   d_delete(dentry);
fsnotify_unlink(dentry, inode, dir);
+   d_delete(dentry);
}
 
return error;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: Oops in 2.6.13-rc5-git-current (0d317fb72fe3cf0f611608cf3a3015bbe6cd2a66)

2005-08-07 Thread Alexander Nyberg
On Sat, Aug 06, 2005 at 11:56:30PM -0400 Ryan Anderson wrote:

 
 Unable to handle kernel paging request at virtual address 6b6b6b6b
  printing eip:
 c0188d15
 *pde = 
 Oops:  [#1]
 PREEMPT 
 Modules linked in: ppp_deflate bsd_comp ppp_async ppp_generic slhc radeon 
 esp6 ah6 wp512 tgr192 tea khazad michael_mic cast6 cast5 arc4 anubis nfsd 
 exportfs lp binfmt_misc ipv6 tsdev evdev analog parport_pc parport 8250_pnp 
 8250 serial_core via_agp serpent aes_i586 crypto_null snd_via82xx gameport 
 snd_ac97_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc 
 snd_mpu401_uart snd_rawmidi snd_seq_device snd soundcore uhci_hcd via_ircc 
 irda dm_mod r8169 raid5 xor tulip via drm agpgart cpuid smbfs usbkbd usbcore 
 trm290 triflex sc1200 ns87415 it821x cy82c693 cs5530 cs5520 atiixp raid1 
 md_mod
 CPU:0
 EIP:0060:[inotify_inode_queue_event+85/336]Not tainted VLI
 EFLAGS: 00010206   (2.6.13-rc5-g0d317fb7) 
 EIP is at inotify_inode_queue_event+0x55/0x150
 eax: 6b6b6b6b   ebx: 6b6b6b63   ecx:    edx: 0066
 esi: c3effe34   edi: ce8c76ac   ebp: d4bb864c   esp: d8655eb0
 ds: 007b   es: 007b   ss: 0068
 Process nfsd (pid: 3750, threadinfo=d8654000 task=d6155020)
 Stack: 0286 0286  0400 d4bb8760 d4bb8768  
 c3effe34 
ce8c76ac d4bb864c c0170626  c3effe34 d6608ad4 db74b17c 
 c3effe34 
e0cfe9a4 0013 e0d01b34 c0dd91b4 ce8c76ac c000 d66092dc 
 d66093c4 
 Call Trace:
  [vfs_unlink+358/560] vfs_unlink+0x166/0x230
  [pg0+544348580/1067586560] nfsd_unlink+0x104/0x230 [nfsd]
  [pg0+544361268/1067586560] nfsd_cache_lookup+0x1c4/0x3c0 [nfsd]
  [pg0+544371728/1067586560] nfsd3_proc_remove+0x80/0xc0 [nfsd]
  [pg0+544381018/1067586560] nfs3svc_decode_diropargs+0x8a/0x100 [nfsd]
  [pg0+544380880/1067586560] nfs3svc_decode_diropargs+0x0/0x100 [nfsd]
  [pg0+544321698/1067586560] nfsd_dispatch+0x82/0x1f0 [nfsd]
  [svc_authenticate+112/336] svc_authenticate+0x70/0x150
  [svc_process+960/1648] svc_process+0x3c0/0x670
  [pg0+544323105/1067586560] nfsd+0x1a1/0x350 [nfsd]
  [ret_from_fork+6/20] ret_from_fork+0x6/0x14
  [pg0+544322688/1067586560] nfsd+0x0/0x350 [nfsd]
  [kernel_thread_helper+5/16] kernel_thread_helper+0x5/0x10

(the long-aged vfs veteran steps into the picture...)

It looks like the following sequence is done in the wrong order.
When vfs_unlink() is called from sys_unlink() it has taken a ref
on the inode and sys_unlink() does the last iput() but when called
from other callsites vfs_unlink() might do the last iput()

Can you reproduce with this patch? It should happen with some nfs
activity, I'll try to set up a scenario myself.

Index: mm/fs/namei.c
===
--- mm.orig/fs/namei.c  2005-08-07 12:06:16.0 +0200
+++ mm/fs/namei.c   2005-08-07 18:17:20.0 +0200
@@ -1869,8 +1869,8 @@
/* We don't d_delete() NFS sillyrenamed files--they still exist. */
if (!error  !(dentry-d_flags  DCACHE_NFSFS_RENAMED)) {
struct inode *inode = dentry-d_inode;
-   d_delete(dentry);
fsnotify_unlink(dentry, inode, dir);
+   d_delete(dentry);
}
 
return error;
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: Oops in 2.6.13-rc5-git-current (0d317fb72fe3cf0f611608cf3a3015bbe6cd2a66)

2005-08-07 Thread Ryan Anderson
(Snipping the oops down a bit in size)

On Sun, Aug 07, 2005 at 07:08:05PM +0200, Alexander Nyberg wrote:
 On Sat, Aug 06, 2005 at 11:56:30PM -0400 Ryan Anderson wrote:
  Unable to handle kernel paging request at virtual address 6b6b6b6b

  EIP is at inotify_inode_queue_event+0x55/0x150

  Call Trace:
   [vfs_unlink+358/560] vfs_unlink+0x166/0x230
   [pg0+544348580/1067586560] nfsd_unlink+0x104/0x230 [nfsd]
   [pg0+544361268/1067586560] nfsd_cache_lookup+0x1c4/0x3c0 [nfsd]
   [pg0+544371728/1067586560] nfsd3_proc_remove+0x80/0xc0 [nfsd]
   [pg0+544381018/1067586560] nfs3svc_decode_diropargs+0x8a/0x100 [nfsd]
   [pg0+544380880/1067586560] nfs3svc_decode_diropargs+0x0/0x100 [nfsd]
   [pg0+544321698/1067586560] nfsd_dispatch+0x82/0x1f0 [nfsd]
   [svc_authenticate+112/336] svc_authenticate+0x70/0x150
   [svc_process+960/1648] svc_process+0x3c0/0x670
   [pg0+544323105/1067586560] nfsd+0x1a1/0x350 [nfsd]
   [ret_from_fork+6/20] ret_from_fork+0x6/0x14
   [pg0+544322688/1067586560] nfsd+0x0/0x350 [nfsd]
   [kernel_thread_helper+5/16] kernel_thread_helper+0x5/0x10
 
 (the long-aged vfs veteran steps into the picture...)
 
 It looks like the following sequence is done in the wrong order.
 When vfs_unlink() is called from sys_unlink() it has taken a ref
 on the inode and sys_unlink() does the last iput() but when called
 from other callsites vfs_unlink() might do the last iput()
 
 Can you reproduce with this patch? It should happen with some nfs
 activity, I'll try to set up a scenario myself.

I'll try after I get a new hard drive in and let the RAID rebuild.

It seems like a very big coincidence that this happened *right* as a
drive was failing though - or is that just a bizarre coincidence?

-- 

Ryan Anderson
  sometimes Pug Majere
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: Oops in 2.6.13-rc5-git-current (0d317fb72fe3cf0f611608cf3a3015bbe6cd2a66)

2005-08-07 Thread Alexander Nyberg
 Unable to handle kernel paging request at virtual address 6b6b6b6b
  printing eip:
 c0188d15
 *pde = 
 Oops:  [#1]
 PREEMPT 
 CPU:0
 EIP:0060:[inotify_inode_queue_event+85/336]Not tainted VLI
 EFLAGS: 00010206   (2.6.13-rc5-g0d317fb7) 
 EIP is at inotify_inode_queue_event+0x55/0x150
 eax: 6b6b6b6b   ebx: 6b6b6b63   ecx:    edx: 0066
 esi: c3effe34   edi: ce8c76ac   ebp: d4bb864c   esp: d8655eb0
 ds: 007b   es: 007b   ss: 0068
 Process nfsd (pid: 3750, threadinfo=d8654000 task=d6155020)
 Stack: 0286 0286  0400 d4bb8760 d4bb8768  
 c3effe34 
ce8c76ac d4bb864c c0170626  c3effe34 d6608ad4 db74b17c 
 c3effe34 
e0cfe9a4 0013 e0d01b34 c0dd91b4 ce8c76ac c000 d66092dc 
 d66093c4 
 Call Trace:
  [vfs_unlink+358/560] vfs_unlink+0x166/0x230
  [pg0+544348580/1067586560] nfsd_unlink+0x104/0x230 [nfsd]
  [pg0+544361268/1067586560] nfsd_cache_lookup+0x1c4/0x3c0 [nfsd]
  [pg0+544371728/1067586560] nfsd3_proc_remove+0x80/0xc0 [nfsd]
  [pg0+544381018/1067586560] nfs3svc_decode_diropargs+0x8a/0x100 [nfsd]
  [pg0+544380880/1067586560] nfs3svc_decode_diropargs+0x0/0x100 [nfsd]
  [pg0+544321698/1067586560] nfsd_dispatch+0x82/0x1f0 [nfsd]
  [svc_authenticate+112/336] svc_authenticate+0x70/0x150
  [svc_process+960/1648] svc_process+0x3c0/0x670
  [pg0+544323105/1067586560] nfsd+0x1a1/0x350 [nfsd]
  [ret_from_fork+6/20] ret_from_fork+0x6/0x14
  [pg0+544322688/1067586560] nfsd+0x0/0x350 [nfsd]
  [kernel_thread_helper+5/16] kernel_thread_helper+0x5/0x10

(akpm: a fix for this needs to go into 2.6.13, inotify + nfs 
trivially oopses otherwise, even if inotify isn't actively used)

It looks like the following sequence is done in the wrong order.
When vfs_unlink() is called from sys_unlink() it has taken a ref
on the inode and sys_unlink() does the last iput() but when called
from other callsites vfs_unlink() might do the last iput() and
free inode, so inotify_inode_queue_event() will receive an already
freed object and dereference an already freed object.

Signed-off-by: Alexander Nyberg [EMAIL PROTECTED]

Index: mm/fs/namei.c
===
--- mm.orig/fs/namei.c  2005-08-07 12:06:16.0 +0200
+++ mm/fs/namei.c   2005-08-07 18:17:20.0 +0200
@@ -1869,8 +1869,8 @@
/* We don't d_delete() NFS sillyrenamed files--they still exist. */
if (!error  !(dentry-d_flags  DCACHE_NFSFS_RENAMED)) {
struct inode *inode = dentry-d_inode;
-   d_delete(dentry);
fsnotify_unlink(dentry, inode, dir);
+   d_delete(dentry);
}
 
return error;
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: Oops in 2.6.13-rc5-git-current (0d317fb72fe3cf0f611608cf3a3015bbe6cd2a66)

2005-08-07 Thread Ryan Anderson
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Alexander Nyberg wrote:
 (akpm: a fix for this needs to go into 2.6.13, inotify + nfs 
 trivially oopses otherwise, even if inotify isn't actively used)

This patch seems to have fixed it for me.

I upgraded to fdbd22dad31982b64a4e663fd056a8a7cfac9607 and applied this
patch on top of it, and I can't retrigger the oops.  (It seemed rather
easy to hit on the other kernel)

So, I guess:

Seems-to-fix-it: Ryan Anderson [EMAIL PROTECTED]

 It looks like the following sequence is done in the wrong order.
 When vfs_unlink() is called from sys_unlink() it has taken a ref
 on the inode and sys_unlink() does the last iput() but when called
 from other callsites vfs_unlink() might do the last iput() and
 free inode, so inotify_inode_queue_event() will receive an already
 freed object and dereference an already freed object.
 
 Signed-off-by: Alexander Nyberg [EMAIL PROTECTED]
 
 Index: mm/fs/namei.c
 ===
 --- mm.orig/fs/namei.c2005-08-07 12:06:16.0 +0200
 +++ mm/fs/namei.c 2005-08-07 18:17:20.0 +0200
 @@ -1869,8 +1869,8 @@
   /* We don't d_delete() NFS sillyrenamed files--they still exist. */
   if (!error  !(dentry-d_flags  DCACHE_NFSFS_RENAMED)) {
   struct inode *inode = dentry-d_inode;
 - d_delete(dentry);
   fsnotify_unlink(dentry, inode, dir);
 + d_delete(dentry);
   }
  
   return error;
 -
 To unsubscribe from this list: send the line unsubscribe linux-kernel in
 the body of a message to [EMAIL PROTECTED]
 More majordomo info at  http://vger.kernel.org/majordomo-info.html
 Please read the FAQ at  http://www.tux.org/lkml/
 

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFC9pgyfhVDhkBuUKURAjbSAKCavd7s4zdk/uce1TZ0CX018RGRmgCfXWFI
XjAPhBcEoLyJDWnjk9oI+XI=
=NMc4
-END PGP SIGNATURE-
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/