Messages in this thread | | | Date | Mon, 27 Feb 2012 09:40:45 -0500 | From | Vivek Goyal <> | Subject | Re: [PATCHSET] mempool, percpu, blkcg: fix percpu stat allocation and remove stats_lock |
| |
On Mon, Feb 27, 2012 at 09:25:29AM -0500, Vivek Goyal wrote: > On Sun, Feb 26, 2012 at 07:21:13AM +0900, Tejun Heo wrote: > > On Sun, Feb 26, 2012 at 06:46:41AM +0900, Tejun Heo wrote: > > > Hello, > > > > > > On Fri, Feb 24, 2012 at 10:44:32PM -0500, Vivek Goyal wrote: > > > > Booting with blkcg-stacking branch and changing io scheduler from cfq to > > > > deadline oopsed. > > > > > > > > login: [ 67.382768] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC > > > > [ 67.383037] CPU 1 > > > > [ 67.383037] Modules linked in: floppy [last unloaded: scsi_wait_scan] > > > > [ 67.383037] > > > > [ 67.383037] Pid: 4763, comm: bash Not tainted 3.3.0-rc3-tejun-misc+ #6 Hewlett-Packard HP xw6600 Workstation/0A9Ch > > > > [ 67.383037] RIP: 0010:[<ffffffff81311793>] [<ffffffff81311793>] cfq_put_queue+0xb3/0x1d0 > > > > > > Hmmm... weird. Looking into it. I'm away from office for a week and > > > will probably be slow. > > > > It won't reproduce here. Can you please explain how to trigger it? > > Can you please also run addr2line on the oops address? > > I have BLK_CGROUP enabled. CFQ is deafult scheduler. I boot the system and > just change the scheduler to deadline on sda and crash happens. It is > consistently reproducible on my machine. > > add2line points to, blk-cgroup.h > > blkg_put() { > WARN_ON_ONCE(blkg->refcnt <= 0); > } > > I put more printk and we are putting down async queues when crash happens. > > cfq_put_async_queues(). > > So looks like a group might have already been freed. May be it is a group > refcount issue. I see 6b6b6b... pattern in RBX. Sounds like a use after > free thing.
I think problem might be that we have destroyed policy data (cfqg also) early and later we access it.
So we call following.
elevator_switch() blkg_destroy_all() update_root_blkg();
Here update_root_blkg() will free up the blkg->pd for cfq.
And later we call.
elevator_exit() cfq_exit_queue() cfq_put_async_queues() cfq_put_queue() blkg_put(cfqg_to_blkg(cfqg)); <------ trying to reach blkg through already freed policy data.
So we should not free up root group policy data till old elevator has exited.
Thanks Vivek
> > Thanks > Vivek
| |