lkml.org 
[lkml]   [2005]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] Split the checkpoint lists
Jan Kara <jack@ucw.cz> wrote:
>
>
> attached patch (to be applied after my previous two bugfixes) is a new
> version of my patch splitting the JBD checkpoint lists into two

Seems to have a use-after-free bug. Did you test it with CONFIG_SLAB_DEBUG?


Unable to handle kernel paging request at virtual address 6b6b6b9b
printing eip:
c01a8a88
*pde = 00000000
Oops: 0000 [#1]
SMP
Modules linked in: video thermal processor fan button battery ac
CPU: 0
EIP: 0060:[<c01a8a88>] Not tainted VLI
EFLAGS: 00010202 (2.6.12-rc5-mm3)
EIP is at journal_clean_one_cp_list+0x18/0x6c
eax: 6b6b6b6b ebx: 6b6b6b6b ecx: 00000001 edx: c1ada000
esi: 00000000 edi: 6b6b6b6b ebp: c1adbec8 esp: c1adbeb4
ds: 007b es: 007b ss: 0068
Process kjournald (pid: 971, threadinfo=c1ada000 task=cfd01030)
Stack: ce5e11a4 00000078 c1a20dac c1ada000 cdd767c8 c1adbee8 c01a8b29 6b6b6b6b
cddd8604 cfdddb08 cfdddb08 c1ada000 cddd8ec4 c1adbf78 c01a66de cfdddaf4
cfdddaf4 cfdddb08 cfdddb08 cfdddbb4 cfdddb48 cddd8640 cfdddb30 cfdddb08
Call Trace:
[<c0103967>] show_stack+0x7b/0x88
[<c0103aa6>] show_registers+0x112/0x188
[<c0103c8f>] die+0xe7/0x168
[<c011225c>] do_page_fault+0x4e4/0x6e2
[<c01035a3>] error_code+0x4f/0x54
[<c01a8b29>] __journal_clean_checkpoint_list+0x4d/0x70
[<c01a66de>] journal_commit_transaction+0x33e/0x12c1
[<c01a9ccd>] kjournald+0x125/0x34c
[<c0100fcd>] kernel_thread_helper+0x5/0xc
Code: 24 00 00 83 c4 08 31 c0 8d 65 f0 5b 5e 5f 89 ec 5d c3 90 55 89 e5 83 ec 08 57 56 53 8b 5d 08 89 df 31 f6 85 d
I can't immediately spot the error. It oopses here:

0xc01a5b78 is in journal_clean_one_cp_list (fs/jbd/checkpoint.c:583).
578 int ret = 0;
579
580 if (!jh)
581 return 0;
582
583 last_jh = jh->b_cpprev;
584 do {
585 jh = next_jh;
586 next_jh = jh->b_cpnext;
587 /* Use trylock because of the ranking */
Called from here:


0xc01a5c10 is in __journal_clean_checkpoint_list (fs/jbd/checkpoint.c:635).
630 goto out;
631 /* It is essential that we are as careful as in the case of
632 t_checkpoint_list with removing the buffer from the list
633 as we can possibly see not yet submitted buffers on
634 io_list */
635 ret += journal_clean_one_cp_list(transaction->
636 t_checkpoint_io_list);
637 if (need_resched())
638 goto out;
639 } while (transaction != last_transaction);
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2005-06-03 11:01    [from the cache]
©2003-2011 Jasper Spaans