Messages in this thread | | | Date | Mon, 9 Jun 2008 17:38:56 +0200 | From | Ingo Molnar <> | Subject | Re: [bug, 2.6.26-rc4/rc5] sporadic bootup crashes in blk_lookup_devt()/prepare_namespace() |
| |
* Linus Torvalds <torvalds@linux-foundation.org> wrote:
> On Mon, 9 Jun 2008, Cornelia Huck wrote: > > > > Does this crash happen with the conversion to the class iterator > > functions (should be in linux-next) as well? They take the class > > mutex... > > I really don't think it's the locking, although I do agree that the > locking looks bogus _too_. > > I suspect that the problem is even simpler than that. On the > "block_class.devices" list we can have two types of devices: the ones > that have been added by the block/genhd.c code (disks: dev->type > "disk_type"), and the ones that are added by the class layer for > partitions (partitions: dev.type "part_type"). > > And *all* the block/genhd.c loops over that device list look like this: > > list_for_each_entry(dev, &block_class.devices, node) { > if (dev->type != &disk_type) > continue; > sgp = dev_to_disk(dev); > ... > > because you cannot do that "dev_to_disk()" on a partition entry (it > won't have a container of type gendisk, it will be of type hd_struct). > > Well, all except one. Guess which one.. > > So I suspect that (a) yes, we need to fix the locking, but (b) the fix for > this particular bug is probably the trivial one appended. > > And yes, this bug was introduced by commit 30f2f0eb4b ("block: > do_mounts - accept root=<non-existant partition>"), so the alternative > is to revert it entirely. Kay?
ah. I suspect that explains the sporadic nature as well: normally there is 'some' object at the list address, just with an invalid type.
The invalid type only gets visible as a hard crash if due to PAGEALLOC the structure sizes and kmalloc/slab details cause the invalid access to go to a not yet allocated page. (and then it crashes there)
And that in itself is a rather unlikely and fragile condition (it might even depend on timings of various allocations), that's why the bug wasnt really reproducible deterministically.
Ingo
| |