lkml.org 
[lkml]   [2008]   [Aug]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectBUG in VFS or block layer
This bug is certainly present in 2.6.27-rc2, and it may be present in
several earlier kernel versions too, perhaps as far back as 2.6.25.
What happens is that in the presence of certain I/O errors, user
processes can hang. Here is a procedure for recreating the bug:

Make sure that CONFIG_USB_GADGET and CONFIG_USB_GADGET_DUMMY_HCD are
enabled as modules, as well as CONFIG_USB_FILE_STORAGE. Apply the
patch below and build the drivers. Then create a blank image file with
1 MB of zeros and load the drivers:

dd if=/dev/zero of=image bs=1M count=1
modprobe dummy-hcd
modprobe g-file-storage file=image

The patch causes a number of sector-read errors to occur, replicating
those in the log attached to

http://marc.info/?l=linux-usb&m=121802760208717&w=2

On my system this leads hald-probe-storage to hang during exit with the
following stack trace:

[ 85.330010] hald-probe-st D e6d17cac 0 2031 1658
[ 85.330174] e6d17cd0 00000046 00000000 e6d17cac ee78d160 e6d83a20 e6d83b74 00000000
[ 85.330600] efb76940 e6d17cb8 c04c447b c17e2024 e6d17cc0 c04c2f0b e6d17cc8 c19d1180
[ 85.331066] c17e2024 c19c8210 e6d17cdc c059c67d e707da48 e6d17cec c0447f64 e6d17d10
[ 85.331534] Call Trace:
[ 85.331693] [<c04c447b>] ? generic_unplug_device+0x16/0x3a
[ 85.331860] [<c04c2f0b>] ? blk_unplug+0xc/0xe
[ 85.332023] [<c059c67d>] io_schedule+0x1e/0x28
[ 85.332149] [<c0447f64>] sync_page+0x46/0x4c
[ 85.332276] [<c059c8c1>] __wait_on_bit_lock+0x30/0x59
[ 85.332403] [<c0447f1e>] ? sync_page+0x0/0x4c
[ 85.332566] [<c0447ee0>] __lock_page+0x4e/0x56
[ 85.332692] [<c042d957>] ? wake_bit_function+0x0/0x43
[ 85.332858] [<c044f0b9>] lock_page+0x27/0x2a
[ 85.332985] [<c044f6b4>] truncate_inode_pages_range+0x218/0x27a
[ 85.333117] [<c0438485>] ? trace_hardirqs_on_caller+0xe1/0x102
[ 85.333283] [<c04384b1>] ? trace_hardirqs_on+0xb/0xd
[ 85.333448] [<c044f722>] truncate_inode_pages+0xc/0x12
[ 85.333576] [<c048590b>] kill_bdev+0x2c/0x2f
[ 85.333704] [<c0485e51>] __blkdev_put+0x4c/0x12b
[ 85.333830] [<c0473747>] ? d_free+0x25/0x37
[ 85.333992] [<c0485f3a>] blkdev_put+0xa/0xc
[ 85.334117] [<c04865a7>] blkdev_close+0x25/0x28
[ 85.334243] [<c04667a3>] __fput+0xae/0x13c
[ 85.334368] [<c0466848>] fput+0x17/0x19
[ 85.334492] [<c04644b8>] filp_close+0x50/0x5a
[ 85.334618] [<c041ee6d>] put_files_struct+0x68/0xaa
[ 85.334746] [<c041eedd>] exit_files+0x2e/0x32
[ 85.334871] [<c041fe4e>] do_exit+0x1df/0x64a
[ 85.334997] [<c04257a4>] ? set_tsk_thread_flag+0xb/0xd
[ 85.335162] [<c04384b1>] ? trace_hardirqs_on+0xb/0xd
[ 85.335326] [<c042033a>] sys_exit_group+0x0/0x11
[ 85.335453] [<c04276e9>] get_signal_to_deliver+0x2ee/0x32d
[ 85.335582] [<c040260e>] do_notify_resume+0x6b/0x5ff
[ 85.335711] [<c04384b1>] ? trace_hardirqs_on+0xb/0xd
[ 85.335875] [<c059cf5c>] ? __mutex_unlock_slowpath+0xf4/0x103
[ 85.336042] [<c059cf73>] ? mutex_unlock+0x8/0xa
[ 85.336204] [<c04858d1>] ? block_llseek+0x94/0xa2
[ 85.336368] [<c0466220>] ? vfs_read+0x78/0xa8
[ 85.336531] [<c0465aa1>] ? do_sync_read+0x0/0xe9
[ 85.336694] [<c0466479>] ? sys_read+0x53/0x5d
[ 85.336857] [<c04030f6>] work_notifysig+0x13/0x19
[ 85.336984] =======================

I don't know enough about the VFS or block layers to track this down
any further.

Alan Stern


Index: usb-2.6/drivers/usb/gadget/file_storage.c
===================================================================
--- usb-2.6.orig/drivers/usb/gadget/file_storage.c
+++ usb-2.6/drivers/usb/gadget/file_storage.c
@@ -1569,6 +1569,11 @@ static int do_read(struct fsg_dev *fsg)
}
file_offset = ((loff_t) lba) << 9;

+ if (lba >= 100) {
+ curlun->sense_data = 0x030000;
+ return -EINVAL;
+ }
+
/* Carry out the file reads */
amount_left = fsg->data_size_from_cmnd;
if (unlikely(amount_left == 0))


\
 
 \ /
  Last update: 2008-08-06 22:43    [W:0.108 / U:0.204 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site