linux-ext4 - Re: Oops with ext4 from 2.6.27-rc3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <OF45EB84A0.4D9527E0-ON652574A5.00168DD0-652574A5.0016C100@in.ibm.com>
Date:	Thu, 14 Aug 2008 09:42:04 +0530
From:	Rishikesh K Rajak <risrajak@...ibm.com>
To:	Theodore Tso <tytso@....edu>
Cc:	linux-ext4@...r.kernel.org, linux-ext4-owner@...r.kernel.org,
	Christian Hesse <mail@...rm.de>,
	Eric Sandeen <sandeen@...hat.com>,
	"Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com>,
	Iranna D Ankad <iranna.ankad@...ibm.com>
Subject: Re: Oops with ext4 from 2.6.27-rc3

linux-ext4-owner@...r.kernel.org wrote on 08/14/2008 04:15:34 AM:

> Theodore Tso <tytso@....edu>
> Sent by: linux-ext4-owner@...r.kernel.org
>
> 08/14/2008 04:15 AM
>
> To
>
> Eric Sandeen <sandeen@...hat.com>
>
> cc
>
> Christian Hesse <mail@...rm.de>, linux-ext4@...r.kernel.org
>
> Subject
>
> Re: Oops with ext4 from 2.6.27-rc3
>
> On Wed, Aug 13, 2008 at 05:19:55PM -0500, Eric Sandeen wrote:
> >
> > I don't :), but I tried a quick reproducer anyway and couldn't hit it
...
> >
> > mkfs.ext3, mount, create non-extents file
> > umount, tune2fs to ext4
> > mount as ext4, write to file, open file O_TRUNC
> >
> > ... didn't oops for me :(
> >
>
> In this particular case, we need to open the file for appending, write
> to it, and then unlink it in order to trigger it, I think.
>
>                                                  - Ted

Hi All,

Actually the same oops hit for me too with 2.6.27-rc1, i was suppose to
open a bug but found it active, but my scenario was same what Ted is
telling to do.

I have created and lvm partition with 30GB, and wrote 2.3GB file on it and
when i am trying to remove this file with "rm -rf "file_name" then i hit
the call trace, as below , but for me machine is in pingable state, rather
i can not execute any command inside the ext4 mounted directory and even i
can not umount the filesystem :(

Here is the call trace i am getting, it seems same as christian has
reported and also i have pasted the code where it is getting oops.

------------[ cut here ]------------
kernel BUG at fs/ext4/mballoc.c:3963!
invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC
Modules linked in: ipv6 autofs4 hidp rfcomm l2cap bluetooth sunrpc
dm_mirror dm_log dm_multipath dm_mod sbs sbshc battery ac parport_pc lp
parport sr_mod sg ide_cd_mod cdrom serio_raw button rtc_cmos rtc_core
rtc_lib tg3 libphy k8temp hwmon i2c_piix4 pcspkr i2c_core usb_storage
sata_svw libata mptspi mptscsih scsi_transport_spi mptbase sd_mod scsi_mod
ext3 jbd uhci_hcd ohci_hcd ehci_hcd

Pid: 8852, comm: rm Not tainted (2.6.27-rc1 #2)
EIP: 0060:[<c04c98f0>] EFLAGS: 00010297 CPU: 0
EIP is at ext4_mb_free_blocks+0x3b6/0x51a
EAX: e56a5fcc EBX: 0000033f ECX: 00000000 EDX: e56a5e40
ESI: 0000000c EDI: 00000000 EBP: f5fb7de8 ESP: f5fb7d74
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process rm (pid: 8852, ti=f5fb7000 task=f43b3b80 task.ti=f5fb7000)
Stack: 0067ee0d 00000000 0067ee01 e56a5e40 df0cc490 0067ee01 00000000
cca06a48
       ebfe5df0 d14d2f80 ddbcffe0 00000000 e7ad0000 00000000 0067ee0d
c966c860
       f35c3c00 c966c860 f35c3800 e7d2b7b8 ebfe5df0 0000000a 0000033f
0000033f
Call Trace:
 [<c04b02df>] ? ext4_free_blocks+0x9b/0x100
 [<c04b4c84>] ? ext4_clear_blocks+0xcb/0xd6
 [<c04b4d54>] ? ext4_free_data+0xc5/0x117
 [<c04b5056>] ? ext4_truncate+0x129/0x3d5
 [<c046ef0d>] ? kmem_cache_alloc+0x75/0xad
 [<c04cf0ff>] ? jbd2_journal_start+0x53/0xb4
 [<c04cf0ff>] ? jbd2_journal_start+0x53/0xb4
 [<c04cf133>] ? jbd2_journal_start+0x87/0xb4
 [<c04bbff7>] ? ext4_journal_start_sb+0x40/0x42
 [<c04b7153>] ? ext4_delete_inode+0xab/0x10a
 [<c04b70a8>] ? ext4_delete_inode+0x0/0x10a
 [<c04828c5>] ? generic_delete_inode+0x98/0xff
 [<c048293e>] ? generic_drop_inode+0x12/0x126
 [<c0482221>] ? iput+0x4b/0x4e
 [<c047ad43>] ? do_unlinkat+0xa9/0x112
 [<c047c98c>] ? vfs_readdir+0x7e/0x8f
 [<c047c780>] ? filldir64+0x0/0xcd
 [<c044a123>] ? audit_syscall_entry+0x101/0x12b
 [<c047adbc>] ? sys_unlink+0x10/0x12
 [<c040383d>] ? sysenter_do_call+0x12/0x21
 =======================
Code: 19 c0 85 c0 75 f0 8b 45 98 8d 55 c8 8b 4d f0 ff 75 08 e8 80 c2 ff ff
8b 45 98 8b 55 98 5e 05 8c 01 00 00 39 82 8c 01 00 00 74 04 <0f> 0b eb fe
8b 4d ac 8b 5d e8 8b 81 a0 01 00 00 89 da 8b 48 58
EIP: [<c04c98f0>] ext4_mb_free_blocks+0x3b6/0x51a SS:ESP 0068:f5fb7d74
---[ end trace d6eba9fe5baf0f00 ]---


================ Code of fs/ext4/mballoc.c
=================================


3952 /*
3953  * finds all preallocated spaces and return blocks being freed to them
3954  * if preallocated space becomes full (no block is used from the
space)
3955  * then the function frees space in buddy
3956  * XXX: at the moment, truncate (which is the only way to free blocks)
3957  * discards all preallocations
3958  */
3959 static void ext4_mb_return_to_preallocation(struct inode *inode,
3960                                         struct ext4_buddy *e4b,
3961                                         sector_t block, int count)
3962 {
3963         BUG_ON(!list_empty(&EXT4_I(inode)->i_prealloc_list));
3964 }



-Rishi

> --
> To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html