linux-kernel - [2.6.20.4] BUG: dentry xattrs still in use in shrink_dcache_for

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 13 Apr 2007 13:04:09 +0200 (MEST)
From:	Andrea Righi <righiandr@...rs.sourceforge.net>
To:	reiserfs-dev@...esys.com
Cc:	LKML <linux-kernel@...r.kernel.org>,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: [2.6.20.4] BUG: dentry xattrs still in use in shrink_dcache_for_umount()
 with reiserfs

I can reproduce the problem umounting my /var (reiserfs), but it doesn't
occur with /usr or /opt, that are reiserfs too.

It seems very similar to this issue: 
ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.18-rc3/2.6.18-rc3-mm2/hot-fixes/reiserfs-make-sure-all-dentries-refs-are-released-before-calling-kill_block_super-try-2.patch

How the xattrs->d_count can be 1 if the dentry is explicitly released
in reiserfs_kill_sb(), before calling kill_super_block()?

(config attached)

-Andrea

BUG: Dentry dfcd2570{i=21bc,n=xattrs} still in use (1) [unmount of reiserfs dm-4]
------------[ cut here ]------------
kernel BUG at fs/dcache.c:623!
invalid opcode: 0000 [#1]
PREEMPT
Modules linked in: fuse hdaps ipt_TCPMSS xt_tcpudp ipt_LOG xt_limit cpufreq_ondemand cpufreq_powersave cpufreq_userspace speedstep_centrino ibm_acpi backlight button battery ac snd_pcm_oss snd_mixer_oss snd_seq snd_seq_device xt_state ipt_REJECT usbhid iptable_mangle iptable_nat nf_nat iptable_filter nf_conntrack_ipv4 nf_conntrack nfnetlink ip_tables x_tables hci_usb bluetooth ehci_hcd uhci_hcd usbcore snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm snd_timer snd_page_alloc tg3 reiserfs dm_snapshot dm_mod fan thermal processor sr_mod cdrom ata_piix ahci
CPU:    0
EIP:    0060:[<c0173d86>]    Not tainted VLI
EFLAGS: 00010286   (2.6.20.4 #8)
EIP is at shrink_dcache_for_umount_subtree+0x236/0x270
eax: 00000055   ebx: dfcd25c8   ecx: ffffffff   edx: 00000000
esi: dfcd2570   edi: f5afad24   ebp: 000021bc   esp: f6bd9ed0
ds: 007b   es: 007b   ss: 0068
Process umount (pid: 6659, ti=f6bd8000 task=f6374a70 task.ti=f6bd8000)
Stack: c038f488 dfcd2570 000021bc dfcd25c8 00000001 f8bee08b f5afad24 f5afac00
       f5afac00 f6bd9f40 dfff4ac0 c0173de5 f8bf92e0 f5afac00 c0164208 c1a32c80
       f5afac00 c1a32c80 f5afac00 c0164325 f5afac00 f8bf92a0 c0164545 00000000
Call Trace:
 [<c0173de5>] shrink_dcache_for_umount+0x25/0x50
 [<c0164208>] generic_shutdown_super+0x18/0x110
 [<c0164325>] kill_block_super+0x25/0x40
 [<c0164545>] deactivate_super+0x55/0x80
 [<c017994a>] sys_umount+0x4a/0x210
 [<c01535b9>] unmap_region+0xb9/0x120
 [<c0115fd7>] do_page_fault+0x327/0x650
 [<c0179b25>] sys_oldumount+0x15/0x20
 [<c0102fa0>] sysenter_past_esp+0x5d/0x81
 =======================
Code: 8b 00 74 03 8b 6a 20 89 7c 24 18 89 4c 24 10 89 5c 24 0c 89 6c 24 08 89 74 24 04 89 44 24 14 c7 04 24 88 f4 38 c0 e8 ea 87 fa ff <0f> 0b eb fe 0f 0b eb fe 83 c4 1c 5b 5e 5f 5d e9 16 bf 1c 00 e8
EIP: [<c0173d86>] shrink_dcache_for_umount_subtree+0x236/0x270 SS:ESP 0068:f6bd9ed0



Download attachment "config.gz" of type "application/x-gzip" (12185 bytes)