linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: James W McMechan <mcmechanjw@juno.com>
To: wli@holomorphy.com
Cc: linux-kernel@vger.kernel.org
Subject: Re: Oops with tmpfs on both 2.4.22 & 2.6.0-test11
Date: Sun, 30 Nov 2003 17:06:04 -0800	[thread overview]
Message-ID: <20031130.170608.-1591395.4.mcmechanjw@juno.com> (raw)

> This is significantly different in nature from the 2.4 oops, since
> 2.4 hit NULL and this pointer is total garbage.
> 
> Either it's a double bitflip or even worse is afoot.

Umm from include/linux/list.h
#define LIST_POISON1  ((void *) 0x00100100)
#define LIST_POISON2  ((void *) 0x00200200)
though perhaps we need a better poison
0xdead0001 for example but that might be valid

Were you thinking of a hardware fault?
The test program oops both a Athlon and a
PentiumMMX and I followed this in from a user
bugreport over on uml-devel

I single stepped through on a UML machine and it looked
like the prev pointer in the list is getting corrupted, I was
suspecting that fs/libfs.c:dcache_readdir:137
list_del(q);
list_add(q, &dentry->d_subdirs);
when q is a empty list entry this occurs when fpos is 2
and has no comment :(
there is a similar chunk at dcache_dir_lseek:90 with a
list_del(&cursor->d_child);
list_add_tail(&cursor->d_child, p);

I suspect that deleting from a empty? list and adding
back the deleted entry will mangle things...
The problem came from looping over roughly

dirfile = opendir(dirname)
seekdir(dirfile,pos)
ent = readdir(dirfile)
pos=telldir(dirfile)
closedir(dirfile)

it started with pos== 0
seekdir is fine
readdir returns "."
teldir returned 1 -> pos
seekdir is fine
readdir then got ".." and 
teldir returned 2 -> pos
seekdir then blew up on the empty entry

Have you tried the test program?

________________________________________________________________
The best thing to hit the internet in years - Juno SpeedBand!
Surf the web up to FIVE TIMES FASTER!
Only $14.95/ month - visit www.juno.com to sign up today!

             reply	other threads:[~2003-12-01  3:39 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2003-12-01  1:06 James W McMechan [this message]
2003-12-01  3:43 ` William Lee Irwin III
     [not found] <20031207.140732.-1654081.3.mcmechanjw@juno.com>
2003-12-08  5:10 ` Maneesh Soni
  -- strict thread matches above, loose matches on Subject: below --
2003-12-07 22:48 James McMechan
2003-12-03 11:06 James W McMechan
2003-12-03 12:02 ` Maneesh Soni
2003-12-01  2:59 James W McMechan
2003-12-01 11:37 ` Maneesh Soni
2003-12-01  2:06 James W McMechan
2003-12-01  4:51 ` William Lee Irwin III
2003-11-30 21:17 James W McMechan
2003-12-01  1:21 ` William Lee Irwin III
2003-12-01  7:58   ` Andries Brouwer
2003-12-01  8:00     ` William Lee Irwin III
2003-11-30 17:34 James W McMechan
2003-11-30 20:06 ` William Lee Irwin III
2003-11-30 21:21   ` Oleg Drokin
2003-11-30 16:57 James W McMechan
2003-11-30 19:27 ` William Lee Irwin III

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20031130.170608.-1591395.4.mcmechanjw@juno.com \
    --to=mcmechanjw@juno.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=wli@holomorphy.com \
    --subject='Re: Oops with tmpfs on both 2.4.22 & 2.6.0-test11' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).