BUG fs/dcache.c:595 in 2.4.24rc3-git3 during NFS umount

BUG fs/dcache.c:595 in 2.4.24rc3-git3 during NFS umount

[Andi Kleen]

FYI

Just saw this on a test system of mine running 2.4.24rc3 (+ some suse patches,
but they're not changing anything near this AFAIK)

-Andi

[101109.104881] ------------[ cut here ]------------
[101109.114487] kernel BUG at fs/dcache.c:595!
[101109.123053] invalid opcode: 0000 [1] SMP 
[101109.131492] last sysfs file: /devices/system/cpu/cpu7/cache/index2/shared_cpu_map
[101109.147023] CPU 0 
[101109.151458] Modules linked in: nfs lockd nfs_acl sunrpc autofs4 iptable_filter ip_tables ip6table_filter ip6_tables x_tables af_packet ipv6 cpufreq_conserv
ative cpufreq_userspace cpufreq_powersave acpi_cpufreq dm_crypt ext2 ext3 jbd mbcache loop dm_mod iTCO_wdt e1000 container button rtc_cmos rtc_core i2c_i801 sh
pchp iTCO_vendor_support i2c_core rtc_lib sr_mod pci_hotplug cdrom sg floppy ehci_hcd uhci_hcd sd_mod usbcore edd reiserfs fan aic79xx scsi_transport_spi ata_p
iix ahci libata scsi_mod thermal processor
[101109.245056] Pid: 8365, comm: umount.nfs Tainted: G       N 2.6.24-rc3-git3-2-default #1
[101109.261620] RIP: 0010:[<ffffffff802a63b2>]  [<ffffffff802a63b2>] shrink_dcache_for_umount_subtree+0x16/0x241
[101109.281862] RSP: 0018:ffff81019294be18  EFLAGS: 00010202
[101109.299219] RAX: 0000000000000000 RBX: ffff81009500ad80 RCX: 0000000000000000
[101109.314048] RDX: 00000000ffffffff RSI: 0000000000000296 RDI: ffff81009500ad80
[101109.328868] RBP: ffff81003679a970 R08: ffff81007311f510 R09: 0000000000000296
[101109.343687] R10: ffff81007311f510 R11: 0000000000000400 R12: ffff810225719c00
[101109.358507] R13: 0000000000000000 R14: 00007f3173a7d3f0 R15: 0000000000000000
[101109.373332] FS:  00007f31729c56f0(0000) GS:ffffffff8051b000(0000) knlGS:0000000000000000
[101109.390081] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[101109.401934] CR2: 0000000040d4bebc CR3: 00000001e61e7000 CR4: 00000000000006e0
[101109.416761] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[101109.431600] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[101109.446432] Process umount.nfs (pid: 8365, threadinfo ffff81019294a000, task ffff8102250f87e0)
[101109.464203] Stack:  0000000000000296 ffff810225719c00 ffffffff883e9be0 ffff810225719c00
[101109.480929]  0000000000000000 ffffffff802a660c ffff810225719c00 ffffffff80297d34
[101109.496407]  ffff81007311f480 0000000000000017 ffffffff88401e90 ffffffff80297e33
[101109.511304] Call Trace:
[101109.517158]  [<ffffffff802a660c>] shrink_dcache_for_umount+0x2f/0x3d
[101109.530218]  [<ffffffff80297d34>] generic_shutdown_super+0x19/0xf1
[101109.542941]  [<ffffffff80297e33>] kill_anon_super+0x9/0x35
[101109.554281]  [<ffffffff883cd1ba>] :nfs:nfs_kill_super+0xd/0x16
[101109.566301]  [<ffffffff80297ee4>] deactivate_super+0x6a/0x83
[101109.577988]  [<ffffffff802ab78f>] sys_umount+0x23c/0x24d
[101109.588979]  [<ffffffff802a5b6e>] d_kill+0x40/0x55
[101109.598919]  [<ffffffff802a70fb>] dput+0x26/0x115
[101109.608684]  [<ffffffff80296fc0>] __fput+0x14a/0x179
[101109.618987]  [<ffffffff802aaab5>] mntput_no_expire+0x1f/0x86
[101109.630671]  [<ffffffff802945ea>] filp_close+0x5a/0x61
[101109.641307]  [<ffffffff8020bfde>] system_call+0x7e/0x83
[101109.652126] 
[101109.655477] 
[101109.655478] Code: 0f 0b eb fe 48 c7 c7 80 f6 62 80 e8 eb 70 17 00 48 8b 53 40 
[101109.674552] RIP  [<ffffffff802a63b2>] shrink_dcache_for_umount_subtree+0x16/0x241
[101109.690110]  RSP <ffff81019294be18>

Re: BUG fs/dcache.c:595 in 2.4.24rc3-git3 during NFS umount

[Andrew Morton]

On Mon, 3 Dec 2007 16:23:58 +0100
Andi Kleen <ak@suse.de> wrote:

> 
> FYI
> 
> Just saw this on a test system of mine running 2.4.24rc3 (+ some suse patches,
> but they're not changing anything near this AFAIK)
> 
> -Andi
> 
> [101109.104881] ------------[ cut here ]------------
> [101109.114487] kernel BUG at fs/dcache.c:595!
> [101109.123053] invalid opcode: 0000 [1] SMP 
> [101109.131492] last sysfs file: /devices/system/cpu/cpu7/cache/index2/shared_cpu_map
> [101109.147023] CPU 0 
> [101109.151458] Modules linked in: nfs lockd nfs_acl sunrpc autofs4 iptable_filter ip_tables ip6table_filter ip6_tables x_tables af_packet ipv6 cpufreq_conserv
> ative cpufreq_userspace cpufreq_powersave acpi_cpufreq dm_crypt ext2 ext3 jbd mbcache loop dm_mod iTCO_wdt e1000 container button rtc_cmos rtc_core i2c_i801 sh
> pchp iTCO_vendor_support i2c_core rtc_lib sr_mod pci_hotplug cdrom sg floppy ehci_hcd uhci_hcd sd_mod usbcore edd reiserfs fan aic79xx scsi_transport_spi ata_p
> iix ahci libata scsi_mod thermal processor
> [101109.245056] Pid: 8365, comm: umount.nfs Tainted: G       N 2.6.24-rc3-git3-2-default #1
> [101109.261620] RIP: 0010:[<ffffffff802a63b2>]  [<ffffffff802a63b2>] shrink_dcache_for_umount_subtree+0x16/0x241
> [101109.281862] RSP: 0018:ffff81019294be18  EFLAGS: 00010202
> [101109.299219] RAX: 0000000000000000 RBX: ffff81009500ad80 RCX: 0000000000000000
> [101109.314048] RDX: 00000000ffffffff RSI: 0000000000000296 RDI: ffff81009500ad80
> [101109.328868] RBP: ffff81003679a970 R08: ffff81007311f510 R09: 0000000000000296
> [101109.343687] R10: ffff81007311f510 R11: 0000000000000400 R12: ffff810225719c00
> [101109.358507] R13: 0000000000000000 R14: 00007f3173a7d3f0 R15: 0000000000000000
> [101109.373332] FS:  00007f31729c56f0(0000) GS:ffffffff8051b000(0000) knlGS:0000000000000000
> [101109.390081] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [101109.401934] CR2: 0000000040d4bebc CR3: 00000001e61e7000 CR4: 00000000000006e0
> [101109.416761] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [101109.431600] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> [101109.446432] Process umount.nfs (pid: 8365, threadinfo ffff81019294a000, task ffff8102250f87e0)
> [101109.464203] Stack:  0000000000000296 ffff810225719c00 ffffffff883e9be0 ffff810225719c00
> [101109.480929]  0000000000000000 ffffffff802a660c ffff810225719c00 ffffffff80297d34
> [101109.496407]  ffff81007311f480 0000000000000017 ffffffff88401e90 ffffffff80297e33
> [101109.511304] Call Trace:
> [101109.517158]  [<ffffffff802a660c>] shrink_dcache_for_umount+0x2f/0x3d
> [101109.530218]  [<ffffffff80297d34>] generic_shutdown_super+0x19/0xf1
> [101109.542941]  [<ffffffff80297e33>] kill_anon_super+0x9/0x35
> [101109.554281]  [<ffffffff883cd1ba>] :nfs:nfs_kill_super+0xd/0x16
> [101109.566301]  [<ffffffff80297ee4>] deactivate_super+0x6a/0x83
> [101109.577988]  [<ffffffff802ab78f>] sys_umount+0x23c/0x24d
> [101109.588979]  [<ffffffff802a5b6e>] d_kill+0x40/0x55
> [101109.598919]  [<ffffffff802a70fb>] dput+0x26/0x115
> [101109.608684]  [<ffffffff80296fc0>] __fput+0x14a/0x179
> [101109.618987]  [<ffffffff802aaab5>] mntput_no_expire+0x1f/0x86
> [101109.630671]  [<ffffffff802945ea>] filp_close+0x5a/0x61
> [101109.641307]  [<ffffffff8020bfde>] system_call+0x7e/0x83
> [101109.652126] 
> [101109.655477] 
> [101109.655478] Code: 0f 0b eb fe 48 c7 c7 80 f6 62 80 e8 eb 70 17 00 48 8b 53 40 
> [101109.674552] RIP  [<ffffffff802a63b2>] shrink_dcache_for_umount_subtree+0x16/0x241
> [101109.690110]  RSP <ffff81019294be18>
> 

wth?  sb->s_root->d_parent != sb->s_root.

Is it repeatable?

Re: BUG fs/dcache.c:595 in 2.4.24rc3-git3 during NFS umount

[Andi Kleen]

On Monday 03 December 2007 16:23:58 Andi Kleen wrote:
> 
> FYI
> 
> Just saw this on a test system of mine running 2.4.24rc3 (+ some suse patches,
> but they're not changing anything near this AFAIK)

Got it again after rebooting the system. Can this be made a 2.6.24 blocker
or something? Admittedly that was with a few suse patches again; I'll double
check it happens in a vanilla kernel too although I don't think there
is anything touching this area.

The system runs autofs and mounts/umounts NFS servers regularly.

-Andi

 [39943.212533] ------------[ cut here ]------------
[39943.221973] kernel BUG at fs/dcache.c:595!
[39943.230369] invalid opcode: 0000 [1] SMP
[39943.238638] last sysfs file: /devices/system/cpu/cpu7/cache/index2/shared_cpu_map
[39943.253998] CPU 3
[39943.258283] Modules linked in: nfs lockd nfs_acl sunrpc autofs4 iptable_filter ip_tables ip6table_filter ip6_tables x_tables af_packet ipv6 cpufreq_conservative cpufreq_userspace cpufreq_powersave acpi_cpufreq dm_crypt ext2 ext3 jbd mbcache loop dm_mod e1000 i2c_i801 shpchp container pci_hotplug button iTCO_wdt rtc_cmos rtc_core i2c_core iTCO_vendor_support rtc_lib sr_mod cdrom floppy sg ehci_hcd uhci_hcd sd_mod usbcore edd reiserfs fan aic79xx scsi_transport_spi ata_piix ahci libata scsi_mod thermal processor
[39943.351718] Pid: 31869, comm: umount.nfs Tainted: G       N 2.6.24-rc4-git3-20071206230004-default #1
[39943.370555] RIP: 0010:[<ffffffff802a64ce>]  [<ffffffff802a64ce>] shrink_dcache_for_umount_subtree+0x16/0x241
[39943.390671] RSP: 0018:ffff8101dc88fe18  EFLAGS: 00010206
[39943.401552] RAX: 0000000000000000 RBX: ffff8100840893c0 RCX: 0000000000000000
[39943.416040] RDX: 00000000ffffffff RSI: 0000000000000296 RDI: ffff8100840893c0
[39943.430504] RBP: ffff8100084fff20 R08: ffff81004d0a6850 R09: 0000000000000296
[39943.444969] R10: ffff81004d0a6850 R11: ffffffff802f778c R12: ffff810222439400
[39943.459424] R13: 0000000000000000 R14: 00007fef065cdf00 R15: 0000000000000000
[39943.473887] FS:  00007fef052ad6f0(0000) GS:ffff810226419940(0000) knlGS:0000000000000000
[39943.490452] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[39943.502134] CR2: 00007f5793a36580 CR3: 000000021ee38000 CR4: 00000000000006e0
[39943.516599] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[39943.531049] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[39943.545507] Process umount.nfs (pid: 31869, threadinfo ffff8101dc88e000, task ffff81021ef3b080)
[39943.563289] Stack:  0000000000000296 ffff810222439400 ffffffff883e9be0 ffff810222439400
[39943.579846]  0000000000000000 ffffffff802a6728 ffff810222439400 ffffffff80297e34
[39943.595152]  ffff81004d0a67c0 0000000000000017 ffffffff88401a80 ffffffff80297f33
[39943.609871] Call Trace:
[39943.615566]  [<ffffffff802a6728>] shrink_dcache_for_umount+0x2f/0x3d
[39943.628463]  [<ffffffff80297e34>] generic_shutdown_super+0x19/0xf1
[39943.641011]  [<ffffffff80297f33>] kill_anon_super+0x9/0x35
[39943.652193]  [<ffffffff883cd1ba>] :nfs:nfs_kill_super+0xd/0x16
[39943.664037]  [<ffffffff80297fe4>] deactivate_super+0x6a/0x83
[39943.675537]  [<ffffffff802ab8ab>] sys_umount+0x23c/0x24d
[39943.686361]  [<ffffffff802a5c8a>] d_kill+0x40/0x55
[39943.696139]  [<ffffffff802a7217>] dput+0x26/0x115
[39943.705745]  [<ffffffff802970c0>] __fput+0x14a/0x179
[39943.715861]  [<ffffffff802aabd1>] mntput_no_expire+0x1f/0x86
[39943.727375]  [<ffffffff802946ea>] filp_close+0x5a/0x61
[39943.737853]  [<ffffffff8020bfde>] system_call+0x7e/0x83
[39943.748495]
[39943.751674]
[39943.751675] Code: 0f 0b eb fe 48 c7 c7 80 06 63 80 e8 67 75 17 00 48 8b 53 40
[39943.770405] RIP  [<ffffffff802a64ce>] shrink_dcache_for_umount_subtree+0x16/0x241
[39943.785790]  RSP <ffff8101dc88fe18>
[82148.423473] JBD: barrier-based sync failed on dm-1 - disabling barriers

Re: BUG fs/dcache.c:595 in 2.4.24rc3-git3 during NFS umount

[Trond Myklebust]

[-- Attachment #1: Type: text/plain, Size: 3486 bytes --]


On Sat, 2007-12-08 at 14:22 +0100, Andi Kleen wrote:
>  [39943.212533] ------------[ cut here ]------------
> [39943.221973] kernel BUG at fs/dcache.c:595!
> [39943.230369] invalid opcode: 0000 [1] SMP
> [39943.238638] last sysfs file: /devices/system/cpu/cpu7/cache/index2/shared_cpu_map
> [39943.253998] CPU 3
> [39943.258283] Modules linked in: nfs lockd nfs_acl sunrpc autofs4 iptable_filter ip_tables ip6table_filter ip6_tables x_tables af_packet ipv6 cpufreq_conservative cpufreq_userspace cpufreq_powersave acpi_cpufreq dm_crypt ext2 ext3 jbd mbcache loop dm_mod e1000 i2c_i801 shpchp container pci_hotplug button iTCO_wdt rtc_cmos rtc_core i2c_core iTCO_vendor_support rtc_lib sr_mod cdrom floppy sg ehci_hcd uhci_hcd sd_mod usbcore edd reiserfs fan aic79xx scsi_transport_spi ata_piix ahci libata scsi_mod thermal processor
> [39943.351718] Pid: 31869, comm: umount.nfs Tainted: G       N 2.6.24-rc4-git3-20071206230004-default #1
> [39943.370555] RIP: 0010:[<ffffffff802a64ce>]  [<ffffffff802a64ce>] shrink_dcache_for_umount_subtree+0x16/0x241
> [39943.390671] RSP: 0018:ffff8101dc88fe18  EFLAGS: 00010206
> [39943.401552] RAX: 0000000000000000 RBX: ffff8100840893c0 RCX: 0000000000000000
> [39943.416040] RDX: 00000000ffffffff RSI: 0000000000000296 RDI: ffff8100840893c0
> [39943.430504] RBP: ffff8100084fff20 R08: ffff81004d0a6850 R09: 0000000000000296
> [39943.444969] R10: ffff81004d0a6850 R11: ffffffff802f778c R12: ffff810222439400
> [39943.459424] R13: 0000000000000000 R14: 00007fef065cdf00 R15: 0000000000000000
> [39943.473887] FS:  00007fef052ad6f0(0000) GS:ffff810226419940(0000) knlGS:0000000000000000
> [39943.490452] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [39943.502134] CR2: 00007f5793a36580 CR3: 000000021ee38000 CR4: 00000000000006e0
> [39943.516599] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [39943.531049] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> [39943.545507] Process umount.nfs (pid: 31869, threadinfo ffff8101dc88e000, task ffff81021ef3b080)
> [39943.563289] Stack:  0000000000000296 ffff810222439400 ffffffff883e9be0 ffff810222439400
> [39943.579846]  0000000000000000 ffffffff802a6728 ffff810222439400 ffffffff80297e34
> [39943.595152]  ffff81004d0a67c0 0000000000000017 ffffffff88401a80 ffffffff80297f33
> [39943.609871] Call Trace:
> [39943.615566]  [<ffffffff802a6728>] shrink_dcache_for_umount+0x2f/0x3d
> [39943.628463]  [<ffffffff80297e34>] generic_shutdown_super+0x19/0xf1
> [39943.641011]  [<ffffffff80297f33>] kill_anon_super+0x9/0x35
> [39943.652193]  [<ffffffff883cd1ba>] :nfs:nfs_kill_super+0xd/0x16
> [39943.664037]  [<ffffffff80297fe4>] deactivate_super+0x6a/0x83
> [39943.675537]  [<ffffffff802ab8ab>] sys_umount+0x23c/0x24d
> [39943.686361]  [<ffffffff802a5c8a>] d_kill+0x40/0x55
> [39943.696139]  [<ffffffff802a7217>] dput+0x26/0x115
> [39943.705745]  [<ffffffff802970c0>] __fput+0x14a/0x179
> [39943.715861]  [<ffffffff802aabd1>] mntput_no_expire+0x1f/0x86
> [39943.727375]  [<ffffffff802946ea>] filp_close+0x5a/0x61
> [39943.737853]  [<ffffffff8020bfde>] system_call+0x7e/0x83
> [39943.748495]
> [39943.751674]
> [39943.751675] Code: 0f 0b eb fe 48 c7 c7 80 06 63 80 e8 67 75 17 00 48 8b 53 40
> [39943.770405] RIP  [<ffffffff802a64ce>] shrink_dcache_for_umount_subtree+0x16/0x241
> [39943.785790]  RSP <ffff8101dc88fe18>
> [82148.423473] JBD: barrier-based sync failed on dm-1 - disabling barriers

Hi Andi,

Does the attached patch fix the Oops?

Cheers
  Trond

[-- Attachment #2: Type: message/rfc822, Size: 1298 bytes --]

From: Trond Myklebust <Trond.Myklebust@netapp.com>
Subject: NFS: Fix an Oops in NFS unmount
Date: 
Message-ID: <1197243901.11792.2.camel@heimdal.trondhjem.org>

Ensure that the dummy 'root dentry' is invisible to d_find_alias(). If not,
then it may be spliced into the tree if a parent directory from the same
filesystem gets mounted at a later time.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
---

 fs/nfs/getroot.c |    9 +++++++++
 1 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c
index 0ee4384..076987e 100644
--- a/fs/nfs/getroot.c
+++ b/fs/nfs/getroot.c
@@ -57,6 +57,15 @@ static int nfs_superblock_set_dummy_root(struct super_block *sb, struct inode *i
 		}
 		/* Circumvent igrab(): we know the inode is not being freed */
 		atomic_inc(&inode->i_count);
+		/*
+		 * Ensure that this dentry is invisible to d_find_alias().
+		 * Otherwise, it may be spliced into the tree by
+		 * d_materialise_unique if a parent directory from the same
+		 * filesystem gets mounted at a later time.
+		 * This again causes shrink_dcache_for_umount_subtree() to
+		 * Oops, since the test for IS_ROOT() will fail.
+		 */
+		sb->s_root->d_flags |= DCACHE_DISCONNECTED;
 	}
 	return 0;
 }

Re: BUG fs/dcache.c:595 in 2.4.24rc3-git3 during NFS umount

[Andi Kleen]

> Hi Andi,
> 
> Does the attached patch fix the Oops?

Nope, got that a few hours after boot again:

-Andi


EXT3 FS on sda1, internal journal
EXT3-fs: mounted filesystem with ordered data mode.
------------[ cut here ]------------
kernel BUG at fs/dcache.c:595!
invalid opcode: 0000 [1] SMP 
CPU 0 
Modules linked in: nfs lockd nfs_acl sunrpc autofs4 iptable_filter ip_tables ip6table_filter ip6_tables x_tables af_packet ipv6 cpufreq_conservative cpufreq_userspace cpufreq_powersave acpi_cpufreq dm_crypt ext2 ext3 jbd mbcache loop dm_mod e1000 shpchp container pci_hotplug button iTCO_wdt rtc_cmos i2c_i801 rtc_core rtc_lib i2c_core sr_mod cdrom iTCO_vendor_support sg floppy ehci_hcd uhci_hcd sd_mod usbcore edd reiserfs fan aic79xx scsi_transport_spi ata_piix ahci libata scsi_mod thermal processor
Pid: 30784, comm: umount.nfs Not tainted 2.6.24-rc4-git3-2-vanilla #1
RIP: 0010:[<ffffffff802a602e>]  [<ffffffff802a602e>] shrink_dcache_for_umount_subtree+0x16/0x241
RSP: 0018:ffff8101530c5e18  EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff8101b2873080 RCX: 0000000000000000
RDX: 00000000ffffffff RSI: 0000000000000296 RDI: ffff8101b2873080
RBP: ffff810153dddcb0 R08: ffff8101db008d10 R09: 0000000000000296
R10: ffff8101db008d10 R11: 0000000000000400 R12: ffff810225c27000
R13: 0000000000000000 R14: 0000555555769040 R15: 0000000000000000
FS:  00002b8c13dd16f0(0000) GS:ffffffff8050d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00002ab9197bc315 CR3: 00000001db56c000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process umount.nfs (pid: 30784, threadinfo ffff8101530c4000, task ffff810224c7d040)
Stack:  0000000000000296 ffff810225c27000 ffffffff883e7be0 ffff810225c27000
 0000000000000000 ffffffff802a6288 ffff810225c27000 ffffffff80297afc
 ffff8101db008c80 0000000000000018 ffffffff883ffe60 ffffffff80297bfb
Call Trace:
 [<ffffffff802a6288>] shrink_dcache_for_umount+0x2f/0x3d
 [<ffffffff80297afc>] generic_shutdown_super+0x19/0xf1
 [<ffffffff80297bfb>] kill_anon_super+0x9/0x35
 [<ffffffff883cb1c2>] :nfs:nfs_kill_super+0xd/0x16
 [<ffffffff80297cac>] deactivate_super+0x6a/0x83
 [<ffffffff802ab2b4>] sys_umount+0x23c/0x24d
 [<ffffffff802a585a>] d_kill+0x40/0x55
 [<ffffffff802a6d77>] dput+0x26/0x115
 [<ffffffff80296d9a>] __fput+0x14a/0x179
 [<ffffffff802aa70d>] mntput_no_expire+0x1f/0x86
 [<ffffffff8029442a>] filp_close+0x5a/0x61
 [<ffffffff8020bfbe>] system_call+0x7e/0x83


Code: 0f 0b eb fe 48 c7 c7 80 16 62 80 e8 d7 bc 16 00 48 8b 53 40 
RIP  [<ffffffff802a602e>] shrink_dcache_for_umount_subtree+0x16/0x241
 RSP <ffff8101530c5e18>

Re: BUG fs/dcache.c:595 in 2.4.24rc3-git3 during NFS umount

[Trond Myklebust]

[-- Attachment #1: Type: text/plain, Size: 504 bytes --]


On Mon, 2007-12-10 at 19:57 +0100, Andi Kleen wrote:
> > Hi Andi,
> > 
> > Does the attached patch fix the Oops?
> 
> Nope, got that a few hours after boot again:
> 
> -Andi

Hi Andi,

I appear to have misread d_find_alias(). It would seem that the only way
to ensure that a mountpoint won't be found is to remove it altogether
from the inode->i_dentry list. AFAICS that should be largely harmless
since the nfs sb->s_root is never visible to users, and is never part of
a dentry tree.

Cheers
  Trond


[-- Attachment #2: linux-2.6.24-003-fix_oops_in_nfs_unmount.dif --]
[-- Type: message/rfc822, Size: 1352 bytes --]

From: Trond Myklebust <Trond.Myklebust@netapp.com>
Subject: NFS: Fix an Oops in NFS unmount
Date: 
Message-ID: <1197428085.28126.4.camel@heimdal.trondhjem.org>

Ensure that the dummy 'root dentry' is invisible to d_find_alias(). If not,
then it may be spliced into the tree if a parent directory from the same
filesystem gets mounted at a later time.

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
---

 fs/nfs/getroot.c |   11 +++++++++++
 1 files changed, 11 insertions(+), 0 deletions(-)

diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c
index 0ee4384..e6242cd 100644
--- a/fs/nfs/getroot.c
+++ b/fs/nfs/getroot.c
@@ -57,6 +57,17 @@ static int nfs_superblock_set_dummy_root(struct super_block *sb, struct inode *i
 		}
 		/* Circumvent igrab(): we know the inode is not being freed */
 		atomic_inc(&inode->i_count);
+		/*
+		 * Ensure that this dentry is invisible to d_find_alias().
+		 * Otherwise, it may be spliced into the tree by
+		 * d_materialise_unique if a parent directory from the same
+		 * filesystem gets mounted at a later time.
+		 * This again causes shrink_dcache_for_umount_subtree() to
+		 * Oops, since the test for IS_ROOT() will fail.
+		 */
+		spin_lock(&dcache_lock);
+		list_del_init(&sb->s_root->d_alias);
+		spin_unlock(&dcache_lock);
 	}
 	return 0;
 }

Re: BUG fs/dcache.c:595 in 2.4.24rc3-git3 during NFS umount

[Andi Kleen]

> I appear to have misread d_find_alias(). It would seem that the only way
> to ensure that a mountpoint won't be found is to remove it altogether
> from the inode->i_dentry list. AFAICS that should be largely harmless
> since the nfs sb->s_root is never visible to users, and is never part of
> a dentry tree.

Hasn't BUGed so far with this patch. I'll watch it further but it looks
good so far. Thanks. I would suggest to push the patch.

-Andi

Re: BUG fs/dcache.c:595 in 2.4.24rc3-git3 during NFS umount

[Trond Myklebust]

On Thu, 2007-12-13 at 00:42 +0100, Andi Kleen wrote:
> > I appear to have misread d_find_alias(). It would seem that the only way
> > to ensure that a mountpoint won't be found is to remove it altogether
> > from the inode->i_dentry list. AFAICS that should be largely harmless
> > since the nfs sb->s_root is never visible to users, and is never part of
> > a dentry tree.
> 
> Hasn't BUGed so far with this patch. I'll watch it further but it looks
> good so far. Thanks. I would suggest to push the patch.
> 
> -Andi

Thanks Andi! I'll push it together with the other patches asap.

Cheers
  Trond