[Ocfs2-devel] NULL pointer dereference in __ocfs2_claim_clusters
Jeff Liu
jeff.liu at oracle.com
Wed Jul 31 03:17:34 PDT 2013
Hi Tao,
On 07/30/2013 05:03 PM, Tao Ma wrote:
> Hi David,
> On 07/30/2013 03:14 PM, David Weber wrote:
>> Hi,
>>
>> we are currently trying to use OCFS2 in Linux 3.11.0-rc3 as a VM storage.
>>
>> When we try to discard free blocks from inside the guest we get a NULL Pointer
>> dereference on the host:
> I thought this is already fixed by Tiger about a year ago.
> https://oss.oracle.com/pipermail/ocfs2-devel/2012-September/008734.html
> would you mind trying this patch to see if it works?
This fix looks good to me. I'd like to rebase it on behalf of Tiger(as Tiger has
left Oracle last year) If you have no objections(i.e, Originally, you also thought
it might could be fixed by skipping the call of ocfs2_readahead_for_cow if file = NULL
should works), and then it need an Acked-by from you as you're the author of the
readahead for CoW.
Thanks,
-Jeff
>
> Thanks,
> Tao
>> [ 3452.936566] BUG: unable to handle kernel NULL pointer dereference at
>> 0000000000000020
>> [ 3452.937042] IP: [<ffffffffa00eb250>]
>> ocfs2_duplicate_clusters_by_page+0x26/0x3cb [ocfs2]
>> [ 3452.937535] PGD 0
>> [ 3452.937655] Oops: 0000 [#1] SMP
>> [ 3452.937853] Modules linked in: vhost_net vhost tun drbd ebtable_nat
>> ebtables ocfs2_stack_o2cb bridge stp llc kvm_intel kvm lru_cache dlm sctp
>> libcrc32c ocfs2_dlm ocfs2_dlmfs ocfs2 ocfs2_stackglue ocfs2_nodemanager
>> configfs igb [last unloaded: drbd]
>> [ 3452.939281] CPU: 0 PID: 3247 Comm: qemu-system-x86 Tainted: G I
>> 3.11.0-rc3 #1
>> [ 3452.939754] Hardware name: Supermicro X8DTU/X8DTU, BIOS 1.0c 07/24/2009
>> [ 3452.940159] task: ffff88079df02620 ti: ffff88079162a000 task.ti: ffff88079162a000
>> [ 3452.940601] RIP: 0010:[<ffffffffa00eb250>] [<ffffffffa00eb250>]
>> ocfs2_duplicate_clusters_by_page+0x26/0x3cb [ocfs2]
>> [ 3452.941232] RSP: 0018:ffff88079162b9d8 EFLAGS: 00010296
>> [ 3452.941542] RAX: 00000000007e0101 RBX: ffff88079dd735c0 RCX: 000000000001f8b7
>> [ 3452.941965] RDX: 0000000000000026 RSI: 0000000000000000 RDI: ffff88079be98030
>> [ 3452.942389] RBP: ffff88079162ba68 R08: 000000000001ad0a R09: 0000000000000001
>> [ 3452.942836] R10: f84eb5df22f96c02 R11: 0000000000000000 R12:
>> 0000000000000001
>> [ 3452.943266] R13: 000000000001f8b7 R14: 0000000000000026 R15:
>> 0000000000000001
>> [ 3452.943687] FS: 00007f304b7fe700(0000) GS:ffff8807bfc00000(0000)
>> knlGS:0000000000000000
>> [ 3452.944164] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
>> [ 3452.944500] CR2: 0000000000000020 CR3: 000000079171a000 CR4:
>> 00000000000027e0
>> [ 3452.944920] Stack:
>> [ 3452.945032] ffff88079162bb80 ffff88079162bb84 ffff88079162ba68 ffffffffa00fd4bc
>> [ 3452.945485] 0000000000000000 ffff88079d3f6000 ffff88079be98030 ffff88079bfd1ed8
>> [ 3452.945936] 000000000001f8b7 000000000001ad0a 0000000000000000
>> 0000000000000000
>> [ 3452.946388] Call Trace:
>> [ 3452.946535] [<ffffffffa00fd4bc>] ? __ocfs2_claim_clusters+0x1f7/0x325 [ocfs2]
>> [ 3452.946967] [<ffffffffa00ee0bf>] ocfs2_replace_cow+0x3f0/0xe18 [ocfs2]
>> [ 3452.947364] [<ffffffffa00ef026>] ocfs2_refcount_cow+0x53f/0x668 [ocfs2]
>> [ 3452.947764] [<ffffffffa00c921f>] ocfs2_cow_file_pos+0x11c/0x123 [ocfs2]
>> [ 3452.948164] [<ffffffffa00c992f>] ocfs2_remove_inode_range+0xc6/0xd5b [ocfs2]
>> [ 3452.948593] [<ffffffffa00d30ce>] ? ocfs2_read_inode_block_full+0x36/0x55
>> [ocfs2]
>> [ 3452.949040] [<ffffffffa00c3c89>] ? ocfs2_inode_lock_full_nested+0x515/0xaa8
>> [ocfs2]
>> [ 3452.949503] [<ffffffffa00d6ada>] ? ocfs2_extend_trans+0x1f9/0x1f9 [ocfs2]
>> [ 3452.949914] [<ffffffffa00cbee1>] __ocfs2_change_file_space+0x3d0/0xaa3 [ocfs2]
>> [ 3452.950354] [<ffffffffa00cc624>] ocfs2_fallocate+0x70/0x74 [ocfs2]
>> [ 3452.950727] [<ffffffff8113b11b>] do_fallocate+0x106/0x14d
>> [ 3452.951050] [<ffffffff8113b1a9>] SyS_fallocate+0x47/0x6b
>> [ 3452.951368] [<ffffffff81664e12>] system_call_fastpath+0x16/0x1b
>> [ 3452.951720] Code: ff 0f 0b 0f 0b 55 48 89 e5 41 57 41 56 41 55 41 54 53 48
>> 83 ec 68 48 89 7d a0 48 89 75 90 41 89 d6 89 4d b0 44 89 45 b8 45 89 cf <48>
>> 8b 46 20 48 89 45 98 48 89 c7 48 83 ef 48 e8 78 8e 02 00 49
>> [ 3452.953241] RIP [<ffffffffa00eb250>]
>> ocfs2_duplicate_clusters_by_page+0x26/0x3cb [ocfs2]
>> [ 3452.953729] RSP <ffff88079162b9d8>
>> [ 3452.953931] CR2: 0000000000000020
>> [ 3453.019391] ---[ end trace 08f73908d0d596c1 ]---
>>
>> The filesystem was created with:
>> mkfs.ocfs2 -b 4K -C 1M -J block64 -L kvm-images -T vmstore /dev/drbd0
>>
>> alice ocfs2 # gdb suballoc.o
>> GNU gdb (Gentoo 7.5.1 p2) 7.5.1
>> Copyright (C) 2012 Free Software Foundation, Inc.
>> License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
>> This is free software: you are free to change and redistribute it.
>> There is NO WARRANTY, to the extent permitted by law. Type "show copying"
>> and "show warranty" for details.
>> This GDB was configured as "x86_64-pc-linux-gnu".
>> For bug reporting instructions, please see:
>> <http://bugs.gentoo.org/>...
>> Reading symbols from /usr/src/linux-3.11-rc3/fs/ocfs2/suballoc.o...done.
>> (gdb) list *(__ocfs2_claim_clusters+0x1f7)
>> 0x40bc is in __ocfs2_claim_clusters (fs/ocfs2/suballoc.c:2306).
>> 2301 && ac->ac_which != OCFS2_AC_USE_MAIN);
>> 2302
>> 2303 if (ac->ac_which == OCFS2_AC_USE_LOCAL) {
>> 2304 WARN_ON(min_clusters > 1);
>> 2305
>> 2306 status = ocfs2_claim_local_alloc_bits(osb,
>> 2307 handle,
>> 2308 ac,
>> 2309 bits_wanted,
>> 2310 cluster_start,
>>
>> Qemu version: 1.5.2
>> Guest OS: Ubuntu 13.10 snapshot (Linux 3.10)
>> Guest filesystem: ext4
>> Command run on the guest: 'fstrim -v /'
>>
>> The disk configuration in libvirt looks like this:
>> <disk type='file' device='disk'>
>> <driver name='qemu' type='raw' cache='none' discard='unmap'/>
>> <source file='/mnt/kvm-images/ubuntu2.img'/>
>> <target dev='sda' bus='scsi'/>
>> <address type='drive' controller='0' bus='0' target='0' unit='0'/>
>> </disk>
>>
>> and maps to such a qemu command line
>>
>> -device virtio-scsi-pci,id=scsi0,bus=pci.0,addr=0x4 -drive file=/mnt/kvm-
>> images/ubuntu2.img,if=none,id=drive-
>> scsi0-0-0-0,format=raw,cache=none,discard=unmap -device scsi-
>> hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-
>> scsi0-0-0-0,id=scsi0-0-0-0,bootindex=1
>>
>> Thanks in advance!
>>
>> Cheers,
>> David
>>
>>
>> _______________________________________________
>> Ocfs2-devel mailing list
>> Ocfs2-devel at oss.oracle.com
>> https://oss.oracle.com/mailman/listinfo/ocfs2-devel
>>
>
>
> _______________________________________________
> Ocfs2-devel mailing list
> Ocfs2-devel at oss.oracle.com
> https://oss.oracle.com/mailman/listinfo/ocfs2-devel
More information about the Ocfs2-devel
mailing list