[Ocfs2-devel] NULL pointer dereference in __ocfs2_claim_clusters

David Weber wb at munzinger.de
Wed Jul 31 05:19:34 PDT 2013 

Am Mittwoch, 31. Juli 2013, 18:17:34 schrieb Jeff Liu:
> Hi Tao,
> 
> On 07/30/2013 05:03 PM, Tao Ma wrote:
> > Hi David,
> > 
> > On 07/30/2013 03:14 PM, David Weber wrote:
> >> Hi,
> >> 
> >> we are currently trying to use OCFS2 in Linux 3.11.0-rc3 as a VM storage.
> >> 
> >> When we try to discard free blocks from inside the guest we get a NULL
> >> Pointer> 
> >> dereference on the host:
> > I thought this is already fixed by Tiger about a year ago.
> > https://oss.oracle.com/pipermail/ocfs2-devel/2012-September/008734.html
> > would you mind trying this patch to see if it works?

The patch works. There are no OOPS any more and according to shared-du the 
image shrank to the minimum size.

Cheers,
David

> 
> This fix looks good to me.  I'd like to rebase it on behalf of Tiger(as
> Tiger has left Oracle last year) If you have no objections(i.e, Originally,
> you also thought it might could be fixed by skipping the call of
> ocfs2_readahead_for_cow if file = NULL should works), and then it need an
> Acked-by from you as you're the author of the readahead for CoW.
> 
> Thanks,
> -Jeff
> 
> > Thanks,
> > Tao
> > 
> >> [ 3452.936566] BUG: unable to handle kernel NULL pointer dereference at
> >> 0000000000000020
> >> [ 3452.937042] IP: [<ffffffffa00eb250>]
> >> ocfs2_duplicate_clusters_by_page+0x26/0x3cb [ocfs2]
> >> [ 3452.937535] PGD 0
> >> [ 3452.937655] Oops: 0000 [#1] SMP
> >> [ 3452.937853] Modules linked in: vhost_net vhost tun drbd ebtable_nat
> >> ebtables ocfs2_stack_o2cb bridge stp llc kvm_intel kvm lru_cache dlm sctp
> >> libcrc32c ocfs2_dlm ocfs2_dlmfs ocfs2 ocfs2_stackglue ocfs2_nodemanager
> >> configfs igb [last unloaded: drbd]
> >> [ 3452.939281] CPU: 0 PID: 3247 Comm: qemu-system-x86 Tainted: G         
> >> I
> >> 3.11.0-rc3 #1
> >> [ 3452.939754] Hardware name: Supermicro X8DTU/X8DTU, BIOS 1.0c   
> >> 07/24/2009 [ 3452.940159] task: ffff88079df02620 ti: ffff88079162a000
> >> task.ti: ffff88079162a000 [ 3452.940601] RIP: 0010:[<ffffffffa00eb250>] 
> >> [<ffffffffa00eb250>] ocfs2_duplicate_clusters_by_page+0x26/0x3cb [ocfs2]
> >> [ 3452.941232] RSP: 0018:ffff88079162b9d8  EFLAGS: 00010296
> >> [ 3452.941542] RAX: 00000000007e0101 RBX: ffff88079dd735c0 RCX:
> >> 000000000001f8b7 [ 3452.941965] RDX: 0000000000000026 RSI:
> >> 0000000000000000 RDI: ffff88079be98030 [ 3452.942389] RBP:
> >> ffff88079162ba68 R08: 000000000001ad0a R09: 0000000000000001 [
> >> 3452.942836] R10: f84eb5df22f96c02 R11: 0000000000000000 R12:
> >> 0000000000000001
> >> [ 3452.943266] R13: 000000000001f8b7 R14: 0000000000000026 R15:
> >> 0000000000000001
> >> [ 3452.943687] FS:  00007f304b7fe700(0000) GS:ffff8807bfc00000(0000)
> >> knlGS:0000000000000000
> >> [ 3452.944164] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> >> [ 3452.944500] CR2: 0000000000000020 CR3: 000000079171a000 CR4:
> >> 00000000000027e0
> >> [ 3452.944920] Stack:
> >> [ 3452.945032]  ffff88079162bb80 ffff88079162bb84 ffff88079162ba68
> >> ffffffffa00fd4bc [ 3452.945485]  0000000000000000 ffff88079d3f6000
> >> ffff88079be98030 ffff88079bfd1ed8 [ 3452.945936]  000000000001f8b7
> >> 000000000001ad0a 0000000000000000 0000000000000000
> >> [ 3452.946388] Call Trace:
> >> [ 3452.946535]  [<ffffffffa00fd4bc>] ? __ocfs2_claim_clusters+0x1f7/0x325
> >> [ocfs2] [ 3452.946967]  [<ffffffffa00ee0bf>]
> >> ocfs2_replace_cow+0x3f0/0xe18 [ocfs2] [ 3452.947364] 
> >> [<ffffffffa00ef026>] ocfs2_refcount_cow+0x53f/0x668 [ocfs2] [
> >> 3452.947764]  [<ffffffffa00c921f>] ocfs2_cow_file_pos+0x11c/0x123
> >> [ocfs2] [ 3452.948164]  [<ffffffffa00c992f>]
> >> ocfs2_remove_inode_range+0xc6/0xd5b [ocfs2] [ 3452.948593] 
> >> [<ffffffffa00d30ce>] ? ocfs2_read_inode_block_full+0x36/0x55 [ocfs2]
> >> [ 3452.949040]  [<ffffffffa00c3c89>] ?
> >> ocfs2_inode_lock_full_nested+0x515/0xaa8 [ocfs2]
> >> [ 3452.949503]  [<ffffffffa00d6ada>] ? ocfs2_extend_trans+0x1f9/0x1f9
> >> [ocfs2] [ 3452.949914]  [<ffffffffa00cbee1>]
> >> __ocfs2_change_file_space+0x3d0/0xaa3 [ocfs2] [ 3452.950354] 
> >> [<ffffffffa00cc624>] ocfs2_fallocate+0x70/0x74 [ocfs2] [ 3452.950727] 
> >> [<ffffffff8113b11b>] do_fallocate+0x106/0x14d
> >> [ 3452.951050]  [<ffffffff8113b1a9>] SyS_fallocate+0x47/0x6b
> >> [ 3452.951368]  [<ffffffff81664e12>] system_call_fastpath+0x16/0x1b
> >> [ 3452.951720] Code: ff 0f 0b 0f 0b 55 48 89 e5 41 57 41 56 41 55 41 54
> >> 53 48 83 ec 68 48 89 7d a0 48 89 75 90 41 89 d6 89 4d b0 44 89 45 b8 45
> >> 89 cf <48> 8b 46 20 48 89 45 98 48 89 c7 48 83 ef 48 e8 78 8e 02 00 49
> >> [ 3452.953241] RIP  [<ffffffffa00eb250>]
> >> ocfs2_duplicate_clusters_by_page+0x26/0x3cb [ocfs2]
> >> [ 3452.953729]  RSP <ffff88079162b9d8>
> >> [ 3452.953931] CR2: 0000000000000020
> >> [ 3453.019391] ---[ end trace 08f73908d0d596c1 ]---
> >> 
> >> The filesystem was created with:
> >> mkfs.ocfs2 -b 4K -C 1M -J block64 -L kvm-images -T vmstore /dev/drbd0
> >> 
> >> alice ocfs2 # gdb suballoc.o
> >> GNU gdb (Gentoo 7.5.1 p2) 7.5.1
> >> Copyright (C) 2012 Free Software Foundation, Inc.
> >> License GPLv3+: GNU GPL version 3 or later
> >> <http://gnu.org/licenses/gpl.html> This is free software: you are free
> >> to change and redistribute it. There is NO WARRANTY, to the extent
> >> permitted by law.  Type "show copying" and "show warranty" for details.
> >> This GDB was configured as "x86_64-pc-linux-gnu".
> >> For bug reporting instructions, please see:
> >> <http://bugs.gentoo.org/>...
> >> Reading symbols from /usr/src/linux-3.11-rc3/fs/ocfs2/suballoc.o...done.
> >> (gdb) list  *(__ocfs2_claim_clusters+0x1f7)
> >> 0x40bc is in __ocfs2_claim_clusters (fs/ocfs2/suballoc.c:2306).
> >> 2301                   && ac->ac_which != OCFS2_AC_USE_MAIN);
> >> 2302
> >> 2303            if (ac->ac_which == OCFS2_AC_USE_LOCAL) {
> >> 2304                    WARN_ON(min_clusters > 1);
> >> 2305
> >> 2306                    status = ocfs2_claim_local_alloc_bits(osb,
> >> 2307                                                          handle,
> >> 2308                                                          ac,
> >> 2309                                                         
> >> bits_wanted,
> >> 2310                                                         
> >> cluster_start,
> >> 
> >> Qemu version: 1.5.2
> >> Guest OS: Ubuntu 13.10 snapshot (Linux 3.10)
> >> Guest filesystem: ext4
> >> Command run on the guest: 'fstrim -v /'
> >> 
> >> The disk configuration in libvirt looks like this:
> >>     <disk type='file' device='disk'>
> >>     
> >>       <driver name='qemu' type='raw' cache='none' discard='unmap'/>
> >>       <source file='/mnt/kvm-images/ubuntu2.img'/>
> >>       <target dev='sda' bus='scsi'/>
> >>       <address type='drive' controller='0' bus='0' target='0' unit='0'/>
> >>     
> >>     </disk>
> >> 
> >> and maps to such a qemu command line
> >> 
> >> -device virtio-scsi-pci,id=scsi0,bus=pci.0,addr=0x4 -drive file=/mnt/kvm-
> >> images/ubuntu2.img,if=none,id=drive-
> >> scsi0-0-0-0,format=raw,cache=none,discard=unmap -device scsi-
> >> hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-
> >> scsi0-0-0-0,id=scsi0-0-0-0,bootindex=1
> >> 
> >> Thanks in advance!
> >> 
> >> Cheers,
> >> David
> >> 
> >> 
> >> _______________________________________________
> >> Ocfs2-devel mailing list
> >> Ocfs2-devel at oss.oracle.com
> >> https://oss.oracle.com/mailman/listinfo/ocfs2-devel
> > 
> > _______________________________________________
> > Ocfs2-devel mailing list
> > Ocfs2-devel at oss.oracle.com
> > https://oss.oracle.com/mailman/listinfo/ocfs2-devel

More information about the Ocfs2-devel mailing list