Bug 9481

Most recent kernel where this bug did not occur:
Distribution: Debian(testing)
Hardware Environment:CPU-pentiumD, HDD-ide(ext3)
Software Environment: kde, vmware-server(1.0.4)
Problem Description:
$umount /dev/hda1
segmentation fault
$dmesg
kjournald starting.  Commit interval 5 seconds
EXT3-fs warning: mounting unchecked fs, running e2fsck is recommended
EXT3 FS on hda1, internal journal
EXT3-fs: mounted filesystem with ordered data mode.
EXT3-fs warning (device hda1): ext3_unlink: Deleting nonexistent file (3075104), 0
sb orphan head is 3075104
sb_info orphan list:
  inode hda1:3075104 at ee30c2cc: mode 100000, nlink 0, next 0
Assertion failure in ext3_put_super() at fs/ext3/super.c:420: "list_empty(&sbi->s_orphan)"
------------[ cut here ]------------
kernel BUG at fs/ext3/super.c:420!
invalid opcode: 0000 [#1]
SMP
Modules linked in: i915 drm vmnet vmmon ppdev lp button ac battery ipv6 ip_nat_ftp ip_conntrack_ftp ip_nat_irc ip_conntrack_irc xt_tcpudp ipt_LOG xt_limit xt_state iptable_nat ip_nat ip_conntrack nfnetlink iptable_filter ip_tables x_tables siimage vfat fat fuse dm_snapshot dm_mirror dm_mod loop tsdev snd_hda_intel snd_hda_codec snd_pcm_oss snd_mixer_oss snd_pcm psmouse i2c_i801 intel_agp parport_pc parport serio_raw i2c_core agpgart snd_timer evdev rtc snd pcspkr soundcore snd_page_alloc ext3 jbd mbcache sd_mod ide_disk ata_piix libata scsi_mod it821x tg3 floppy piix ehci_hcd generic ide_core uhci_hcd usbcore thermal processor fan
CPU:    0
EIP:    0060:[<f897fff0>]    Tainted: P      VLI
EFLAGS: 00010296   (2.6.18-5-686 #1)
EIP is at ext3_put_super+0x13a/0x192 [ext3]
eax: 0000005e   ebx: cef87800   ecx: 00000046   edx: 000000ff
esi: cef87ccc   edi: cef87ccc   ebp: c28c0e00   esp: d7a53ef4
ds: 007b   es: 007b   ss: 0068
Process umount (pid: 5941, ti=d7a52000 task=dff63000 task.ti=d7a52000)
Stack: f8987dd3 f8986482 f89874c1 000001a4 f8987db8 c28c0e00 c1979be8 f8991bc0
       00000000 c015f8ce f7903cc0 c28c0e00 00000000 c015f977 c28c0e00 f8991ba0
       c015fa1f dfdaa2c0 c28c0e00 c01723a2 c1979be8 dfdaa2c0 00000001 c17fdea0
Call Trace:
 [<c015f8ce>] generic_shutdown_super+0x7d/0x109
 [<c015f977>] kill_block_super+0x1d/0x2d
 [<c015fa1f>] deactivate_super+0x52/0x65
 [<c01723a2>] sys_umount+0x1f0/0x218
 [<c0161f4d>] sys_stat64+0xf/0x23
 [<c014ddc2>] remove_vma+0x31/0x36
 [<c014e674>] do_munmap+0x181/0x19b
 [<c01723d5>] sys_oldumount+0xb/0xe
 [<c0102c11>] sysenter_past_esp+0x56/0x79
Code: 06 0f 18 00 90 39 fe 75 c9 39 3f 74 29 68 b8 7d 98 f8 68 a4 01 00 00 68 c1 74 98 f8 68 82 64 98 f8 68 d3 7d 98 f8 e8 7a d9 79 c7 <0f> 0b a4 01 c1 74 98 f8 83 c4 14 8b 85 98 00 00 00 31 d2 e8 93
EIP: [<f897fff0>] ext3_put_super+0x13a/0x192 [ext3] SS:ESP 0068:d7a53ef4
 BUG: warning at kernel/exit.c:854/do_exit()
 [<c011f8b6>] do_exit+0x44/0x71b
 [<c0103f9f>] die+0x1e2/0x28a
 [<c0104022>] die+0x265/0x28a
 [<c0104844>] do_invalid_op+0x0/0x9d
 [<c01048d5>] do_invalid_op+0x91/0x9d
 [<f897fff0>] ext3_put_super+0x13a/0x192 [ext3]
 [<c0208212>] vt_console_print+0x0/0x21d
 [<c011d0af>] __call_console_drivers+0x53/0x5f
 [<c011d37e>] release_console_sem+0x182/0x1bc
 [<c027f909>] __wait_on_bit+0x50/0x58
 [<c01037f9>] error_code+0x39/0x40
 [<f897fff0>] ext3_put_super+0x13a/0x192 [ext3]
 [<c015f8ce>] generic_shutdown_super+0x7d/0x109
 [<c015f977>] kill_block_super+0x1d/0x2d
 [<c015fa1f>] deactivate_super+0x52/0x65
 [<c01723a2>] sys_umount+0x1f0/0x218
 [<c0161f4d>] sys_stat64+0xf/0x23
 [<c014ddc2>] remove_vma+0x31/0x36
 [<c014e674>] do_munmap+0x181/0x19b
 [<c01723d5>] sys_oldumount+0xb/0xe
 [<c0102c11>] sysenter_past_esp+0x56/0x79


Steps to reproduce: add in vmware virtual machine /dev/hda1 as phisical disk, mount it in virtual machine. Mount /dev/hda1 in real machine too. Copy some files to /dev/hda1 from real and virtual machines . Umount /dev/hda1 from virtual machine(good), umount /dev/hda1 from real machine(seg fault)