Bug 27972 - Null pointer dereference at shutdown time
Summary: Null pointer dereference at shutdown time
Status: RESOLVED CODE_FIX
Alias: None
Product: File System
Classification: Unclassified
Component: ReiserFS (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: ReiseFS developers team
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-02-01 04:54 UTC by Harald Dunkel
Modified: 2012-08-14 15:57 UTC (History)
1 user (show)

See Also:
Kernel Version: 2.6.37 x86_64
Subsystem:
Regression: No
Bisected commit-id:


Attachments
screen snapshot (429.11 KB, image/jpeg)
2011-02-01 04:54 UTC, Harald Dunkel
Details
config file (100.93 KB, text/plain)
2011-02-01 04:55 UTC, Harald Dunkel
Details
reiserfs: Fix crash during umount (5.41 KB, patch)
2011-02-02 15:54 UTC, Jeff Mahoney
Details | Diff

Description Harald Dunkel 2011-02-01 04:54:37 UTC
Created attachment 45722 [details]
screen snapshot

I got a kernel dump at umount time of a huge reiserfs partition. It said

	Null pointer dereference at 0000000000000010
	IP: [ffffffffa01dc818] open_xa_dir+0x2d/0x1b0 [reiserfs]
	:

The config file and a photo with a complete stack trace are attached.

reiserfsck of this partition showed a lot of files to sync due to the missing umount, but no other problems.

Kernel is 2.6.37 (amd64). Please mail if I can help to track this
down.
Comment 1 Harald Dunkel 2011-02-01 04:55:27 UTC
Created attachment 45732 [details]
config file
Comment 2 Jeff Mahoney 2011-02-02 15:54:19 UTC
Created attachment 46052 [details]
reiserfs: Fix crash during umount

 There is a conflict between shrink_dcache_for_umount_subtree and how
 xattrs are cleaned up for deleted files at umount.

 shrink_dcache_for_umount_subtree wants to ensure that all dentries for a
 file system have been evicted and it walks the dentry tree from the root
 of the file system to do this. It will BUG if there are any dentries
 left with elevated counts.

 The reiserfs xattr infrastructure caches two dentries. One is for
 .reiserfs_priv and the other is for .reiserfs_priv/xattrs. When
 shrink_dcache_for_umount_subtree goes through, it will BUG on these dentries
 if they aren't freed. OTOH, it will Oops in reiserfs_delete_xattrs if
 they are due to the xattr code needing to walk the list of xattrs for
 a file undergoing delayed deletion. This will end up loading up other
 dentries and possibly queue up more delayed deletions.

 This patch detaches the tree under .reiserfs_priv during ->kill_sb. This
 allows shrink_dcache_for_umount_subtree to complete successfully as well
 as keeps around the .reiserfs_priv tree for deletion handling. After
 the regular cycle is completed, it will call shrink_dcache_for_umount_subtree
 again itself to ensure that the xattrs are cleaned up.

Note You need to log in before you can comment on or make changes to this bug.