Bug 72461 - btrfs/015 double free detected in cache 'kmalloc-32' during mkfs
Summary: btrfs/015 double free detected in cache 'kmalloc-32' during mkfs
Status: RESOLVED CODE_FIX
Alias: None
Product: File System
Classification: Unclassified
Component: btrfs (show other bugs)
Hardware: All Linux
: P1 high
Assignee: Josef Bacik
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-03-18 16:27 UTC by David Sterba
Modified: 2014-04-16 16:05 UTC (History)
1 user (show)

See Also:
Kernel Version: 3.14-rc7
Tree: Mainline
Regression: No

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Sterba 2014-03-18 16:27:15 UTC 
MKFS_OPTIONS  -- -m single -d single /dev/sda10
MOUNT_OPTIONS -- -o enospc_debug,space_cache,noatime /dev/sda10 /mnt/a2

sda10 has 10G

[ 6107.607510] slab: double free detected in cache 'kmalloc-32', objp ffff88006ce428a0
[ 6107.610267] ------------[ cut here ]------------
[ 6107.610267] kernel BUG at mm/slab.c:2635!
[ 6107.610267] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC
[ 6107.610267] Modules linked in: dm_flakey rpcsec_gss_krb5 dm_crypt loop btrfs
[ 6107.610267] CPU: 1 PID: 23741 Comm: mkfs.btrfs Tainted: G        W    3.14.0-rc7-default+ #122
[ 6107.610267] Hardware name: Intel Corporation Santa Rosa platform/Matanzas, BIOS TSRSCRB1.86C.0047.B00.0610170821 10/17/06
[ 6107.610267] task: ffff880049fd8910 ti: ffff880047a04000 task.ti: ffff880047a04000
[ 6107.610267] RIP: 0010:[<ffffffff8116dbea>]  [<ffffffff8116dbea>] free_block+0x23a/0x270
[ 6107.610267] RSP: 0018:ffff880047a05b78  EFLAGS: 00010092
[ 6107.610267] RAX: 0000000000000047 RBX: ffff88007a810fc0 RCX: 0000000000000000
[ 6107.610267] RDX: ffff88007d5cefb0 RSI: ffffffff810c0cc9 RDI: ffffffff810ab14d
[ 6107.610267] RBP: ffff880047a05bc8 R08: 0000000000000002 R09: 0000000000000000
[ 6107.610267] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000036
[ 6107.610267] R13: ffffea0001b39080 R14: ffff88006ce428a0 R15: ffff88007a815040
[ 6107.610267] FS:  00007f1a293ed780(0000) GS:ffff88007d400000(0000) knlGS:0000000000000000
[ 6107.610267] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 6107.610267] CR2: 00007fad85055000 CR3: 000000002083f000 CR4: 00000000000007e0
[ 6107.610267] Stack:
[ 6107.610267]  ffff880079d05ea8 0000001000000000 0000000000000000 0000000a47dddf00
[ 6107.610267]  ffff880047a05bc8 0000000000000010 ffff880079d05e00 ffff88007a815040
[ 6107.610267]  ffff88007a810fc0 ffff880079d05e58 ffff880047a05c18 ffffffff8116dc93
[ 6107.610267] Call Trace:
[ 6107.610267]  [<ffffffff8116dc93>] cache_flusharray+0x73/0x130
[ 6107.610267]  [<ffffffff8116deb7>] kmem_cache_free+0x167/0x180
[ 6107.610267]  [<ffffffff8116d97d>] slab_destroy+0x18d/0x1c0
[ 6107.610267]  [<ffffffff8116dbc6>] free_block+0x216/0x270
[ 6107.610267]  [<ffffffff8116dc93>] cache_flusharray+0x73/0x130
[ 6107.610267]  [<ffffffff811ad1e2>] ? free_buffer_head+0x22/0x50
[ 6107.610267]  [<ffffffff8116deb7>] kmem_cache_free+0x167/0x180
[ 6107.610267]  [<ffffffff811ad1e2>] free_buffer_head+0x22/0x50
[ 6107.610267]  [<ffffffff811ad424>] try_to_free_buffers+0x84/0xc0
[ 6107.610267]  [<ffffffff811b5125>] blkdev_releasepage+0x45/0x50
[ 6107.610267]  [<ffffffff81128ed5>] try_to_release_page+0x35/0x50
[ 6107.610267]  [<ffffffff81139361>] invalidate_inode_page+0x71/0x90
[ 6107.610267]  [<ffffffff81139492>] invalidate_mapping_pages+0x112/0x1d0
[ 6107.610267]  [<ffffffff8112dbc6>] SyS_fadvise64_64+0x196/0x270
[ 6107.610267]  [<ffffffff8112dcae>] SyS_fadvise64+0xe/0x10
[ 6107.610267]  [<ffffffff81a0cc52>] system_call_fastpath+0x16/0x1b
[ 6107.610267] Code: 45 b0 e8 2a fc ff ff 48 8b 45 b0 eb 98 49 8b 75 10 e9 3e ff ff ff 48 8b 73 50 4c 89 f2 48 c7 c7 48 db f1 81 31 c0 e8 9d f8 88 00 <0f> 0b be 44 0a 00 00 48 c7 c7 6a 02 f2 81 48
89 45 b0 e8 ff 3a
[ 6107.610267] RIP  [<ffffffff8116dbea>] free_block+0x23a/0x270
[ 6107.610267]  RSP <ffff880047a05b78>
[ 6107.610267] ---[ end trace 5d112da8eb1a4310 ]---
[ 6107.996074] note: mkfs.btrfs[23741] exited with preempt_count 2
[ 6107.996074] BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:20
[ 6107.996074] in_atomic(): 1, irqs_disabled(): 1, pid: 23741, name: mkfs.btrfs
[ 6107.996074] INFO: lockdep is turned off.
[ 6107.996074] irq event stamp: 0
[ 6107.996074] hardirqs last  enabled at (0): [<          (null)>]           (null)
[ 6107.996074] hardirqs last disabled at (0): [<ffffffff8105f269>] copy_process+0x3f9/0x1910
[ 6107.996074] softirqs last  enabled at (0): [<ffffffff8105f269>] copy_process+0x3f9/0x1910
[ 6107.996074] softirqs last disabled at (0): [<          (null)>]           (null)
[ 6107.996074] CPU: 1 PID: 23741 Comm: mkfs.btrfs Tainted: G      D W    3.14.0-rc7-default+ #122
[ 6107.996074] Hardware name: Intel Corporation Santa Rosa platform/Matanzas, BIOS TSRSCRB1.86C.0047.B00.0610170821 10/17/06
[ 6107.996074]  0000000000000000 ffff880047a05838 ffffffff819fd603 ffff880047a05838
[ 6107.996074]  ffff880049fd8910 ffff880047a05858 ffffffff8108f81a ffff88005b498b88
[ 6107.996074]  ffff88006c199be8 ffff880047a05888 ffffffff81a01e06 ffff880047a058a8
[ 6107.996074] Call Trace:
[ 6107.996074]  [<ffffffff819fd603>] dump_stack+0x51/0x6e
[ 6107.996074]  [<ffffffff8108f81a>] __might_sleep+0xda/0x100
[ 6107.996074]  [<ffffffff81a01e06>] down_read+0x26/0xa0
[ 6107.996074]  [<ffffffff810e5c3b>] acct_collect+0x4b/0x1b0
[ 6107.996074]  [<ffffffff81063a25>] do_exit+0x125/0xa80
[ 6107.996074]  [<ffffffff810c1ea5>] ? kmsg_dump+0x115/0x130
[ 6107.996074]  [<ffffffff810c1db6>] ? kmsg_dump+0x26/0x130
[ 6107.996074]  [<ffffffff81a05100>] oops_end+0xa0/0xe0
[ 6107.996074]  [<ffffffff8100618b>] die+0x5b/0x90
[ 6107.996074]  [<ffffffff81a04a53>] do_trap+0xc3/0x170
[ 6107.996074]  [<ffffffff810032a5>] do_invalid_op+0x95/0xb0
[ 6107.996074]  [<ffffffff8116dbea>] ? free_block+0x23a/0x270
[ 6107.996074]  [<ffffffff810ab099>] ? trace_hardirqs_off_caller+0x29/0xd0
[ 6107.996074]  [<ffffffff813cc6bd>] ? trace_hardirqs_off_thunk+0x3a/0x3c
[ 6107.996074]  [<ffffffff81a0434c>] ? restore_args+0x30/0x30
[ 6107.996074]  [<ffffffff81a0e2b8>] invalid_op+0x18/0x20
[ 6107.996074]  [<ffffffff810c0cc9>] ? vprintk_emit+0x279/0x530
[ 6107.996074]  [<ffffffff810ab14d>] ? trace_hardirqs_off+0xd/0x10
[ 6107.996074]  [<ffffffff8116dbea>] ? free_block+0x23a/0x270
[ 6107.996074]  [<ffffffff8116dbea>] ? free_block+0x23a/0x270
[ 6107.996074]  [<ffffffff8116dc93>] cache_flusharray+0x73/0x130
[ 6107.996074]  [<ffffffff8116deb7>] kmem_cache_free+0x167/0x180
[ 6107.996074]  [<ffffffff8116d97d>] slab_destroy+0x18d/0x1c0
[ 6107.996074]  [<ffffffff8116dbc6>] free_block+0x216/0x270
[ 6107.996074]  [<ffffffff8116dc93>] cache_flusharray+0x73/0x130
[ 6107.996074]  [<ffffffff811ad1e2>] ? free_buffer_head+0x22/0x50
[ 6107.996074]  [<ffffffff8116deb7>] kmem_cache_free+0x167/0x180
[ 6107.996074]  [<ffffffff811ad1e2>] free_buffer_head+0x22/0x50
[ 6107.996074]  [<ffffffff811ad424>] try_to_free_buffers+0x84/0xc0
[ 6107.996074]  [<ffffffff811b5125>] blkdev_releasepage+0x45/0x50
[ 6107.996074]  [<ffffffff81128ed5>] try_to_release_page+0x35/0x50
[ 6107.996074]  [<ffffffff81139361>] invalidate_inode_page+0x71/0x90
[ 6107.996074]  [<ffffffff81139492>] invalidate_mapping_pages+0x112/0x1d0
[ 6107.996074]  [<ffffffff8112dbc6>] SyS_fadvise64_64+0x196/0x270
[ 6107.996074]  [<ffffffff8112dcae>] SyS_fadvise64+0xe/0x10
[ 6107.996074[ 6132.136005] BUG: soft lockup - CPU#1 stuck for 22s! [mkfs.btrfs:23741]
[ 6132.136009] Modules linked in: dm_flakey rpcsec_gss_krb5 dm_crypt loop btrfs
[ 6132.136009] irq event stamp: 0
[ 6132.136009] hardirqs last  enabled at (0): [<          (null)>]           (null)
[ 6132.136009] hardirqs last disabled at (0): [<ffffffff8105f269>] copy_process+0x3f9/0x1910
[ 6132.136009] softirqs last  enabled at (0): [<ffffffff8105f269>] copy_process+0x3f9/0x1910
[ 6132.136009] softirqs last disabled at (0): [<          (null)>]           (null)
[ 6132.136009] CPU: 1 PID: 23741 Comm: mkfs.btrfs Tainted: G      D W    3.14.0-rc7-default+ #122
[ 6132.136009] Hardware name: Intel Corporation Santa Rosa platform/Matanzas, BIOS TSRSCRB1.86C.0047.B00.0610170821 10/17/06
[ 6132.136009] task: ffff880049fd8910 ti: ffff880047a04000 task.ti: ffff880047a04000
[ 6132.136009] RIP: 0010:[<ffffffff810dd24a>]  [<ffffffff810dd24a>] generic_exec_single+0x5a/0x80
[ 6132.136009] RSP: 0018:ffff880047a055d8  EFLAGS: 00000202
[ 6132.136009] RAX: 00000000000008fb RBX: ffffffff81a0431c RCX: 0000000000000000
[ 6132.136009] RDX: ffff88007d3d4600 RSI: ffffffff81037a02 RDI: 0000000000000000
[ 6132.136009] RBP: ffff880047a055f8 R08: ffff880047a05728 R09: 0000000000000000
[ 6132.136009] R10: 0000000000000000 R11: 0000000000000000 R12: ffff880047a05548
[ 6132.136009] R13: ffff88007d5d3b00 R14: ffff880047a04000 R15: ffff880049fd8910
[ 6132.136009] FS:  0000000000000000(0000) GS:ffff88007d400000(0000) knlGS:0000000000000000
[ 6132.136009] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 6132.136009] CR2: 00007fad85055000 CR3: 000000000220b000 CR4: 00000000000007e0
[ 6132.136009] Stack:
[ 6132.136009]  0000010100000082 0000000000000000 ffffffff811ae330 0000000000000000
[ 6132.136009]  ffff880047a05678 ffffffff810dd4f5 ffff880047a05618 ffff880047a05688
[ 6132.136009]  0000000000000000 0000000000000000 ffffffff811ae330 0000000000000000
[ 6132.136009] Call Trace:
]  [<ffffffff81a0cc52>] system_call_fastpath+0x16
[ 6132.136009]  [<ffffffff811ae330>] ? buffer_cpu_notify+0xa0/0xa0
[ 6132.136009]  [<ffffffff810dd4f5>] smp_call_function_single+0x175/0x180
[ 6132.136009]  [<ffffffff811ae330>] ? buffer_cpu_notify+0xa0/0xa0
[ 6132.136009]  [<ffffffff81136945>] ? pagevec_lookup_tag+0x25/0x40
[ 6132.136009]  [<ffffffff811ae330>] ? buffer_cpu_notify+0xa0/0xa0
[ 6132.136009]  [<ffffffff810dd897>] smp_call_function_many+0x227/0x240
[ 6132.136009]  [<ffffffff811ae330>] ? buffer_cpu_notify+0xa0/0xa0
[ 6132.136009]  [<ffffffff811ae330>] ? buffer_cpu_notify+0xa0/0xa0
[ 6132.136009]  [<ffffffff810dd8f2>] on_each_cpu_mask+0x42/0xa0
[ 6132.136009]  [<ffffffff811acf10>] ? mark_buffer_async_write+0x20/0x20
[ 6132.136009]  [<ffffffff810dd9ea>] on_each_cpu_cond+0x9a/0xd0
[ 6132.136009]  [<ffffffff811ad9d9>] invalidate_bh_lrus+0x29/0x30
[ 6132.136009]  [<ffffffff811b5535>] kill_bdev+0x25/0x40
[ 6132.136009]  [<ffffffff811b5976>] __blkdev_put+0x76/0x1e0
[ 6132.136009]  [<ffffffff811b5b40>] blkdev_put+0x60/0x190
[ 6132.136009]  [<ffffffff811b5c97>] blkdev_close+0x27/0x30
[ 6132.136009]  [<ffffffff8117b369>] __fput+0xc9/0x240
[ 6132.136009]  [<ffffffff8117b52e>] ____fput+0xe/0x10
[ 6132.136009]  [<ffffffff81083844>] task_work_run+0xb4/0xe0
[ 6132.136009]  [<ffffffff81063bb3>] do_exit+0x2b3/0xa80
[ 6132.136009]  [<ffffffff810c1ea5>] ? kmsg_dump+0x115/0x130
[ 6132.136009]  [<ffffffff810c1db6>] ? kmsg_dump+0x26/0x130
[ 6132.136009]  [<ffffffff81a05100>] oops_end+0xa0/0xe0
[ 6132.136009]  [<ffffffff8100618b>] die+0x5b/0x90
[ 6132.136009]  [<ffffffff81a04a53>] do_trap+0xc3/0x170
[ 6132.136009]  [<ffffffff810032a5>] do_invalid_op+0x95/0xb0
[ 6132.136009]  [<ffffffff8116dbea>] ? free_block+0x23a/0x270
[ 6132.136009]  [<ffffffff810ab099>] ? trace_hardirqs_off_caller+0x29/0xd0
[ 6132.136009]  [<ffffffff813cc6bd>] ? trace_hardirqs_off_thunk+0x3a/0x3c
[ 6132.136009]  [<ffffffff81a0434c>] ? restore_args+0x30/0x30
[ 6132.136009]  [<ffffffff81a0e2b8>] invalid_op+0x18/0x20
[ 6132.136009]  [<ffffffff810c0cc9>] ? vprintk_emit+0x279/0x530
[ 6132.136009]  [<ffffffff810ab14d>] ? trace_hardirqs_off+0xd/0x10
[ 6132.136009]  [<ffffffff8116dbea>] ? free_block+0x23a/0x270
[ 6132.136009]  [<ffffffff8116dbea>] ? free_block+0x23a/0x270
[ 6132.136009]  [<ffffffff8116dc93>] cache_flusharray+0x73/0x130
[ 6132.136009]  [<ffffffff8116deb7>] kmem_cache_free+0x167/0x180
[ 6132.136009]  [<ffffffff8116d97d>] slab_destroy+0x18d/0x1c0
[ 6132.136009]  [<ffffffff8116dbc6>] free_block+0x216/0x270
[ 6132.136009]  [<ffffffff8116dc93>] cache_flusharray+0x73/0x130
[ 6132.136009]  [<ffffffff811ad1e2>] ? free_buffer_head+0x22/0x50
[ 6132.136009]  [<ffffffff8116deb7>] kmem_cache_free+0x167/0x180
[ 6132.136009]  [<ffffffff811ad1e2>] free_buffer_head+0x22/0x50
[ 6132.136009]  [<ffffffff811ad424>] try_to_free_buffers+0x84/0xc0
[ 6132.136009]  [<ffffffff811b5125>] blkdev_releasepage+0x45/0x50
[ 6132.136009]  [<ffffffff81128ed5>] try_to_release_page+0x35/0x50
[ 6132.136009]  [<ffffffff81139361>] invalidate_inode_page+0x71/0x90
[ 6132.136009]  [<ffffffff81139492>] invalidate_mapping_pages+0x112/0x1d0
[ 6132.136009]  [<ffffffff8112dbc6>] SyS_fadvise64_64+0x196/0x270
[ 6132.136009]  [<ffffffff8112dcae>] SyS_fadvise64+0xe/0x10
[ 6132.136009]  [<ffffffff81a0cc52>] system_call_fastpath+0x16/0x1b
[ 6132.136009] Code: c7 c2 00 46 1d 00 48 89 de 48 03 14 c5 00 36 34 82 48 89 df e8 b8 3d 2f 00 84 c0 75 24 45 85 e4 75 09 eb 0d 0f 1f 44 00 00 f3 90 <f6> 43 20 01 75 f8 48 8b 5d e8 4c 8b 65 f0 4c 8b 6d f8 c9 c3 66
[ 6108.366382] ------------[ cut here ]------------
Comment 1 David Sterba 2014-03-24 16:27:04 UTC 
Reproduces with latest integration (for 3.15 changes).
Comment 2 David Sterba 2014-04-16 16:05:53 UTC 
Seems ok with 3.15-rc1
Note You need to log in before you can comment on or make changes to this bug.