[PATCH 2.6.17-rc1-mm1] BUG due to freed dentry in dcache race fix
From: Balbir Singh
Date: Thu Apr 06 2006 - 10:09:22 EST
Hi, Andrew,
Please apply this patch on top of
fix-dcache-race-during-umount.patch
we need to save a reference to the s_umount read write semaphore. The dentry
can be freed by prune_one_dentry(). Dereferencing dentry->d_sb->s_umount is
not safe after that point.
I hit an Oops while running 2.6.17-rc1-mm1
DMA free:3584kB min:68kB low:84kB high:100kB active:10448kB inactive:0kB presentOops: 0002 [#1]
PREEMPT SMP
last sysfs file: /devices/pci0000:00/0000:00:0a.0/power/state
Modules linked in: loop dm_mod ide_cd cdrom ohci_hcd usbcore serverworks generii
CPU: 1
EIP: 0060:[<c10824f1>] Not tainted VLI
EFLAGS: 00010212 (2.6.17-rc1-mm1cpum #2)
EIP is at prune_dcache+0x91/0x1d0
eax: 6b6b6ba7 ebx: e45918e0 ecx: 00000001 edx: ffffffff
esi: e45918e8 edi: 00000058 ebp: e4cfcbe0 esp: e4cfcbbc
ds: 007b es: 007b ss: 0068
Process hackbench (pid: 11183, threadinfo=e4cfc000 task=e4d076b0)
Stack: <0>c12fb400 e4cfcbd0 c122f5ed c2288504 00000000 00000000 0000283c 000a0f
c2259404 e4cfcbe8 c108266e e4cfcc28 c104fe9b 00000080 000000d0 0000000b
00000021 00000000 e4cfc000 00000000 0000008c e4cfc000 00000080 00004db7
Call Trace:
<c1003f9d> show_stack_log_lvl+0xad/0xe0 <c10041e7> show_registers+0x1c7/0x250
<c10043aa> die+0x13a/0x330 <c1230f50> do_page_fault+0x2d0/0x750
<c1003987> error_code+0x4f/0x54 <c108266e> shrink_dcache_memory+0x3e/0x50
<c104fe9b> shrink_slab+0x17b/0x240 <c105077f> try_to_free_pages+0x1bf/0x2b0
<c104b466> __alloc_pages+0x136/0x310 <c10635fc> cache_alloc_refill+0x40c/0x70
<c1063b86> __kmalloc_track_caller+0xc6/0xf0 <c11d922f> __alloc_skb+0x5f/0x110
<c11d5247> sock_alloc_send_skb+0x1a7/0x200 <c1227a2d> unix_stream_sendmsg+0x0
<c11d1bb4> do_sock_write+0xb4/0xc0 <c11d2367> sock_aio_write+0x67/0x70
<c1067809> do_sync_write+0xb9/0xf0 <c10682f1> vfs_write+0x181/0x190
<c1068a07> sys_write+0x47/0x70 <c122f93f> sysenter_past_esp+0x54/0x75
Code: 0a 75 f3 85 c0 0f 88 fe 00 00 00 8b 4b 60 8b 41 38 85 c0 0f 84 de 00 00 0
Thanks,
Balbir
Signed-off-by: Balbir Singh <balbir@xxxxxxxxxx>
---
fs/dcache.c | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletion(-)
diff -puN fs/dcache.c~dcache_race_umount_sem_fix fs/dcache.c
--- linux-2.6.17/fs/dcache.c~dcache_race_umount_sem_fix 2006-04-06 17:11:41.000000000 +0530
+++ linux-2.6.17-balbir/fs/dcache.c 2006-04-06 17:17:02.000000000 +0530
@@ -464,9 +464,14 @@ static void prune_dcache(int count, stru
* So we try to get s_umount, and make sure s_root isn't NULL
*/
if (down_read_trylock(&dentry->d_sb->s_umount)) {
+ /*
+ * Save the semaphore reference, prune_one_dentry() can
+ * free the dentry
+ */
+ struct rw_semaphore *umnt_sem = &dentry->d_sb->s_umount;
if (dentry->d_sb->s_root != NULL) {
prune_one_dentry(dentry);
- up_read(&dentry->d_sb->s_umount);
+ up_read(umnt_sem);
continue;
}
up_read(&dentry->d_sb->s_umount);
_
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/