linux 2.4.28 umount oops

[Bjoern Brill]

Hello list,

my machine oopses in the umount script at shutdown once every few
weeks (at 1-2 shutdowns / day). Two times this resulted in repairable
errors on an EXT3 filesystem during the next bootup.

This is on an i386 (actually AMD K6-II) machine with a single IDE disk.
The mounted filesystems are EXT3 and VFAT. I don't use LVM, cryptoloop, or
other fancy stuff. The kernel is a self-compiled kernel.org 2.4.28 with no
extra patches; I think the problem did also occur with at least 2.4.27
and 2.4.26.

Attached is the output of ver_linux and ksymoops. (I had to copy the oops
by hand. I tried to be careful, but may have made errors.) More data
(dmesg, etc) can be found at
<http://fs.math.uni-frankfurt.de/~brill/oops-20050119/>
and I can produce anything else on request.

According to ksymoops, EIP points to an address in
fs/buffer.c::__remove_inode_queue(). Could somebody please have a look at
the oops or point me to the right person? (I couldn't find a suitable
entry in the MAINTAINERS file.)

Please CC me on list replies.


Thanks,

Bjoern Brill
--
Bj"orn Brill <brill@xxxxxxxxxxxxxxxxxxxxxxxx>
Frankfurt am Main, Germany
If some fields are empty or look unusual you may have an old version.
Compare to the current minimal requirements in Documentation/Changes.
 
Linux kvaefjord 2.4.28 #3 Tue Nov 23 01:50:14 CET 2004 i586 unknown
 
Gnu C                  2.95.4
Gnu make               3.79.1
util-linux             2.11n
mount                  2.11n
modutils               2.4.26
e2fsprogs              1.27
PPP                    2.4.1
Linux C Library        2.2.5
Dynamic linker (ldd)   2.2.5
Procps                 2.0.7
Net-tools              1.60
Console-tools          0.2.3
Sh-utils               2.0.11
Modules Loaded         radeon ne 8390 crc32 usb-uhci usbcore rtc emu10k1-gp joydev analog snd-emu10k1-synth snd-emux-synth snd-seq-midi-emul snd-seq-virmidi snd-seq-midi-event snd-seq snd-emu10k1 snd-pcm-oss snd-mixer-oss snd-pcm snd-timer snd-hwdep snd-page-alloc snd-util-mem snd-ac97-codec snd-rawmidi snd-seq-device snd soundcore aha152x ide-scsi
ksymoops 2.4.5 on i586 2.4.28.  Options used
     -v /usr/src/linux-2.4.28/vmlinux (specified)
     -k 20050119010807.ksyms (specified)
     -l 20050119010807.modules (specified)
     -o /lib/modules/2.4.28/ (default)
     -m /boot/System.map-2.4.28 (default)

Deactivating swap...done
Unmounting local filesystems...Unable to handle kernel NULL pointer dereference
c0131a12
*pde = 00000000
Oops: 0002
CPU: 0
EIP: 0010:[<c0131a12>] Not tainted
Using defaults from ksymoops -t elf32-i386 -a i386
EFLAGS: 00010202
eax: 0000000c   ebx: cca06ad8     ecx: 00001000       edx: cca06a84
esi: cca06a80   edi: cca06888     ebp: cf157f54       esp: cf157ef4
ds: 0018    es: 0018    ss: 0018
Stack:  cca06a98 c0131e73 cca06a84 cca06a88 cca06a80 c01425ec cca06a80 cfd4fc00
        cf157f54 cf157f54 00000001 0001dcc4 00000000 c014269b c0264904 cfd4fc00
        cf157f54 c02648fc cfd4fc00 cf157f54 cfd4fc00 cfd4fc48 c0265ba0 bfffff1b
Call Trace: [<c0131e73>] [<c01425ec>] [<c014269b>] [<c013529d>] [<c0144081>]
[<c0138e0e>] [<c01446ad>] [<c0106b23>]
Code: 89 48 04 89 01 c7 42 54 00 00 00 00 c7 43 04 00 00 00 00 b8


>>EIP; c0131a12 <__remove_inode_queue+e/2c>   <=====

>>ebx; cca06ad8 <_end+c720578/105ceaa0>
>>ecx; 00001000 Before first symbol
>>edx; cca06a84 <_end+c720524/105ceaa0>
>>esi; cca06a80 <_end+c720520/105ceaa0>
>>edi; cca06888 <_end+c720328/105ceaa0>
>>ebp; cf157f54 <_end+ee719f4/105ceaa0>
>>esp; cf157ef4 <_end+ee71994/105ceaa0>

Trace; c0131e73 <invalidate_inode_buffers+23/58>
Trace; c01425ec <invalidate_list+3c/b8>
Trace; c014269b <invalidate_inodes+33/78>
Trace; c013529d <kill_super+81/dc>
Trace; c0144081 <__mntput+1d/24>
Trace; c0138e0e <path_release+26/2c>
Trace; c01446ad <sys_umount+6d/78>
Trace; c0106b23 <system_call+33/40>

Code;  c0131a12 <__remove_inode_queue+e/2c>
00000000 <_EIP>:
Code;  c0131a12 <__remove_inode_queue+e/2c>   <=====
   0:   89 48 04                  mov    %ecx,0x4(%eax)   <=====
Code;  c0131a15 <__remove_inode_queue+11/2c>
   3:   89 01                     mov    %eax,(%ecx)
Code;  c0131a17 <__remove_inode_queue+13/2c>
   5:   c7 42 54 00 00 00 00      movl   $0x0,0x54(%edx)
Code;  c0131a1e <__remove_inode_queue+1a/2c>
   c:   c7 43 04 00 00 00 00      movl   $0x0,0x4(%ebx)
Code;  c0131a25 <__remove_inode_queue+21/2c>
  13:   b8 00 00 00 00            mov    $0x0,%eax