2015-06-04 09:12:07

by Stefan Seyfried

[permalink] [raw]
Subject: [REGRESSION] 4.1-rc6 unloading loop OOPS

Hi all,

I just tried to unload loop to change the max_part parameter on my
freshly booted 4.1-rc6.
This produced this nice Warning, then an OOPS:
[ 661.382335] ------------[ cut here ]------------
[ 661.382344] WARNING: CPU: 1 PID: 2903 at ../mm/backing-dev.c:372 bdi_unregister+0x32/0x40()
[ 661.382346] Modules linked in: ctr ccm fuse xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT xt_tcpudp tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ip_tables x_tables af_packet bnep bluetooth dm_crypt ecb algif_skcipher af_alg xfs libcrc32c iTCO_wdt iTCO_vendor_support snd_hda_codec_conexant snd_hda_codec_generic snd_hda_intel snd_hda_controller snd_hda_codec snd_hda_core snd_hwdep snd_pcm_oss snd_pcm dm_mod coretemp kvm_intel arc4 kvm snd_seq iwldvm cdc_ether cdc_acm cdc_wdm usbnet mac80211 mii thinkpad_acpi snd_seq_device snd_timer iwlwifi i2c_i801 snd_mixer_oss pcspkr serio_raw cfg80211 lpc_ich snd mfd_core shpchp mei_me mei soundcore rfkill
[ 661.382393] tpm_tis battery ac tpm wmi acpi_cpufreq i915 i2c_algo_bit drm_kms_helper xhci_pci xhci_hcd drm e1000e ptp pps_core video button fan thermal processor sg loop(-)
[ 661.382408] CPU: 1 PID: 2903 Comm: rmmod Not tainted 4.1.0-rc6-2.g8f2a4d1-desktop #1
[ 661.382410] Hardware name: LENOVO 74665EG/74665EG, BIOS 6DET71WW (3.21 ) 12/13/2011
[ 661.382412] 0000000000000000 ffffffff81a4c793 ffffffff8169b34a 0000000000000000
[ 661.382415] ffffffff81067b71 ffff8802307b5400 0000000000000000 0000000000000000
[ 661.382418] 00000000ffffffff 0000000000000000 ffffffff8118cdd2 000000000000000e
[ 661.382421] Call Trace:
[ 661.382434] [<ffffffff810055bc>] dump_trace+0x8c/0x340
[ 661.382438] [<ffffffff8100596c>] show_stack_log_lvl+0xfc/0x1a0
[ 661.382442] [<ffffffff81007071>] show_stack+0x21/0x50
[ 661.382447] [<ffffffff8169b34a>] dump_stack+0x47/0x67
[ 661.382452] [<ffffffff81067b71>] warn_slowpath_common+0x81/0xb0
[ 661.382457] [<ffffffff8118cdd2>] bdi_unregister+0x32/0x40
[ 661.382461] [<ffffffff8133e040>] del_gendisk+0x110/0x280
[ 661.382470] [<ffffffffa0000351>] loop_remove+0x21/0x50 [loop]
[ 661.382476] [<ffffffffa0000391>] loop_exit_cb+0x11/0x20 [loop]
[ 661.382480] [<ffffffff81359743>] idr_for_each+0xa3/0xf0
[ 661.382487] [<ffffffffa0003516>] loop_exit+0x30/0xb1a [loop]
[ 661.382492] [<ffffffff810ece3c>] SyS_delete_module+0x1ac/0x230
[ 661.382497] [<ffffffff816a1cb2>] system_call_fastpath+0x16/0x75
[ 661.382502] [<00007ff635777f37>] 0x7ff635777f37
[ 661.382504] ---[ end trace 7b8e0f39c45cf571 ]---
[ 661.449507] BUG: unable to handle kernel NULL pointer dereference at 0000000000000108
[ 661.449548] IP: [<ffffffff8135b3ce>] kobject_del+0xe/0x50
[ 661.449586] PGD 1d8f2c067 PUD 1d8e7c067 PMD 0
[ 661.449618] Oops: 0000 [#1] PREEMPT SMP
[ 661.449649] Modules linked in: ctr ccm fuse xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT xt_tcpudp tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ip_tables x_tables af_packet bnep bluetooth dm_crypt ecb algif_skcipher af_alg xfs libcrc32c iTCO_wdt iTCO_vendor_support snd_hda_codec_conexant snd_hda_codec_generic snd_hda_intel snd_hda_controller snd_hda_codec snd_hda_core snd_hwdep snd_pcm_oss snd_pcm dm_mod coretemp kvm_intel arc4 kvm snd_seq iwldvm cdc_ether cdc_acm cdc_wdm usbnet mac80211 mii thinkpad_acpi snd_seq_device snd_timer iwlwifi i2c_i801 snd_mixer_oss pcspkr serio_raw cfg80211 lpc_ich snd mfd_core shpchp mei_me mei soundcore rfkill
[ 661.449906] tpm_tis battery ac tpm wmi acpi_cpufreq i915 i2c_algo_bit drm_kms_helper xhci_pci xhci_hcd drm e1000e ptp pps_core video button fan thermal processor sg loop(-)
[ 661.449993] CPU: 0 PID: 2903 Comm: rmmod Tainted: G W 4.1.0-rc6-2.g8f2a4d1-desktop #1
[ 661.450025] Hardware name: LENOVO 74665EG/74665EG, BIOS 6DET71WW (3.21 ) 12/13/2011
[ 661.450055] task: ffff8802322220d0 ti: ffff8801d8d78000 task.ti: ffff8801d8d78000
[ 661.450084] RIP: 0010:[<ffffffff8135b3ce>] [<ffffffff8135b3ce>] kobject_del+0xe/0x50
[ 661.450118] RSP: 0018:ffff8801d8d7bd78 EFLAGS: 00010206
[ 661.450146] RAX: ffff88023004ab60 RBX: 00000000000000d8 RCX: 0000000000000001
[ 661.450175] RDX: 0000000000000000 RSI: ffff88023078c4d8 RDI: 00000000000000d8
[ 661.450203] RBP: ffff88023004f800 R08: ffff88023215a8b8 R09: ffff88023215b0c8
[ 661.450217] R10: 0001526900015261 R11: 000000000000000e R12: 0000000000000000
[ 661.450217] R13: ffff8802300577e0 R14: ffff88023004f400 R15: ffffffffa0000380
[ 661.450217] FS: 00007ff636056700(0000) GS:ffff88023bc00000(0000) knlGS:0000000000000000
[ 661.450217] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 661.450217] CR2: 0000000000000108 CR3: 000000023223f000 CR4: 00000000000407f0
[ 661.450217] Stack:
[ 661.450217] ffffffffa0000380 0000000000000001 ffff88023004f800 ffffffff8133abed
[ 661.450217] ffff8802319eba80 ffff8802300577e0 ffff88023004f800 ffffffff8133ac61
[ 661.450217] ffff8802300577e0 ffff88023004f400 0000000000000000 00000000ffffffff
[ 661.450217] Call Trace:
[ 661.450217] [<ffffffff8133abed>] blk_mq_unregister_hctx.part.0+0x3d/0x60
[ 661.450217] [<ffffffff8133ac61>] blk_mq_unregister_disk+0x51/0xe0
[ 661.450217] [<ffffffff81330a2c>] blk_unregister_queue+0x2c/0x90
[ 661.450217] [<ffffffff8133e048>] del_gendisk+0x118/0x280
[ 661.450217] [<ffffffffa0000351>] loop_remove+0x21/0x50 [loop]
[ 661.450217] [<ffffffffa0000391>] loop_exit_cb+0x11/0x20 [loop]
[ 661.450217] [<ffffffff81359743>] idr_for_each+0xa3/0xf0
[ 661.450217] [<ffffffffa0003516>] loop_exit+0x30/0xb1a [loop]
[ 661.450217] [<ffffffff810ece3c>] SyS_delete_module+0x1ac/0x230
[ 661.450217] [<ffffffff816a1cb2>] system_call_fastpath+0x16/0x75
[ 661.450217] [<00007ff635777f37>] 0x7ff635777f37
[ 661.450217] Code: 48 83 c7 18 e9 54 ff ff ff 0f 1f 40 00 5b c3 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 55 53 48 89 fb 48 83 ec 08 48 85 ff 74 2e <48> 8b 6f 30 e8 09 cc ef ff 48 89 ef e8 a1 98 ef ff 80 63 3c fd
[ 661.450217] RIP [<ffffffff8135b3ce>] kobject_del+0xe/0x50
[ 661.450217] RSP <ffff8801d8d7bd78>
[ 661.450217] CR2: 0000000000000108
[ 661.466690] ---[ end trace 7b8e0f39c45cf572 ]---

I can reproduce the backtrace after a reboot once (subsequent modprobe/rmmod loop
do not complain anymore), but not the OOPS.

Best regards,

Stefan
--
Stefan Seyfried
Linux Consultant & Developer -- GPG Key: 0x731B665B

B1 Systems GmbH
Osterfeldstraße 7 / 85088 Vohburg / http://www.b1-systems.de
GF: Ralph Dehner / Unternehmenssitz: Vohburg / AG: Ingolstadt,HRB 3537


2015-06-04 10:24:09

by Ming Lei

[permalink] [raw]
Subject: Re: [REGRESSION] 4.1-rc6 unloading loop OOPS

On Thu, Jun 4, 2015 at 5:11 PM, Stefan Seyfried
<[email protected]> wrote:
>
> Hi all,
>
> I just tried to unload loop to change the max_part parameter on my
> freshly booted 4.1-rc6.
> This produced this nice Warning, then an OOPS:
> [ 661.382335] ------------[ cut here ]------------
> [ 661.382344] WARNING: CPU: 1 PID: 2903 at ../mm/backing-dev.c:372 bdi_unregister+0x32/0x40()
> [ 661.382346] Modules linked in: ctr ccm fuse xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT xt_tcpudp tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ip_tables x_tables af_packet bnep bluetooth dm_crypt ecb algif_skcipher af_alg xfs libcrc32c iTCO_wdt iTCO_vendor_support snd_hda_codec_conexant snd_hda_codec_generic snd_hda_intel snd_hda_controller snd_hda_codec snd_hda_core snd_hwdep snd_pcm_oss snd_pcm dm_mod coretemp kvm_intel arc4 kvm snd_seq iwldvm cdc_ether cdc_acm cdc_wdm usbnet mac80211 mii thinkpad_acpi snd_seq_device snd_timer iwlwifi i2c_i801 snd_mixer_oss pcspkr serio_raw cfg80211 lpc_ich snd mfd_core shpchp mei_me mei soundcore rfkill
> [ 661.382393] tpm_tis battery ac tpm wmi acpi_cpufreq i915 i2c_algo_bit drm_kms_helper xhci_pci xhci_hcd drm e1000e ptp pps_core video button fan thermal processor sg loop(-)
> [ 661.382408] CPU: 1 PID: 2903 Comm: rmmod Not tainted 4.1.0-rc6-2.g8f2a4d1-desktop #1
> [ 661.382410] Hardware name: LENOVO 74665EG/74665EG, BIOS 6DET71WW (3.21 ) 12/13/2011
> [ 661.382412] 0000000000000000 ffffffff81a4c793 ffffffff8169b34a 0000000000000000
> [ 661.382415] ffffffff81067b71 ffff8802307b5400 0000000000000000 0000000000000000
> [ 661.382418] 00000000ffffffff 0000000000000000 ffffffff8118cdd2 000000000000000e
> [ 661.382421] Call Trace:
> [ 661.382434] [<ffffffff810055bc>] dump_trace+0x8c/0x340
> [ 661.382438] [<ffffffff8100596c>] show_stack_log_lvl+0xfc/0x1a0
> [ 661.382442] [<ffffffff81007071>] show_stack+0x21/0x50
> [ 661.382447] [<ffffffff8169b34a>] dump_stack+0x47/0x67
> [ 661.382452] [<ffffffff81067b71>] warn_slowpath_common+0x81/0xb0
> [ 661.382457] [<ffffffff8118cdd2>] bdi_unregister+0x32/0x40
> [ 661.382461] [<ffffffff8133e040>] del_gendisk+0x110/0x280
> [ 661.382470] [<ffffffffa0000351>] loop_remove+0x21/0x50 [loop]
> [ 661.382476] [<ffffffffa0000391>] loop_exit_cb+0x11/0x20 [loop]
> [ 661.382480] [<ffffffff81359743>] idr_for_each+0xa3/0xf0
> [ 661.382487] [<ffffffffa0003516>] loop_exit+0x30/0xb1a [loop]
> [ 661.382492] [<ffffffff810ece3c>] SyS_delete_module+0x1ac/0x230
> [ 661.382497] [<ffffffff816a1cb2>] system_call_fastpath+0x16/0x75
> [ 661.382502] [<00007ff635777f37>] 0x7ff635777f37
> [ 661.382504] ---[ end trace 7b8e0f39c45cf571 ]---
> [ 661.449507] BUG: unable to handle kernel NULL pointer dereference at 0000000000000108
> [ 661.449548] IP: [<ffffffff8135b3ce>] kobject_del+0xe/0x50
> [ 661.449586] PGD 1d8f2c067 PUD 1d8e7c067 PMD 0
> [ 661.449618] Oops: 0000 [#1] PREEMPT SMP
> [ 661.449649] Modules linked in: ctr ccm fuse xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT xt_tcpudp tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ip_tables x_tables af_packet bnep bluetooth dm_crypt ecb algif_skcipher af_alg xfs libcrc32c iTCO_wdt iTCO_vendor_support snd_hda_codec_conexant snd_hda_codec_generic snd_hda_intel snd_hda_controller snd_hda_codec snd_hda_core snd_hwdep snd_pcm_oss snd_pcm dm_mod coretemp kvm_intel arc4 kvm snd_seq iwldvm cdc_ether cdc_acm cdc_wdm usbnet mac80211 mii thinkpad_acpi snd_seq_device snd_timer iwlwifi i2c_i801 snd_mixer_oss pcspkr serio_raw cfg80211 lpc_ich snd mfd_core shpchp mei_me mei soundcore rfkill
> [ 661.449906] tpm_tis battery ac tpm wmi acpi_cpufreq i915 i2c_algo_bit drm_kms_helper xhci_pci xhci_hcd drm e1000e ptp pps_core video button fan thermal processor sg loop(-)
> [ 661.449993] CPU: 0 PID: 2903 Comm: rmmod Tainted: G W 4.1.0-rc6-2.g8f2a4d1-desktop #1
> [ 661.450025] Hardware name: LENOVO 74665EG/74665EG, BIOS 6DET71WW (3.21 ) 12/13/2011
> [ 661.450055] task: ffff8802322220d0 ti: ffff8801d8d78000 task.ti: ffff8801d8d78000
> [ 661.450084] RIP: 0010:[<ffffffff8135b3ce>] [<ffffffff8135b3ce>] kobject_del+0xe/0x50
> [ 661.450118] RSP: 0018:ffff8801d8d7bd78 EFLAGS: 00010206
> [ 661.450146] RAX: ffff88023004ab60 RBX: 00000000000000d8 RCX: 0000000000000001
> [ 661.450175] RDX: 0000000000000000 RSI: ffff88023078c4d8 RDI: 00000000000000d8
> [ 661.450203] RBP: ffff88023004f800 R08: ffff88023215a8b8 R09: ffff88023215b0c8
> [ 661.450217] R10: 0001526900015261 R11: 000000000000000e R12: 0000000000000000
> [ 661.450217] R13: ffff8802300577e0 R14: ffff88023004f400 R15: ffffffffa0000380
> [ 661.450217] FS: 00007ff636056700(0000) GS:ffff88023bc00000(0000) knlGS:0000000000000000
> [ 661.450217] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [ 661.450217] CR2: 0000000000000108 CR3: 000000023223f000 CR4: 00000000000407f0
> [ 661.450217] Stack:
> [ 661.450217] ffffffffa0000380 0000000000000001 ffff88023004f800 ffffffff8133abed
> [ 661.450217] ffff8802319eba80 ffff8802300577e0 ffff88023004f800 ffffffff8133ac61
> [ 661.450217] ffff8802300577e0 ffff88023004f400 0000000000000000 00000000ffffffff
> [ 661.450217] Call Trace:
> [ 661.450217] [<ffffffff8133abed>] blk_mq_unregister_hctx.part.0+0x3d/0x60
> [ 661.450217] [<ffffffff8133ac61>] blk_mq_unregister_disk+0x51/0xe0
> [ 661.450217] [<ffffffff81330a2c>] blk_unregister_queue+0x2c/0x90
> [ 661.450217] [<ffffffff8133e048>] del_gendisk+0x118/0x280
> [ 661.450217] [<ffffffffa0000351>] loop_remove+0x21/0x50 [loop]
> [ 661.450217] [<ffffffffa0000391>] loop_exit_cb+0x11/0x20 [loop]
> [ 661.450217] [<ffffffff81359743>] idr_for_each+0xa3/0xf0
> [ 661.450217] [<ffffffffa0003516>] loop_exit+0x30/0xb1a [loop]
> [ 661.450217] [<ffffffff810ece3c>] SyS_delete_module+0x1ac/0x230
> [ 661.450217] [<ffffffff816a1cb2>] system_call_fastpath+0x16/0x75
> [ 661.450217] [<00007ff635777f37>] 0x7ff635777f37
> [ 661.450217] Code: 48 83 c7 18 e9 54 ff ff ff 0f 1f 40 00 5b c3 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 55 53 48 89 fb 48 83 ec 08 48 85 ff 74 2e <48> 8b 6f 30 e8 09 cc ef ff 48 89 ef e8 a1 98 ef ff 80 63 3c fd
> [ 661.450217] RIP [<ffffffff8135b3ce>] kobject_del+0xe/0x50
> [ 661.450217] RSP <ffff8801d8d7bd78>
> [ 661.450217] CR2: 0000000000000108
> [ 661.466690] ---[ end trace 7b8e0f39c45cf572 ]---
>
> I can reproduce the backtrace after a reboot once (subsequent modprobe/rmmod loop
> do not complain anymore), but not the OOPS.

One fix[1] was just merged to linus tree, and could you test that to see if your
issue can be addressed?

[1] http://marc.info/?t=143201518300001&r=1&w=2


Thanks,
Ming

>
> Best regards,
>
> Stefan
> --
> Stefan Seyfried
> Linux Consultant & Developer -- GPG Key: 0x731B665B
>
> B1 Systems GmbH
> Osterfeldstraße 7 / 85088 Vohburg / http://www.b1-systems.de
> GF: Ralph Dehner / Unternehmenssitz: Vohburg / AG: Ingolstadt,HRB 3537
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/




--
Ming Lei

2015-06-04 14:36:27

by Stefan Seyfried

[permalink] [raw]
Subject: Re: [REGRESSION] 4.1-rc6 unloading loop OOPS

Hi Ming,

Am 04.06.2015 um 12:24 schrieb Ming Lei:
> On Thu, Jun 4, 2015 at 5:11 PM, Stefan Seyfried
> <[email protected]> wrote:

>> I can reproduce the backtrace after a reboot once (subsequent modprobe/rmmod loop
>> do not complain anymore), but not the OOPS.
>
> One fix[1] was just merged to linus tree, and could you test that to see if your
> issue can be addressed?
>
> [1] http://marc.info/?t=143201518300001&r=1&w=2

I just tried current Linus' master v4.1-rc6-49-g8a7deb3 which contains
this commit and do no longer get the Warning

Unfortunately, due to this I cannot really test your patch for the OOPS
(but the OOPS was only happening once for me, so it was not reliably
triggered).

Thanks, things work well for me, again :-)

Best regards,

Stefan
--
Stefan Seyfried
Linux Consultant & Developer -- GPG Key: 0x731B665B

B1 Systems GmbH
Osterfeldstraße 7 / 85088 Vohburg / http://www.b1-systems.de
GF: Ralph Dehner / Unternehmenssitz: Vohburg / AG: Ingolstadt,HRB 3537

2015-06-04 14:43:49

by Ming Lei

[permalink] [raw]
Subject: Re: [REGRESSION] 4.1-rc6 unloading loop OOPS

On Thu, Jun 4, 2015 at 10:36 PM, Stefan Seyfried
<[email protected]> wrote:
> Hi Ming,
>
> Am 04.06.2015 um 12:24 schrieb Ming Lei:
>> On Thu, Jun 4, 2015 at 5:11 PM, Stefan Seyfried
>> <[email protected]> wrote:
>
>>> I can reproduce the backtrace after a reboot once (subsequent modprobe/rmmod loop
>>> do not complain anymore), but not the OOPS.
>>
>> One fix[1] was just merged to linus tree, and could you test that to see if your
>> issue can be addressed?
>>
>> [1] http://marc.info/?t=143201518300001&r=1&w=2
>
> I just tried current Linus' master v4.1-rc6-49-g8a7deb3 which contains
> this commit and do no longer get the Warning
>
> Unfortunately, due to this I cannot really test your patch for the OOPS
> (but the OOPS was only happening once for me, so it was not reliably
> triggered).
>
> Thanks, things work well for me, again :-)

Maybe the freed variable is still usable for you, :-)

Actually I can reproduce the issue every time by just runing following
command in VM:

sudo modprobe loop; sleep 1; sudo rmmod loop

Thanks,
Ming

>
> Best regards,
>
> Stefan
> --
> Stefan Seyfried
> Linux Consultant & Developer -- GPG Key: 0x731B665B
>
> B1 Systems GmbH
> Osterfeldstraße 7 / 85088 Vohburg / http://www.b1-systems.de
> GF: Ralph Dehner / Unternehmenssitz: Vohburg / AG: Ingolstadt,HRB 3537



--
Ming Lei