Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S261830AbUD3WeE (ORCPT ); Fri, 30 Apr 2004 18:34:04 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S261822AbUD3WeD (ORCPT ); Fri, 30 Apr 2004 18:34:03 -0400 Received: from smtp3.Stanford.EDU ([171.67.16.138]:2283 "EHLO smtp3.Stanford.EDU") by vger.kernel.org with ESMTP id S261798AbUD3Wdz (ORCPT ); Fri, 30 Apr 2004 18:33:55 -0400 Date: Fri, 30 Apr 2004 15:33:19 -0700 (PDT) From: Junfeng Yang To: Dave Kleikamp , Linux Kernel Mailing List , , , Madanlal S Musuvathi , "David L. Dill" Subject: [CHECKER] Double txEnd calls causing the kernel to panic (JFS 2.4, kernel 2.4.19) Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1062 Lines: 41 The common pattern in JFS is to call txCommit then call txEnd to end a transction. But if diWrite in txCommit fails (it fails when read_cache_page fails to get a page), txAbortCommit will be called. txAbortCommit will subsequently call txEnd and set tblk->next to txAnchor.freetid. Later on, when the second txEnd gets called on the same tid, the assertion assert(tblk->next) in txEnd will always fail. void txEnd(tid_t tid) { struct tblock *tblk = tid_to_tblock(tid); ... Assert == 0 --> assert(tblk->next == 0); /* * insert tblock back on freelist */ Set to non zero --> tblk->next = TxAnchor.freetid; TxAnchor.freetid = tid; ... } here is an example: int jfs_mkdir(struct inode *dip, struct dentry *dentry, int mode) { ... rc = txCommit(tid, 2, &iplist[0], 0); out3: txEnd(tid); ... } - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/