Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <7bc6b466-9b9a-b857-8f72-2dce99b18939@gmx.de>
Date:   Sun, 17 Jul 2022 11:42:48 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.11.0
Subject: Re: WARNING: CPU: 1 PID: 14735 at fs/dcache.c:365
 dentry_free+0x100/0x128
Content-Language: en-US
From:   Helge Deller <deller@gmx.de>
To:     Hillf Danton <hdanton@sina.com>
Cc:     linux-kernel@vger.kernel.org, linux-parisc@vger.kernel.org
References: <20220709090756.2384-1-hdanton@sina.com>
 <20220715133300.1297-1-hdanton@sina.com>
 <cff76e00-3561-4069-f5c7-26d3de4da3c4@gmx.de>
In-Reply-To: <cff76e00-3561-4069-f5c7-26d3de4da3c4@gmx.de>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi Hillf,

On 7/16/22 07:27, Helge Deller wrote:
> On 7/15/22 15:33, Hillf Danton wrote:
>> On Fri, 15 Jul 2022 10:18:23 +0200 Helge Deller  wrote:
> and this was the output:
>
> [108563.953441]  IAOQ[1]: dentry_free+0xc4/0x338
> [108564.005441]  RP(r2): __dentry_kill+0x284/0x2e8
> [108564.057443] Backtrace:
> [108564.089454]  [<000000004073bab0>] __dentry_kill+0x284/0x2e8
> [108564.157445]  [<000000004073d2f8>] dput+0x334/0x5a8
> [108564.213444]  [<00000000407267a4>] step_into+0x790/0xa88
> [108564.277444]  [<0000000040727084>] walk_component+0xa8/0x330
> [108564.345443]  [<00000000407275f8>] link_path_walk.part.0.constprop.0+=
0x2ec/0x4d0
> [108564.437443]  [<0000000040728254>] path_openat+0x150/0x1ba8
> [108564.501441]  [<000000004072ba28>] do_filp_open+0x9c/0x198
> [108564.569441]  [<0000000040701d20>] do_sys_openat2+0x14c/0x2a8
> [108564.637441]  [<0000000040702654>] compat_sys_openat+0x58/0xb8
> [108564.705440]  [<0000000040303e30>] syscall_exit+0x0/0x10
> [108564.769444]
> [108564.789435] ---[ end trace 0000000000000000 ]---
> [108564.845444] dentry =3D 000000031624e6c0
> [108564.889437] spin_is_locked(&dentry->d_lock) =3D 0
> [108564.945436] dname_external(dentry) =3D 0
> [108564.993436] dentry->d_flags & DCACHE_NORCU =3D 0
> [108565.045446] dentry->d_name.len =3D 3
> [108565.089435] dentry->d_name.hash =3D 89116695
> [108565.137435] dentry->d_lockref.count =3D -128
> [108565.189434] dentry->d_flags =3D 32776
> [108565.233435] dentry->d_inode =3D 0000000000000000
> [108565.285429] dentry->d_parent =3D 000000022ef756c0
> [108565.341434] dentry->d_u.d_rcu =3D 0x416be770
>
>> Add debug info to the diff below. Cut the first BUG_ON off if it>> trig=
gers and see if the second one can be hit.

I used WARN_ON() instead of BUG_ON().
With that, both triggered, first the first one, then the second one.
Full log is here:
http://dellerweb.de/testcases/minicom.dcache.crash.6-warn

Helge

>> +++ y/fs/dcache.>> @@ -605,8 +605,10 @@ static void __dentry_kill(struc=
t dentry
>>  		spin_unlock(&parent->d_lock);
>>  	if (dentry->d_inode)
>>  		dentry_unlink_inode(dentry);
>> -	else
>> +	else {
>> +		BUG_ON(!hlist_unhashed(&dentry->d_u.d_alias));
>>  		spin_unlock(&dentry->d_lock);
>> +	}
>>  	this_cpu_dec(nr_dentry);
>>  	if (dentry->d_op && dentry->d_op->d_release)
>>  		dentry->d_op->d_release(dentry);
>> @@ -616,6 +618,7 @@ static void __dentry_kill(struct dentry
>>  		dentry->d_flags |=3D DCACHE_MAY_FREE;
>>  		can_free =3D false;
>>  	}
>> +	BUG_ON(!hlist_unhashed(&dentry->d_u.d_alias));
>>  	spin_unlock(&dentry->d_lock);
>>  	if (likely(can_free))
>>  		dentry_free(dentry);