Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756440AbYHCM0B (ORCPT ); Sun, 3 Aug 2008 08:26:01 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753955AbYHCMZx (ORCPT ); Sun, 3 Aug 2008 08:25:53 -0400 Received: from jenny.ondioline.org ([66.220.1.122]:54944 "EHLO jenny.ondioline.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753855AbYHCMZw (ORCPT ); Sun, 3 Aug 2008 08:25:52 -0400 From: Paul Collins To: Neil Brown Cc: "J. Bruce Fields" , linuxppc-dev@ozlabs.org, nfsv4@linux-nfs.org, linux-kernel@vger.kernel.org Subject: Re: nfsd, v4: oops in find_acceptable_alias, ppc32 Linux, post-2.6.27-rc1 References: <87tze38vzt.fsf@burly.wgtn.ondioline.org> <20080802184554.GB715@fieldses.org> <87abfvm4cc.fsf@burly.wgtn.ondioline.org> <877iayy4qc.fsf@burly.wgtn.ondioline.org> <18581.40960.737792.454035@notabene.brown> Date: Mon, 04 Aug 2008 00:25:51 +1200 In-Reply-To: <18581.40960.737792.454035@notabene.brown> (Neil Brown's message of "Sun, 3 Aug 2008 22:09:36 +1000") Message-ID: <87r696l1yo.fsf@burly.wgtn.ondioline.org> User-Agent: Gnus/5.110011 (No Gnus v0.11) Emacs/23.0.60 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 9981 Lines: 184 Neil Brown writes: > On Sunday August 3, paul@burly.ondioline.org wrote: >> >> I can trigger it reliably with a 2.6.26 client. I've also triggered it >> with 496d6c32d4d057cb44272d9bd587ff97d023ee92 reverted on the server. >> >> It's harder to trigger with 2.6.27-rc1+ but I managed to get an Oops >> on the fourth build after three successful builds on the NFS4 mount. >> >> One of the Oopses I got with 2.6.26 had a slightly different call trace: >> >> Unable to handle kernel paging request for instruction fetch >> Faulting instruction address: 0x00000000 > > So we have called a function pointer which was NULL. > > There a lots of function pointers in use in this code. > There is the 'acceptable' function. There is ->fh_to_dentry > and ->fh_to_parent. And various inode operations line ->lookup, but > that is a bit further away. > >> NIP [00000000] 0x0 >> LR [c0159bb0] exportfs_decode_fh+0xa8/0x200 > > I guess this is where the call came from. > exportfs_decode_fh is never passed NULL for 'acceptable'. Only > ever 'nfsd_acceptable'. > ->fh_to_parent is tested for NULL before being called, and > ->fh_to_dentry is called very early in exportfs_decode_fh, where as > the bad call is 0xa8 in to the function. > > Is it possible that ->fh_to_parent is being changed immediately after > being tested for NULL and before being dereferenced. That seems > unlikely. > > What filesystem is being exported here? Boring old ext3 (on LVM, on dm-crypt). > Can you get an assembly version of exportfs_decode_fh, so we can check > what is happening at 0xa8 (and 0x4c). Dump of assembler code for function exportfs_decode_fh: 0xc015b7cc : mflr r0 0xc015b7d0 : stw r0,4(r1) 0xc015b7d4 : bl 0xc0013154 <_mcount> 0xc015b7d8 : stwu r1,-304(r1) 0xc015b7dc : mflr r0 0xc015b7e0 : stmw r22,264(r1) 0xc015b7e4 : mr r27,r3 0xc015b7e8 : mr r31,r1 0xc015b7ec : stw r0,308(r1) 0xc015b7f0 : mr r25,r7 0xc015b7f4 : mr r26,r8 0xc015b7f8 : mr r29,r4 0xc015b7fc : mr r24,r5 0xc015b800 : mr r23,r6 0xc015b804 : lwz r3,20(r3) 0xc015b808 : lwz r30,48(r3) 0xc015b80c : lwz r0,4(r30) 0xc015b810 : mtctr r0 0xc015b814 : bctrl 0xc015b818 : mr. r28,r3 0xc015b81c : bne+ 0xc015b824 0xc015b820 : li r28,-116 0xc015b824 : li r22,-4096 0xc015b828 : cmplw cr7,r28,r22 0xc015b82c : bgt- cr7,0xc015b9b0 0xc015b830 : lwz r9,8(r28) 0xc015b834 : lhz r0,114(r9) 0xc015b838 : rlwinm r0,r0,0,16,19 0xc015b83c : cmpwi cr7,r0,16384 0xc015b840 : bne- cr7,0xc015b880 0xc015b844 : lwz r0,4(r28) 0xc015b848 : andi. r9,r0,4 0xc015b84c : beq- 0xc015b864 0xc015b850 : mr r3,r27 0xc015b854 : mr r4,r28 0xc015b858 : bl 0xc015b45c 0xc015b85c : mr. r30,r3 0xc015b860 : bne- 0xc015b9a4 0xc015b864 : mr r3,r26 0xc015b868 : mr r4,r28 0xc015b86c : mtctr r25 0xc015b870 : bctrl 0xc015b874 : cmpwi cr7,r3,0 0xc015b878 : beq+ cr7,0xc015b998 0xc015b87c : b 0xc015b9b0 0xc015b880 : mr r3,r28 0xc015b884 : mr r4,r25 0xc015b888 : mr r5,r26 0xc015b88c : bl 0xc015b6c4 0xc015b890 : cmpwi r3,0 0xc015b894 : bne+ 0xc015b990 0xc015b898 : lwz r0,8(r30) 0xc015b89c : cmpwi cr7,r0,0 0xc015b8a0 : beq- cr7,0xc015b9a0 0xc015b8a4 : mr r4,r29 0xc015b8a8 : mr r5,r24 0xc015b8ac : lwz r3,20(r27) 0xc015b8b0 : mtctr r0 0xc015b8b4 : mr r6,r23 0xc015b8b8 : bctrl 0xc015b8bc : mr. r29,r3 0xc015b8c0 : beq- 0xc015b9a0 0xc015b8c4 : cmplw cr7,r29,r22 0xc015b8c8 : mr r30,r29 0xc015b8cc : bgt- cr7,0xc015b9a4 0xc015b8d0 : mr r3,r27 0xc015b8d4 : mr r4,r29 0xc015b8d8 : bl 0xc015b45c 0xc015b8dc : mr. r30,r3 0xc015b8e0 : beq- 0xc015b8f0 0xc015b8e4 : mr r3,r29 0xc015b8e8 : bl 0xc00befb0 0xc015b8ec : b 0xc015b9a4 0xc015b8f0 : addi r30,r31,8 0xc015b8f4 : mr r3,r27 0xc015b8f8 : mr r4,r29 0xc015b8fc : mr r5,r30 0xc015b900 : mr r6,r28 0xc015b904 : bl 0xc015b2cc 0xc015b908 : cmpwi cr7,r3,0 0xc015b90c : bne+ cr7,0xc015b970 0xc015b910 : lwz r3,8(r29) 0xc015b914 : addi r3,r3,116 0xc015b918 : bl 0xc0421bb0 0xc015b91c : mr r3,r30 0xc015b920 : bl 0xc00188fc 0xc015b924 : mr r4,r29 0xc015b928 : mr r5,r3 0xc015b92c : mr r3,r30 0xc015b930 : bl 0xc00b4e44 0xc015b934 : mr r30,r3 0xc015b938 : lwz r3,8(r29) 0xc015b93c : addi r3,r3,116 0xc015b940 : bl 0xc04219a8 0xc015b944 : cmplw cr7,r30,r22 0xc015b948 : bgt- cr7,0xc015b970 0xc015b94c : lwz r0,8(r30) 0xc015b950 : cmpwi cr7,r0,0 0xc015b954 : beq- cr7,0xc015b968 0xc015b958 : mr r3,r28 0xc015b95c : mr r28,r30 0xc015b960 : bl 0xc00befb0 0xc015b964 : b 0xc015b970 0xc015b968 : mr r3,r30 0xc015b96c : bl 0xc00befb0 0xc015b970 : mr r3,r29 0xc015b974 : bl 0xc00befb0 0xc015b978 : mr r3,r28 0xc015b97c : mr r4,r25 0xc015b980 : mr r5,r26 0xc015b984 : bl 0xc015b6c4 0xc015b988 : cmpwi r3,0 0xc015b98c : beq- 0xc015b998 0xc015b990 : mr r28,r3 0xc015b994 : b 0xc015b9b0 0xc015b998 : li r30,-13 0xc015b99c : b 0xc015b9a4 0xc015b9a0 : li r30,-116 0xc015b9a4 : mr r3,r28 0xc015b9a8 : mr r28,r30 0xc015b9ac : bl 0xc00befb0 0xc015b9b0 : lwz r11,0(r1) 0xc015b9b4 : mr r3,r28 0xc015b9b8 : lwz r0,4(r11) 0xc015b9bc : lmw r22,-40(r11) 0xc015b9c0 : mr r1,r11 0xc015b9c4 : mtlr r0 0xc015b9c8 : blr End of assembler dump. -- Paul Collins Wellington, New Zealand Dag vijandelijk luchtschip de huismeester is dood -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/