From: Jan Kara <jack@suse.cz>
Subject: Re: BUG: unable to handle kernel NULL pointer dereference at
 0000000000000006
Date: Wed, 4 Jul 2012 12:44:18 +0200
Message-ID: <20120704104418.GH27388@quack.suse.cz>
References: <4FF41CC2.70706@cn.fujitsu.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: ext4 <linux-ext4@vger.kernel.org>, Jan Kara <jack@suse.cz>
To: Liu Bo <liubo2009@cn.fujitsu.com>
Return-path: <linux-ext4-owner@vger.kernel.org>
Received: from cantor2.suse.de ([195.135.220.15]:56617 "EHLO mx2.suse.de"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S933859Ab2GDKoU (ORCPT <rfc822;linux-ext4@vger.kernel.org>);
	Wed, 4 Jul 2012 06:44:20 -0400
Content-Disposition: inline
In-Reply-To: <4FF41CC2.70706@cn.fujitsu.com>
Sender: linux-ext4-owner@vger.kernel.org
List-ID: <linux-ext4.vger.kernel.org>

On Wed 04-07-12 18:36:50, Liu Bo wrote:
> I happen to hit this [1] while testing btrfs's latest upstream, which is based on 3.4.0.
> 
> And I'm not sure if this has been fixed, so I post a bug report here.
  This is actually a secondary oops (as suggested both by taint D flag and
kernel stack). So ext4/jbd2 is innocent here, the bug is in btrfs which
appears to oops in run_delalloc_nocow(). So just report the first oops you
have in the log to btrfs developers. Thanks.

								Honza
> 
> thanks,
> liubo
> 
> ===
> [1]:
> 
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000006
> IP: [<ffffffffa013348a>] jbd2__journal_start+0x4a/0x100 [jbd2]
> PGD 0 
> Oops: 0000 [#2] SMP 
> CPU 1 
> Modules linked in: btrfs(O) zlib_deflate libcrc32c iptable_filter ip_tables ebtable_nat ebtables 
> ipt_REJECT bridge stp llc autofs4 cpufreq_ondemand acpi_cpufreq freq_table mperf be2iscsi iscsi_b
> oot_sysfs bnx2i cnic uio cxgb3i libcxgbi cxgb3 mdio ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_c
> ore ib_addr iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ext3 jbd dm_mirror dm_region_has
> h dm_log dm_mod ppdev sg coretemp hwmon i2c_i801 serio_raw iTCO_wdt iTCO_vendor_support parport_p
> c parport pcspkr sky2 ext4 mbcache jbd2 sd_mod crc_t10dif pata_acpi ata_generic ata_piix i915 drm
> _kms_helper drm i2c_algo_bit i2c_core video [last unloaded: btrfs]
> 
> Pid: 4147, comm: fio Tainted: G      D    O 3.4.0+ #21 LENOVO QiTianM7150/To be filled by O.E.M.
> RIP: 0010:[<ffffffffa013348a>]  [<ffffffffa013348a>] jbd2__journal_start+0x4a/0x100 [jbd2]
> RSP: 0018:ffff88003434cff8  EFLAGS: 00010286
> RAX: 0000000000000006 RBX: ffff880077ab3190 RCX: 0000000000000003
> RDX: 0000000000000050 RSI: 0000000000000024 RDI: ffff88007540c800
> RBP: ffff88003434d028 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000014 R12: ffff88007540c800
> R13: ffff880037424a90 R14: 0000000000000024 R15: ffff880079156920
> FS:  0000000000000000(0000) GS:ffff88007da80000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> CR2: 0000000000000006 CR3: 0000000001a0b000 CR4: 00000000000407e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> Process fio (pid: 4147, threadinfo ffff88003434c000, task ffff880037424a90)
> Stack:
>  ffffea0001252038 ffffea00013202f8 ffff88007540c800 ffff88007626b800
>  0000000000000024 ffffffffa0161d2c ffff88003434d038 ffffffffa0133553
>  ffff88003434d0a8 ffffffffa0178f43 0000000000000002 000000020000001f
> Call Trace:
>  [<ffffffffa05352fc>] ? free_extent_buffer+0x3c/0xa0 [btrfs]
>  [<ffffffffa0161d2c>] ? ext4_evict_inode+0x12c/0x440 [ext4]
>  [<ffffffffa0133553>] jbd2_journal_start+0x13/0x20 [jbd2]
>  [<ffffffffa0178f43>] ext4_journal_start_sb+0x83/0x1b0 [ext4]
>  [<ffffffffa0161d2c>] ext4_evict_inode+0x12c/0x440 [ext4]
>  [<ffffffff8117e13f>] evict+0x9f/0x1b0
>  [<ffffffff8117e364>] iput+0x114/0x210
>  [<ffffffff8117bad8>] d_kill+0xf8/0x110
>  [<ffffffff8117c2e2>] dput+0xe2/0x1b0
>  [<ffffffff81166978>] fput+0x1c8/0x2a0
>  [<ffffffff81162b43>] filp_close+0x63/0x90
>  [<ffffffff8105016f>] put_files_struct+0x7f/0xf0
>  [<ffffffff8105022c>] exit_files+0x4c/0x60
>  [<ffffffff81051f02>] do_exit+0x192/0x900
>  [<ffffffff81487fec>] oops_end+0xac/0xf0
>  [<ffffffff8101665b>] die+0x5b/0x90
>  [<ffffffff81487b44>] do_trap+0xc4/0x170
>  [<ffffffff810144c5>] do_invalid_op+0x95/0xb0
>  [<ffffffffa051747c>] ? cow_file_range+0x42c/0x4b0 [btrfs]
>  [<ffffffffa053736a>] ? clear_extent_bit+0x15a/0x3f0 [btrfs]
>  [<ffffffff8148ff9b>] invalid_op+0x1b/0x20
>  [<ffffffffa051747c>] ? cow_file_range+0x42c/0x4b0 [btrfs]
>  [<ffffffffa04f4199>] ? btrfs_search_slot+0x389/0x970 [btrfs]
>  [<ffffffffa051b2a3>] run_delalloc_nocow+0x363/0x880 [btrfs]
>  [<ffffffffa051bb0e>] run_delalloc_range+0x34e/0x3b0 [btrfs]
>  [<ffffffffa053919d>] __extent_writepage+0x5dd/0x770 [btrfs]
>  [<ffffffff810775ef>] ? walk_tg_tree_from+0x6f/0xd0
>  [<ffffffff81106b5f>] ? find_get_pages_tag+0xcf/0x170
>  [<ffffffffa0539812>] extent_write_cache_pages.clone.3+0x332/0x3d0 [btrfs]
>  [<ffffffffa05398f6>] extent_writepages+0x46/0x60 [btrfs]
>  [<ffffffffa051c440>] ? btrfs_mknod+0x200/0x200 [btrfs]
>  [<ffffffffa0515d77>] btrfs_writepages+0x27/0x30 [btrfs]
>  [<ffffffff81110981>] do_writepages+0x21/0x40
>  [<ffffffff81105bab>] __filemap_fdatawrite_range+0x5b/0x60
>  [<ffffffff81105e83>] filemap_fdatawrite_range+0x13/0x20
>  [<ffffffffa0532765>] btrfs_wait_ordered_range+0x45/0x120 [btrfs]
>  [<ffffffffa0555e6e>] __btrfs_write_out_cache+0x72e/0x950 [btrfs]
>  [<ffffffffa05020a4>] ? btrfs_run_delayed_refs+0x254/0x4d0 [btrfs]
>  [<ffffffffa0556202>] btrfs_write_out_cache+0xb2/0xf0 [btrfs]
>  [<ffffffffa05027d3>] btrfs_write_dirty_block_groups+0x4b3/0x580 [btrfs]
>  [<ffffffffa051169f>] commit_cowonly_roots+0x13f/0x210 [btrfs]
>  [<ffffffffa05127c8>] btrfs_commit_transaction+0x5f8/0xaa0 [btrfs]
>  [<ffffffffa0510da3>] ? btrfs_record_root_in_trans+0x63/0x80 [btrfs]
>  [<ffffffffa0513032>] ? start_transaction+0x92/0x320 [btrfs]
>  [<ffffffff8106f8d0>] ? wake_up_bit+0x40/0x40
>  [<ffffffffa05222c8>] btrfs_sync_file+0x168/0x250 [btrfs]
>  [<ffffffff8119136b>] vfs_fsync_range+0x2b/0x30
>  [<ffffffff8119138c>] vfs_fsync+0x1c/0x20
>  [<ffffffff811915ca>] do_fsync+0x3a/0x60
>  [<ffffffff81191620>] sys_fsync+0x10/0x20
>  [<ffffffff8148ee29>] system_call_fastpath+0x16/0x1b
> Code: 8b 2c 25 80 c6 00 00 48 85 ff 49 89 fc 41 89 f6 49 8b 85 d0 07 00 00 48 c7 c3 e2 ff ff ff 74 18 48 85 c0 48 89 c3 74 29 48 8b 00 <48> 3b 38 0f 85 a9 00 00 00 83 43 0c 01 48 89 d8 4c 8b 65 e8 48 
> RIP  [<ffffffffa013348a>] jbd2__journal_start+0x4a/0x100 [jbd2]
>  RSP <ffff88003434cff8>
> CR2: 0000000000000006
> ---[ end trace 30963075824b267c ]---
> Fixing recursive fault but reboot is needed!
-- 
Jan Kara <jack@suse.cz>
SUSE Labs, CR