From: Frank Filz <ffilzlnx@us.ibm.com>
Subject: Crash in dec_zone_page_state when nfs_page req is freed
Date: Mon, 18 Sep 2006 16:55:36 -0700
Message-ID: <1158623736.3376.8.camel@dyn9047022153>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: NFS List <nfs@lists.sourceforge.net>
Sender: nfs-bounces@lists.sourceforge.net
Errors-To: nfs-bounces@lists.sourceforge.net

I am seeing a crash in dec_zone_page_state when called from 

static void nfs_cancel_commit_list(struct list_head *head)
{
	struct nfs_page *req;

	while(!list_empty(head)) {
		req = nfs_list_entry(head->next);
		nfs_list_remove_request(req);
		nfs_inode_remove_request(req);
		nfs_clear_page_writeback(req);
		dec_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);
	}
}

I see this was somewhat recently added. It appears that
nfs_clear_page_writeback has resulted in the req being freed. We are
running with CONFIG_SLAB_DEBUG on which poisons memory with repeated
0x6b bytes when freed so the subsequent reference to req results in a
bad wb_page pointer.

Is it the expectation that the request will be freed here? If so, should
the dec_zone_page_state call be re-ordered, the wb_page pointer saved
before calling nfs_clear_page_writeback, or wb_count being incremented
and then adding a call to nfs_release_request?

Frank Filz


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs