Menu
▾
▴
#6 OHSM crashes: [23097.964023] IP: [<f98ed20e>] ohsm_free_inst
Hi all,
OHSM crashes in case we try to remove the module, and in the mean while the file system is unmounted.
[23097.964007] BUG: unable to handle kernel NULL pointer dereference at 00000238
[23097.964023] IP: [<f98ed20e>] ohsm_free_instance+0x2e/0x130 [ohsm]
[23097.964043] *pde = 00000000
[23097.964052] Oops: 0002 [#1] SMP
[23097.964064] last sysfs file: /sys/devices/pci0000:00/0000:00:1c.1/0000:03:00.0/ieee80211/phy0/rfkill2/state
[23097.964076] Modules linked in: ohsm(-) ext4 jbd2 crc16 nls_cp437 cifs af_packet ppdev rfcomm bridge stp bnep sco l2cap ipv6 pci_slot sbs sbshc container binfmt_misc autofs4 sbp2 lp parport snd_hda_codec_analog snd_hda_intel snd_hda_codec snd_pcm_oss snd_mixer_oss snd_pcm arc4 snd_seq_dummy ecb joydev snd_seq_oss snd_seq_midi snd_rawmidi iwlagn snd_seq_midi_event iwlcore snd_seq pcmcia snd_timer snd_seq_device mac80211 snd soundcore btusb yenta_socket cfg80211 bluetooth psmouse thinkpad_acpi led_class iTCO_wdt iTCO_vendor_support snd_page_alloc rsrc_nonstatic pcmcia_core intel_agp agpgart rfkill pcspkr serio_raw nvram wmi evdev video output ac battery button processor usbhid hid ext3 jbd mbcache sr_mod cdrom sg ata_generic pata_acpi ohci1394 ieee1394 ehci_hcd ata_piix uhci_hcd usbcore e1000e linear thermal fan fuse
[23097.964310]
[23097.964321] Pid: 31599, comm: rmmod Not tainted (2.6.31-rc7 #2) 7665AD6
[23097.964330] EIP: 0060:[<f98ed20e>] EFLAGS: 00210246 CPU: 1
[23097.964343] EIP is at ohsm_free_instance+0x2e/0x130 [ohsm]
[23097.964352] EAX: 00000000 EBX: ef9b9600 ECX: 00200046 EDX: 051a3000
[23097.964361] ESI: ef9baa00 EDI: ef9b9600 EBP: f39e3f24 ESP: f39e3f08
[23097.964370] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[23097.964380] Process rmmod (pid: 31599, ti=f39e2000 task=f4174b60 task.ti=f39e2000)
[23097.964387] Stack:
[23097.964392] f98f0125 ef9b9624 f98f03a8 000000a8 f98eff43 f98f158c f98f158c f39e3f4c
[23097.964414] <0> f98ee2b1 00000000 f98f12e0 c08c7538 f39e3f4c c01c2f27 00000000 f98f12e0
[23097.964437] <0> 00000000 f39e3fac c01c3fd0 6d73686f c027d800 f3906c60 f3906c60 f39e3f98
[23097.964462] Call Trace:
[23097.964480] [<f98ee2b1>] ? ohsm_cleanup+0x81/0x150 [ohsm]
[23097.964498] [<c01c2f27>] ? module_refcount+0x37/0x90
[23097.964512] [<c01c3fd0>] ? sys_delete_module+0x2b0/0x470
[23097.964525] [<c027d800>] ? remove_vma+0x40/0xe0
[23097.964537] [<c0280222>] ? do_munmap+0x3d2/0x520
[23097.964550] [<c0104bdc>] ? sysenter_do_call+0x12/0x28
[23097.964558] Code: 56 53 89 c3 83 ec 14 83 05 00 16 8f f9 01 83 15 04 16 8f f9 00 f6 05 40 14 8f f9 04 8b 70 18 0f 85 8a 00 00 00 8b 86 98 01 00 00 <c7> 80 38 02 00 00 00 00 00 00 8b 43 10 e8 c0 11 9b c6 83 05 20
[23097.964687] EIP: [<f98ed20e>] ohsm_free_instance+0x2e/0x130 [ohsm] SS:ESP 0068:f39e3f08
[23097.964706] CR2: 0000000000000238
[23097.964717] ---[ end trace eb2d0047c470adc4 ]---
The implementation for ohsm_ext4_umount() is biting us now and we need it as early as possible to avoid such issues.
Manish can you please look into the same.
Related
Ok... I will have a look. Do I need to pull any of your patches to reproduce this ?? Or whatever is there in git that is sufficient ?
Yes, you would need the latest patches. But I am sure that even without those you should be able to reproduce this.
The reason is that during umount we do not remove the instance and hence when we try to disable it later, it dereferences the dangling pointers to super block.
This issue is resolved now. Manish you may want to close this?
Fixed with ext4 unmount callouts.