[Top] [All Lists]

Re: possible null pointer in xlog_iodone

To: Vlad Bespalov <vlad.botanic@xxxxxxxxx>
Subject: Re: possible null pointer in xlog_iodone
From: Dave Chinner <david@xxxxxxxxxxxxx>
Date: Sat, 15 Jun 2013 11:03:13 +1000
Cc: xfs@xxxxxxxxxxx
Delivered-to: xfs@xxxxxxxxxxx
In-reply-to: <CA+aXbB5ohJkDde8qJSE0AU6B0dh59YjNPVfxVjXCOg73k7ihXQ@xxxxxxxxxxxxxx>
References: <CA+aXbB5ohJkDde8qJSE0AU6B0dh59YjNPVfxVjXCOg73k7ihXQ@xxxxxxxxxxxxxx>
User-agent: Mutt/1.5.21 (2010-09-15)
On Fri, Jun 14, 2013 at 09:15:04PM +0400, Vlad Bespalov wrote:
> i`m running an xfs filesystem over device going offline/online and
> sometimes offline may be done in parallel with unmounting
> at some point i got several crashes with null pointer panic in
> xlog_iodone: xlog_t structure taken from input buffer is null
> i wonder if the following call path combined with disk online/offline
> handling could have led to this crash:
> --------------
> xfs_unmountfs()
>     xfs_log_unmount_write(mp)
>         xlog_state_release_iclog(log)
>             xlog_sync(log, iclog = log->l_iclog)
>             (bp=iclog->ic_bp)
>                 xlog_bdstrat(bp)
>                 (iclog->ic_state != XLOG_STATE_ERROR ? )
>                     xfs_buf_iorequest(bp)
>                         xfs_buf_ioend (called with scheduling (*) )
>                         (queues  : bp->b_iodone_work,
>                          callback: xlog_iodone)

Which is followed by:

                if (!(iclog->ic_state == XLOG_STATE_ACTIVE ||
                      iclog->ic_state == XLOG_STATE_DIRTY)) {
                        if (!XLOG_FORCED_SHUTDOWN(log)) {

Which is supposed to wait for the log IO to complete and hence
xlog_iodone() is supposed to have been run by the time this code

What kernel are you tesing on? Do you have a script that reproduces


Dave Chinner

<Prev in Thread] Current Thread [Next in Thread>