Message-Id: <200005100601.QAA72713@clouds.melbourne.sgi.com>
To:     linux-xfs@oss.sgi.com
Subject: race in unmount code.
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date:   Wed, 10 May 2000 16:01:29 +1000
From:   Daniel Moore <dxm@clouds.melbourne.sgi.com>
Sender: owner-linux-xfs@oss.sgi.com
Precedence: bulk


I finally found a way of tickling an problem I've been seeing
every-so-often during my testing:

   yes cat /proc/mounts | tcsh & mount /dev/hda6 /mnt/arch0 -t xfs ; 
       umount /dev/hda6 ; kill %

    (one line - ie cat /proc/mounts repeatedly in the background whilst
     unmounting)

try it a couple of times until you get a NULL pointer dereference
in d_path.

I'm pretty sure the problem is because d_umount (called from do_umount in 
super.c) sets s_root to NULL then does other stuff which causes the
kernel to sleep and allows entry to get_filesystem_info from a
syscall while the superblock is in a screwy state.

After that, I'm lost - it does seem to be XFS specific.

(yes it's a contrived example, but it demonstrates a bug I've been
seeing in more or less normal operation)

Any ideas people? I've got to get back to testing.

-----------------------------------------------------
 Daniel Moore                  dxm@sgi.com
 R&D Software Engineer         Phone: +61-3-98348209
 SGI Performance Tools Group   Fax:   +61-3-98132378
-----------------------------------------------------