bomb and force shutdown

[ASANO Masahiro <masano@xxxxxxxxxxxxxx>]

Hi,

I made a simple "bomb" function which generated SCSI disk error
periodically.

When I carried out "cvs checkout linux-2.4-xfs" on xfs using this
bomb, "Scheduling in interrupt" occurred. The kernel back trace was
the same as the reported previously on this list.
    Date: 30 Oct 2001 16:09:13 -0500
    Subject: Kernel OOPS 2.4.5-XFS-1.0.1 w/Feral FC drivers
    Message-Id: <1004476153.21484.32.camel@xxxxxxxxxxxxxxxxxxxxxx>

So I removed xfs_incore_relse() from _xfs_force_shutdown() function
in linux/fs/xfs/xfs_rw.c according to the mail:
    Date: 30 Oct 2001 15:23:05 -0600
    Subject: Re: Kernel OOPS 2.4.5-XFS-1.0.1 w/Feral FC drivers
    Message-Id: <1004476985.28795.46.camel@xxxxxxxxxxxxxxxxxxxx>
Then the "Scheduling in interrupt" went away. But I got another
problem. After filesystem shutting down by the bomb, the super-block
(and/or AGF,AGI) was overwritten by file data.

Does anyone know the cause of these problems?
Any help or suggestions would be appreciated.

The bomb patch for linux-2.4-xfs is here.

8<----8<----8<----8<----8<----8<----8<----
--- linux/drivers/scsi/sd.c.orig        Sun Jan 13 20:00:21 2002
+++ linux/drivers/scsi/sd.c     Thu Jan 13 20:00:21 2002
@@ -77,6 +77,10 @@
 
 #define MAX_RETRIES 5
 
+kdev_t bomb_dev;                       /*BOMB*/ /* Patch me to test dev# */
+unsigned int bomb_count;               /*BOMB*/
+unsigned int bomb_limit = 0x3ff;       /*BOMB*/
+
 /*
  *  Time out in seconds for disks and Magneto-opticals (which are slower).
  */
@@ -654,6 +658,14 @@
                                    SCpnt->cmnd[0] == WRITE_10)
                                        SCpnt->device->ten = 0;
                        }
+               }
+       } else {                                        /*BOMB*/
+               struct buffer_head *bh = SCpnt->request.bh;
+               if (bh && bh->b_dev == bomb_dev && (++bomb_count & bomb_limit) 
== 0) {
+                       SCpnt->result = result = DRIVER_SOFT << 24;
+                       SCpnt->sense_buffer[2] = MEDIUM_ERROR;
+                       good_sectors = 0;
+                       printk("bomb: blocknr=%x size=%x state=%lx 
reqnext=%p\n", bh->b_blocknr, bh->b_size, bh->b_state, bh->b_reqnext);
                }
        }
        /*
8<----8<----8<----8<----8<----8<----8<----

--
Masano