zfsonlinux/zfs — Issue #456: nfs_lookup_revalidate() NULL deref
Author: behlendorf
Created: 2011-11-21 19:02:53+00:00
State: open
Labels: Bug

Reported by Chris Dunlop

Just trying zfsonlinux for the first time, and I'm getting the kernel oops below when doing "zpool create" when using nfs-root. There's no oops with "zpool create" on the same kernel when using local root.

This is with Linux 3.1.1, spl/zfs current git (spl: 1114ae6a zfs: ca5fd249)

SPL: Loaded module v0.6.0, using hostid 0xc80a843f
zunicode: module license 'CDDL' taints kernel.
Disabling lock debugging due to kernel taint
ZFS: Loaded module v0.6.0, ZFS pool version 28, ZFS filesystem version 5
BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
IP: [] nfs_lookup_revalidate+0x1c/0x3f4 [nfs]
PGD 212e067 PUD 9f487067 PMD 0
Oops: 0000 [#1] SMP
CPU 0

Pid: 3334, comm: zpool Tainted: P 3.1.1-otn-00008-gd50247e #2 System manufacturer System Product Na me/M4A88TD-M
RIP: e030:[] [] nfs_lookup_revalidate+0x1c/0x3f4 [nfs]
RSP: e02b:ffff8800b7a41a58 EFLAGS: 00010292
RAX: 00000000fffffff6 RBX: ffff8800a33c2cc0 RCX: 0000000000000070
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8800a33c2cc0
RBP: ffff8800b7a41a98 R08: 000000000000000f R09: ffff8800a33c2d06
R10: 000000000e8ca8a5 R11: ffff8800b78cfcd0 R12: ffff8800a1010cc0
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 00007f6f419bec00(0000) GS:ffff8800bb727000(0000) knlGS:0000000000000000
CS: e033 DS: 0000 ES: 0000 CR0: 000000008005003b [ 1042.779009] CR2: 0000000000000038 CR3: 00000000023e1000 CR4: 0000000000000660
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process zpool (pid: 3334, threadinfo ffff8800b7a40000, task ffff8800a47f2780)
Stack:
ffff8800b7a41ae8 0000000000000000 ffff8800b7a41a98 ffff8800a33c2cc0
ffff8800a1010cc0 0000000000000000 ffff8800b7a41ae8 0000000000000000
ffff8800b7a41ad8 ffffffff811077d0 ffff8800b7ba09a0 ffff8800a1010cc0
Call Trace:
[] __lookup_hash+0x7e/0xc9
[] lookup_one_len+0xb8/0xcc
[] vn_rename+0xac/0x1e0 [spl]
[] ? bit_waitqueue+0x16/0xa4
[] ? wake_up_bit+0x20/0x25
[] ? nfs_commit_clear_lock+0x20/0x22 [nfs]
[] ? nfs_commit_inode+0x18f/0x1b2 [nfs]
[] ? nfs_file_fsync+0xd4/0xe6 [nfs]
[] spa_config_sync+0x32e/0x44f [zfs]
[] spa_create+0x6be/0x72f [zfs]
[] ? kmem_alloc_debug+0x92/0xd1 [spl]
[] zfs_ioc_pool_create+0x1c2/0x22f [zfs]
[] zfsdev_ioctl+0x11b/0x176 [zfs]
[] ? xen_force_evtchn_callback+0xd/0xf
[] do_vfs_ioctl+0x3ed/0x43c
[] ? xen_restore_fl_direct_reloc+0x4/0x4
[] ? xen_clts+0xfc/0x107
[] sys_ioctl+0x42/0x65
[] system_call_fastpath+0x16/0x1b
RIP [] nfs_lookup_revalidate+0x1c/0x3f4 [nfs]
RSP
CR2: 0000000000000038