zfsonlinux/zfs — Issue #470: dbuf_destroy() NULL dereference
Author: behlendorf
Created: 2011-11-28 19:54:52+00:00
State: open
Labels: Bug

I just got one of those on a amd64 12 core,16GiB ECC memory, arc limited to 1GiB, one root zpool with dedup and compression on a USB stick and one raidz zpool on 6 2TB drives. At the time of the crash, had an nbd-server serving a 16GiB zvol with volblocksize = 4k and refreservation = 0 on the raidz zpool, the remote nbd client is hanging writing 512 bytes worth of data.

Had to hard-reset the machine as any disk i/o hangs even on the root zpool.

ubuntu 11.10, 0.6.0.39-0ubuntu1~oneiric1 from daily ppa, 3.1.2
kernel from kernel-ppa.

[177472.785034] BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
[177472.788002] IP: [] dbuf_destroy+0x104/0x170 [zfs]
[177472.788002] PGD 1fa199067 PUD 1937e0067 PMD 0
[177472.788002] Oops: 0000 [#1] SMP
[177472.788002] CPU 4
[177472.788002] Modules linked in: kvm_amd kvm psmouse serio_raw sp5100_tco hed k10temp i2c_piix4 joydev acpi_power_meter dcdbas amd64_edac_mod edac_core edac_mce_amd tpm_tis zfs(P) zcommon(P) znvpair(P) zavl(P) zunicode(P) spl zlib_deflate usbhid hid raid10 raid456 async_pq async_xor xor async_memcpy async_raid6_recov usb_storage uas mpt2sas raid6_pq scsi_transport_sas async_tx raid_class bnx2 raid1 raid0 multipath linear
[177472.788002]
[177472.788002] Pid: 505, comm: arc_reclaim Tainted: P 3.1.2-030102-generic #201111211835 Dell Inc. PowerEdge R515/03X0MN
[177472.788002] RIP: 0010:[] [] dbuf_destroy+0x104/0x170 [zfs]
[177472.788002] RSP: 0018:ffff8802096c7e00 EFLAGS: 00010286
[177472.788002] RAX: 0000000000000000 RBX: ffff8801b7cc5000 RCX: 000000000002001f
[177472.788002] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa02922f0
[177472.788002] RBP: ffff8802096c7e20 R08: 0059936d963e3c04 R09: f4745afb4593bd9c
[177472.788002] R10: ffff8802096ce488 R11: ffff8801ee2147f8 R12: 0000000000000038
[177472.788002] R13: ffffffffa02922f0 R14: ffffffffa0112ea0 R15: 0000000000000000
[177472.788002] FS: 00007fd2c0726720(0000) GS:ffff880217a60000(0000) knlGS:0000000000000000
[177472.788002] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[177472.788002] CR2: 0000000000000038 CR3: 000000014b25d000 CR4: 00000000000006e0
[177472.788002] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[177472.788002] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[177472.788002] Process arc_reclaim (pid: 505, threadinfo ffff8802096c6000, task ffff88020f6716f0)
[177472.788002] Stack:
[177472.788002] ffff8801b7cc5000 ffff8801b7cc5000 ffff880204b9c180 0000000000000000
[177472.788002] ffff8802096c7e40 ffffffffa01d4dee ffff8801b7cc5000 ffff8801b7cc5000
[177472.788002] ffff8802096c7e60 ffffffffa01d4e43 ffff880204b9c170 ffff880204b9c170
[177472.788002] Call Trace:
[177472.788002] [] dbuf_evict+0x1e/0x30 [zfs]
[177472.788002] [] dbuf_do_evict+0x43/0x70 [zfs]
[177472.788002] [] arc_do_user_evicts+0x50/0xd0 [zfs]
[177472.788002] [] arc_reclaim_thread+0xa6/0x150 [zfs]
[177472.788002] [] ? arc_shrinker_func+0xd0/0xd0 [zfs]
[177472.788002] [] thread_generic_wrapper+0x78/0x90 [spl]
[177472.788002] [] ? __thread_create+0x160/0x160 [spl]
[177472.788002] [] kthread+0x96/0xa0
[177472.788002] [] kernel_thread_helper+0x4/0x10
[177472.788002] [] ? kthread_worker_fn+0x190/0x190
[177472.788002] [] ? gs_change+0x13/0x13
[177472.788002] Code: 49 c1 e5 05 49 81 c5 b0 22 29 a0 4c 89 ef e8 c4 ab 42 e1 48 8b 05 15 f7 0b 00 4e 8d 24 e0 49 8b 04 24 48 39 c3 74 0d 4c 8d 60 38
[177472.788002] 8b 40 38 48 39 c3 75 f3 48 8b 43 38 4c 89 ef 49 89 04 24 48
[177472.788002] RIP [] dbuf_destroy+0x104/0x170 [zfs]
[177472.788002] RSP
[177472.788002] CR2: 0000000000000038
[177473.086068] ---[ end trace 4563c75500319972 ]---