Bug 1032633

Description of problem:

I tried out my reproducer for bug #1031320 on the rawhide kernel and it didn't reproduce the same, but on umount it hit a bug in a different part of the dcache code. It could be a different manifestation of the same problem but I figured it best to open a new bz for this one anyway.

Version-Release number of selected component (if applicable):

3.13.0-0.rc0.git7.1.fc21.x86_64

How reproducible:

Every time.

Steps to Reproduce:

[root@rawhide1 ~]# mkfs.gfs2 -Op lock_nolock testdev
[root@rawhide1 ~]# mount testdev /mnt/test
[root@rawhide1 ~]# mkdir /mnt/test/foo
[root@rawhide1 ~]# umount /mnt/test
[root@rawhide1 ~]# mount testdev /mnt/test
[root@rawhide1 ~]# cat boom.c
#include <dirent.h>
int main(void)
{
	DIR *dirp = opendir("/mnt/test/foo");
	closedir(dirp);
	return 0;
}
[root@rawhide1 ~]# gcc boom.c -o boom
[root@rawhide1 ~]# ./boom
[root@rawhide1 ~]# umount /mnt/test
[   48.191507] BUG: Dentry ffff8800232aea20{i=a40016,n=foo} still in use (-1) [unmount of gfs2 loop0]
[   48.192879] ------------[ cut here ]------------
[   48.193517] kernel BUG at fs/dcache.c:1387!
[   48.193811] invalid opcode: 0000 [#1] SMP 
[   48.193811] Modules linked in: gfs2 loop dlm sctp libcrc32c iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi cfg80211 rfkill microcode 8139too joydev serio_raw virtio_net 8139cp mii virtio_console virtio_balloon i2c_piix4 virtio_scsi virtio_blk qxl drm_kms_helper ttm drm virtio_pci virtio_ring virtio i2c_core ata_generic pata_acpi
[   48.193811] CPU: 0 PID: 381 Comm: umount Not tainted 3.13.0-0.rc0.git7.1.fc21.x86_64 #1
[   48.193811] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   48.193811] task: ffff88002b89b3a0 ti: ffff88002bdde000 task.ti: ffff88002bdde000
[   48.193811] RIP: 0010:[<ffffffff812111a1>]  [<ffffffff812111a1>] umount_collect+0x101/0x120
[   48.193811] RSP: 0018:ffff88002bddfd88  EFLAGS: 00010282
[   48.193811] RAX: 0000000000000056 RBX: ffff8800232aea20 RCX: 0000000000000006
[   48.193811] RDX: 00000000000024a0 RSI: ffff88002b89be58 RDI: 0000000000000246
[   48.193811] RBP: ffff88002bddfda0 R08: 0000000000000000 R09: 0000000000000000
[   48.193811] R10: 0000000000000001 R11: ffff88002bddfab6 R12: ffff88002bddfe38
[   48.193811] R13: ffff8800232aea20 R14: ffff8800232aeb30 R15: ffff8800232aeab0
[   48.193811] FS:  00007f2b87b19880(0000) GS:ffff88002fc00000(0000) knlGS:0000000000000000
[   48.193811] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[   48.193811] CR2: 00007fd3eca693d0 CR3: 000000002875e000 CR4: 00000000000006f0
[   48.193811] Stack:
[   48.193811]  ffff880027cfa908 ffff88002325c798 ffff88002325c8b8 ffff88002bddfe28
[   48.193811]  ffffffff81212afb ffffffff812142e8 0000000000000000 01000000001d5cc0
[   48.193811]  ffff88002325c828 ffff88002325c798 ffff88002325c828 ffff88002325c8b8
[   48.193811] Call Trace:
[   48.193811]  [<ffffffff81212afb>] d_walk+0xdb/0x470
[   48.193811]  [<ffffffff812142e8>] ? shrink_dcache_for_umount+0x88/0x140
[   48.193811]  [<ffffffff812110a0>] ? check_and_collect+0x30/0x30
[   48.193811]  [<ffffffff812142e8>] shrink_dcache_for_umount+0x88/0x140
[   48.193811]  [<ffffffff811fb051>] generic_shutdown_super+0x21/0xf0
[   48.193811]  [<ffffffff811fb357>] kill_block_super+0x27/0x70
[   48.193811]  [<ffffffffa02ae462>] gfs2_kill_sb+0x72/0x80 [gfs2]
[   48.193811]  [<ffffffff811fb77d>] deactivate_locked_super+0x3d/0x60
[   48.193811]  [<ffffffff811fbd36>] deactivate_super+0x46/0x60
[   48.193811]  [<ffffffff8121e19d>] mntput_no_expire+0x17d/0x1f0
[   48.193811]  [<ffffffff8121e037>] ? mntput_no_expire+0x17/0x1f0
[   48.193811]  [<ffffffff8121fa1e>] SyS_umount+0x8e/0x100
[   48.193811]  [<ffffffff8175fc29>] system_call_fastpath+0x16/0x1b
[   48.193811] Code: 00 00 48 8b 40 28 4c 8b 08 48 8b 43 68 48 85 c0 74 2d 48 8b 50 40 48 89 34 24 48 c7 c7 78 3d a5 81 48 89 de 31 c0 e8 43 82 53 00 <0f> 0b 0f 1f 44 00 00 48 89 f7 e8 10 fd ff ff e9 56 ff ff ff 31 
[   48.193811] RIP  [<ffffffff812111a1>] umount_collect+0x101/0x120
[   48.193811]  RSP <ffff88002bddfd88>
[   48.242102] ---[ end trace d508dcba41033e87 ]---
[   48.243204] BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:20
[   48.245097] in_atomic(): 1, irqs_disabled(): 0, pid: 381, name: umount
[   48.246621] INFO: lockdep is turned off.
[   48.247545] CPU: 0 PID: 381 Comm: umount Tainted: G      D      3.13.0-0.rc0.git7.1.fc21.x86_64 #1
[   48.249537] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   48.250848]  ffffffff81a3e4f3 ffff88002bddfa88 ffffffff8174d2c7 0000000000000000
[   48.251752]  ffff88002bddfab0 ffffffff810ac2b5 ffff88002b91a768 ffff88002b91a7c8
[   48.252848]  ffff88002b89b3a0 ffff88002bddfad8 ffffffff8175492a ffff88002bddfae8
[   48.253910] Call Trace:
[   48.254271]  [<ffffffff8174d2c7>] dump_stack+0x4d/0x66
[   48.255274]  [<ffffffff810ac2b5>] __might_sleep+0x175/0x230
[   48.256544]  [<ffffffff8175492a>] down_read+0x2a/0xa0
[   48.257683]  [<ffffffff8108b534>] exit_signals+0x24/0x130
[   48.258908]  [<ffffffff81077573>] do_exit+0xc3/0xcf0
[   48.260240]  [<ffffffff810e2828>] ? kmsg_dump+0x1b8/0x230
[   48.261505]  [<ffffffff810e2695>] ? kmsg_dump+0x25/0x230
[   48.262708]  [<ffffffff8175798c>] oops_end+0x9c/0xe0
[   48.263830]  [<ffffffff8101cf8b>] die+0x4b/0x70
[   48.264947]  [<ffffffff81757230>] do_trap+0x60/0x170
[   48.266107]  [<ffffffff8101a115>] do_invalid_op+0x95/0xb0
[   48.267314]  [<ffffffff812111a1>] ? umount_collect+0x101/0x120
[   48.268629]  [<ffffffff8138d2fa>] ? trace_hardirqs_off_thunk+0x3a/0x3c
[   48.270066]  [<ffffffff81756a63>] ? restore_args+0x30/0x30
[   48.271279]  [<ffffffff8176136e>] invalid_op+0x1e/0x30
[   48.272433]  [<ffffffff812111a1>] ? umount_collect+0x101/0x120
[   48.273724]  [<ffffffff812111a1>] ? umount_collect+0x101/0x120
[   48.275036]  [<ffffffff81212afb>] d_walk+0xdb/0x470
[   48.276133]  [<ffffffff812142e8>] ? shrink_dcache_for_umount+0x88/0x140
[   48.277611]  [<ffffffff812110a0>] ? check_and_collect+0x30/0x30
[   48.279014]  [<ffffffff812142e8>] shrink_dcache_for_umount+0x88/0x140
[   48.280479]  [<ffffffff811fb051>] generic_shutdown_super+0x21/0xf0
[   48.281799]  [<ffffffff811fb357>] kill_block_super+0x27/0x70
[   48.283089]  [<ffffffffa02ae462>] gfs2_kill_sb+0x72/0x80 [gfs2]
[   48.284439]  [<ffffffff811fb77d>] deactivate_locked_super+0x3d/0x60
[   48.285943]  [<ffffffff811fbd36>] deactivate_super+0x46/0x60
[   48.287209]  [<ffffffff8121e19d>] mntput_no_expire+0x17d/0x1f0
[   48.288520]  [<ffffffff8121e037>] ? mntput_no_expire+0x17/0x1f0
[   48.289831]  [<ffffffff8121fa1e>] SyS_umount+0x8e/0x100
[   48.291011]  [<ffffffff8175fc29>] system_call_fastpath+0x16/0x1b
[   48.292392] note: umount[381] exited with preempt_count 2
Segmentation fault