Additional info: libreport version: 2.0.18 abrt_version: 2.0.18 cmdline: BOOT_IMAGE=/vmlinuz-3.6.5-1.fc17.x86_64 root=UUID=3d131530-ad80-43f5-8c8b-1aacf8f4e047 ro rd.md=0 rd.lvm=0 rd.dm=0 SYSFONT=True KEYTABLE=us rd.luks=0 LANG=en_US.UTF-8 rhgb quiet kernel: 3.6.5-1.fc17.x86_64 backtrace: :BUG: unable to handle kernel NULL pointer dereference at 000000000000003f :IP: [<ffffffffa05bbca6>] free_extent_map+0x16/0x70 [btrfs] :PGD 64ce067 PUD 64cf067 PMD 0 :Oops: 0000 [#1] SMP :Modules linked in: hid_logitech_dj xfs btrfs libcrc32c zlib_deflate tcp_diag inet_diag ts_bm xt_string fuse lockd sunrpc tun bnep 8021q bluetooth garp stp llc nf_conntrack_netbios_ns nf_conntrack_broadcast ip6t_REJECT nf_conntrack_ipv6 ipt_MASQUERADE iptable_nat nf_defrag_ipv6 nf_nat nf_conntrack_ipv4 xt_state nf_defrag_ipv4 nf_conntrack ip6table_filter ip6_tables snd_hda_codec_hdmi snd_hda_codec_realtek kvm_amd kvm snd_hda_intel snd_hda_codec snd_hwdep arc4 rt2800pci rt2800lib edac_core snd_seq snd_seq_device snd_pcm forcedeth rt2x00pci rt2x00lib eeprom_93cx6 mac80211 edac_mce_amd shpchp i2c_nforce2 microcode k10temp snd_page_alloc snd_timer snd soundcore cfg80211 rfkill crc_ccitt serio_raw uinput ata_generic pata_acpi usb_storage pata_amd nouveau mxm_wmi wmi video i2c_algo_bit drm_kms_helper ttm drm i2c_core :CPU 0 :Pid: 11216, comm: rsync Not tainted 3.6.5-1.fc17.x86_64 #1 eMachines ER1401/ER1401 :RIP: 0010:[<ffffffffa05bbca6>] [<ffffffffa05bbca6>] free_extent_map+0x16/0x70 [btrfs] :RSP: 0018:ffff8800079bbc18 EFLAGS: 00010282 :RAX: ffffffffffffffef RBX: ffffffffffffffef RCX: 00000000009f70a1 :RDX: 00000000009f70a0 RSI: ffff88001c1dc7e0 RDI: ffffffffffffffef :RBP: ffff8800079bbc28 R08: 000060ff90000da0 R09: 00000000ffffffef :R10: 00000000ffffffef R11: 0000000000000000 R12: ffff8800095ca768 :R13: 0000000410a7d000 R14: 0000000410a5e000 R15: ffffffffffffffef :FS: 00007f03f8128740(0000) GS:ffff88006fc00000(0000) knlGS:0000000000000000 :CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b :CR2: 000000000000003f CR3: 00000000064cd000 CR4: 00000000000007f0 :DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 :DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 :Process rsync (pid: 11216, threadinfo ffff8800079ba000, task ffff880007b9ae20) :Stack: : 0000000410a5e000 0000000410a5e000 ffff8800079bbcf8 ffffffffa05b4199 : ffff8800079bbc68 ffffffffa05b5942 ffff88000000000e ffff8800079bbcc8 : ffff88003791b980 ffff8800095ca768 ffff8800079bbc98 ffffffffffffffef :Call Trace: : [<ffffffffa05b4199>] btrfs_cont_expand+0x279/0x320 [btrfs] : [<ffffffffa05b5942>] ? btrfs_update_time+0x62/0xd0 [btrfs] : [<ffffffffa05b9edd>] btrfs_file_aio_write+0x28d/0x4a0 [btrfs] : [<ffffffff8118e807>] do_sync_write+0xa7/0xe0 : [<ffffffff8118f08c>] vfs_write+0xac/0x180 : [<ffffffff8118f3ba>] sys_write+0x4a/0x90 : [<ffffffff81625829>] system_call_fastpath+0x16/0x1b :Code: 00 00 00 c7 40 58 00 00 00 00 c7 40 50 01 00 00 00 5d c3 66 90 55 48 89 e5 53 48 83 ec 08 66 66 66 66 90 48 85 ff 48 89 fb 74 28 <8b> 47 50 85 c0 74 28 f0 ff 4b 50 0f 94 c0 84 c0 74 16 8b 43 54 :RIP [<ffffffffa05bbca6>] free_extent_map+0x16/0x70 [btrfs] : RSP <ffff8800079bbc18> :CR2: 000000000000003f
This oops comes from buggy error handling in btrfs_cont_expand(). > :BUG: unable to handle kernel NULL pointer dereference at 000000000000003f > :IP: [<ffffffffa05bbca6>] free_extent_map+0x16/0x70 [btrfs] > 41ca6: 8b 47 50 mov 0x50(%rdi),%eax > :RDX: 00000000009f70a0 RSI: ffff88001c1dc7e0 RDI: ffffffffffffffef > (gdb) print/x 0xffffffffffffffef + 0x50 > $2 = 0x3f > (gdb) print (long)0xffffffffffffffef > $4 = -17 > /usr/include/asm-generic/errno-base.h:#define EEXIST 17 > while (1) { > em = btrfs_get_extent(inode, NULL, 0, cur_offset, > block_end - cur_offset, 0); > if (IS_ERR(em)) { > err = PTR_ERR(em); > break; > } > [ ... ] > } > > free_extent_map(em); > void free_extent_map(struct extent_map *em) > { > if (!em) > return; > WARN_ON(atomic_read(&em->refs) == 0); So any errors from btrfs_get_extent() in btrfs_cont_expand() will trigger this oops. The bug is still present upstream in mainline. I'll get it fixed.
This has been applied upstream and was first available in v3.8-rc5. commit f276795627045a3c599a60b476767861e4318c7d Author: Zach Brown <zab> Date: Tue Jan 8 19:37:58 2013 +0000 btrfs: fix btrfs_cont_expand() freeing IS_ERR em $ git tag --contains f276795627045a3c599a60b476767861e4318c7d v3.8-rc5 So the fix will be available in F17 if the kernel package rebases to a 3.8 kernel, probably around a 3.8.1 stable kernel release.