[2.6.31] kernel BUG at fs/ext3/super.c:435

[2.6.31] kernel BUG at fs/ext3/super.c:435

[Mikael Pettersson]

One of my machines just oopsed in ext3_put_super()
during reboot after a glibc update:

>	if (!list_empty(&sbi->s_orphan))
>		dump_orphan_list(sb, sbi);
>	J_ASSERT(list_empty(&sbi->s_orphan));

Turning off swap:  
Turning off quotas:  quotaoff: Warning: No quota format detected in the kernel.

Unmounting file systems:  sb orphan head is 17
sb_info orphan list:
  inode sda2:17 at d7565a18: mode 100600, nlink 0, next 15
  inode sda2:15 at dd646ba0: mode 100600, nlink 0, next 0
kernel BUG at fs/ext3/super.c:435!
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = dfb90000
[00000000] *pgd=00000000
Internal error: Oops: 805 [#1]
Modules linked in:
CPU: 0    Not tainted  (2.6.31 #1)
PC is at __bug+0x20/0x2c
LR is at release_console_sem+0x1a4/0x204
pc : [<c0025128>]    lr : [<c0035fb4>]    psr: 60000013
sp : de827eb8  ip : de827df8  fp : de827ec4
r10: 00000000  r9 : de827f60  r8 : 00000000
r7 : df9335a4  r6 : df967200  r5 : df9335a4  r4 : df9334e0
r3 : 00000000  r2 : c03060c4  r1 : 002bdc93  r0 : 00000029
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 0005397f  Table: 1fb90000  DAC: 00000015
Process umount (pid: 16089, stack limit = 0xde826270)
Stack: (0xde827eb8 to 0xde828000)
7ea0:                                                       de827ef4 de827ec8 
7ec0: c00d11b4 c0025118 00008180 00000000 00000000 c025d9f0 df967200 c025d9f0 
7ee0: 00000000 df80a1a0 de827f0c de827ef8 c0089518 c00d1068 df402660 00000003 
7f00: de827f24 de827f10 c00895cc c00894ac df967200 c030b234 de827f3c de827f28 
7f20: c0089aac c00895bc df80a1a0 df967200 de827f5c de827f40 c009c82c c0089a74 
7f40: df80a198 df80a198 df80a1a0 df80a1b8 de827fa4 de827f60 c009cd74 c009c7cc 
7f60: de827f60 de827f60 de827f68 de827f68 df80a1a0 df4373d8 c0027660 00000000 
7f80: 2a008164 2a00a798 00000034 c0022004 de826000 00000000 00000000 de827fa8 
7fa0: c0021e80 c009cae4 00000000 2a008164 2a00a798 00000001 00000001 00000274 
7fc0: 00000000 2a008164 2a00a798 00000034 2a00a1e8 2a00a788 00000000 bed3defa 
7fe0: 00000000 bed3da58 2a0020b4 4012c96c 60000010 2a00a798 00000000 00000000 
Backtrace: 
[<c0025108>] (__bug+0x0/0x2c) from [<c00d11b4>] (ext3_put_super+0x15c/0x1cc)
[<c00d1058>] (ext3_put_super+0x0/0x1cc) from [<c0089518>] (generic_shutdown_super+0x7c/0x110)
 r7:df80a1a0 r6:00000000 r5:c025d9f0 r4:df967200
[<c008949c>] (generic_shutdown_super+0x0/0x110) from [<c00895cc>] (kill_block_super+0x20/0x38)
 r5:00000003 r4:df402660
[<c00895ac>] (kill_block_super+0x0/0x38) from [<c0089aac>] (deactivate_super+0x48/0x60)
 r5:c030b234 r4:df967200
[<c0089a64>] (deactivate_super+0x0/0x60) from [<c009c82c>] (mntput_no_expire+0x70/0xa8)
 r5:df967200 r4:df80a1a0
[<c009c7bc>] (mntput_no_expire+0x0/0xa8) from [<c009cd74>] (sys_umount+0x2a0/0x2d0)
 r6:df80a1b8 r5:df80a1a0 r4:df80a198
[<c009cad4>] (sys_umount+0x0/0x2d0) from [<c0021e80>] (ret_fast_syscall+0x0/0x2c)
Code: e1a01000 e59f000c eb08bdc9 e3a03000 (e5833000) 

The machine came up Ok after the reboot with no noticeable
complaints from the kernel or mount (/dev/sda2 is /tmp).

/Mikael

Re: [2.6.31] kernel BUG at fs/ext3/super.c:435

[Mikael Pettersson]

Mikael Pettersson writes:
 > One of my machines just oopsed in ext3_put_super()
 > during reboot after a glibc update:
 > 
 > >	if (!list_empty(&sbi->s_orphan))
 > >		dump_orphan_list(sb, sbi);
 > >	J_ASSERT(list_empty(&sbi->s_orphan));
 > 
 > Turning off swap:  
 > Turning off quotas:  quotaoff: Warning: No quota format detected in the kernel.
 > 
 > Unmounting file systems:  sb orphan head is 17
 > sb_info orphan list:
 >   inode sda2:17 at d7565a18: mode 100600, nlink 0, next 15
 >   inode sda2:15 at dd646ba0: mode 100600, nlink 0, next 0
 > kernel BUG at fs/ext3/super.c:435!

The exact same oops now happened on a different machine that
also had done a glibc rebuild + upgrade followed by a reboot:

Unmounting file systems:  sb orphan head is 14
sb_info orphan list:
  inode sda7:14 at c2621dc8: mode 100600, nlink 0, next 12
  inode sda7:12 at c2453c30: mode 100600, nlink 0, next 0
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c3bd8000
[00000000] *pgd=00000000
Internal error: Oops: 8f5 [#1]
Modules linked in: sunrpc af_packet ehci_hcd uhci_hcd ixp4xx_eth ixp4xx_npe firmware_class ixp4xx_qmgr e
CPU: 0    Not tainted  (2.6.31 #1)
PC is at ext3_put_super+0x170/0x1e0
LR is at release_console_sem+0x1b0/0x20c
pc : [<c00cb6b0>]    lr : [<c002ecd8>]    psr: 80000013
sp : c3945ec8  ip : c3945e08  fp : c3945ef4
r10: 00000000  r9 : c3945f60  r8 : 00000000
r7 : c38da484  r6 : c3adfc00  r5 : c38da3c0  r4 : c38da484
r3 : 00000000  r2 : c024ac9c  r1 : 000030a4  r0 : 00000040
Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 000039ff  Table: 03bd8000  DAC: 00000015
Process umount (pid: 21959, stack limit = 0xc3944270)
Stack: (0xc3945ec8 to 0xc3946000)
5ec0:                   00008180 00000000 00000000 c01c5164 c3adfc00 c01c5164 
5ee0: 00000000 c380ae20 c3945f0c c3945ef8 c0081aa4 c00cb54c c3402860 00000003 
5f00: c3945f24 c3945f10 c0081b58 c0081a34 c3adfc00 c024e3ec c3945f3c c3945f28 
5f20: c0082038 c0081b44 c380ae20 c3adfc00 c3945f5c c3945f40 c0094d04 c0081ffc 
5f40: c380ae18 c380ae18 c380ae20 c380ae38 c3945fa4 c3945f60 c009524c c0094ca0 
5f60: c3945f60 c3945f60 c3945f68 c3945f68 c380ae20 c15c1cb8 c002545c 00000000 
5f80: 2a008164 2a00a798 00000034 c001ffc4 c3944000 00000000 00000000 c3945fa8 
5fa0: c001fe40 c0094fb8 00000000 2a008164 2a00a798 00000001 00000001 00000274 
5fc0: 00000000 2a008164 2a00a798 00000034 2a00a1e8 2a00a788 00000000 bea5ef07 
5fe0: 00000000 bea5ea68 2a0020b4 401345cc 60000010 2a00a798 ffffffff ffffffff 
Backtrace: 
[<c00cb540>] (ext3_put_super+0x0/0x1e0) from [<c0081aa4>] (generic_shutdown_super+0x7c/0x110)
 r7:c380ae20 r6:00000000 r5:c01c5164 r4:c3adfc00
[<c0081a28>] (generic_shutdown_super+0x0/0x110) from [<c0081b58>] (kill_block_super+0x20/0x38)
 r5:00000003 r4:c3402860
[<c0081b38>] (kill_block_super+0x0/0x38) from [<c0082038>] (deactivate_super+0x48/0x60)
 r5:c024e3ec r4:c3adfc00
[<c0081ff0>] (deactivate_super+0x0/0x60) from [<c0094d04>] (mntput_no_expire+0x70/0xa8)
 r5:c3adfc00 r4:c380ae20
[<c0094c94>] (mntput_no_expire+0x0/0xa8) from [<c009524c>] (sys_umount+0x2a0/0x2d0)
 r6:c380ae38 r5:c380ae20 r4:c380ae18
[<c0094fac>] (sys_umount+0x0/0x2d0) from [<c001fe40>] (ret_fast_syscall+0x0/0x2c)

This kernel runs on a memory-constrained machine, so it has fewer
debugging features, but the oops location is the same J_ASSERT
as before.