Re: kernel BUG at fs/dcache.c:648! with v3.11-7890-ge5c832d

[Linus Torvalds]

On Tue, Sep 10, 2013 at 11:43 AM, Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote:
>
> !LOOKUP_ROOT: we set nd->root the first time we need / (in the very
> beginning if it's an absolute pathname, on the first absolute symlink
> otherwise).  In non-RCU mode we hold a reference to it; in RCU mode
> we do not.  As the result, leaving RCU mode should either grab
> a reference to the damn thing (if we intend to go on) or zero it out.

Yeah, that was what I was thinking. But in particular, I was wondering
if we could simplify unlazy_walk() to _not_ take that root reference
at all, and just always zero it out even if we succeed.

IOW, doing the attached patch (_instead_ of the one I sent out).

Or is there something in path lookup retrying that might get uphappy
if we go back to a NULL root.mnt, and doesn't check it?

Because this patch actually simplifies that nasty/complex
unlazy_walk() a lot, and makes it much more understnadable, I think.
It always looked really odd to me how it used to do "if LOOKUP_ROOT is
_not_ set, let's take a reference count to the root"). With this patch
in place, I really like how straightforward unlazy_walk() is. That
used to be just about _the_ most subtle part of the whole
rcu-to-refcount thing (as demonstrated by the number of bugs it has
exposed in the patches), and now it looks almost trivial.

Mace - ignore this newer patch for now, the one I want you to test is
the minimal one you already have, not this cleanup one. But since you
clearly saw the problem I never did, if you get bored _after_ testing
the first patch, feel free to give this one a whirl too. But notice
that this patch is a replacement for - not in addition to - the first
one.

             Linus

Attachment: patch.diff
Description: Binary data