From: Jiri Slaby Subject: Re: OOPS in configfs when doing d_delete Date: Mon, 21 Feb 2011 11:47:09 +0100 Message-ID: <4D6242AD.2090600@suse.cz> References: <4D623C62.8030509@suse.cz> <20110221104359.GA18538@noexit> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: npiggin@kernel.dk, Al Viro , linux-fsdevel@vger.kernel.org, LKML , Jiri Slaby To: jlbec@evilplan.org Return-path: Received: from mail-bw0-f42.google.com ([209.85.214.42]:51041 "EHLO mail-bw0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752810Ab1BUKzT (ORCPT ); Mon, 21 Feb 2011 05:55:19 -0500 In-Reply-To: <20110221104359.GA18538@noexit> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On 02/21/2011 11:44 AM, Joel Becker wrote: > On Mon, Feb 21, 2011 at 11:20:18AM +0100, Jiri Slaby wrote: >> when configfs_attach_group fails in configfs_register_subsystem: >> dentry = d_alloc(configfs_sb->s_root, &name); >> if (dentry) { >> d_add(dentry, NULL); >> >> err = configfs_attach_group(sd->s_element, &group->cg_item, >> dentry); >> if (err) { >> d_delete(dentry); >> dput(dentry); >> >> >> d_delete kills the kernel. I don't know what the actual bug is here, but >> d_delete looks broken anyway: >> spin_lock(&dentry->d_lock); >> inode = dentry->d_inode; >> isdir = S_ISDIR(inode->i_mode); <======== dereference >> if (dentry->d_count == 1) { >> if (inode && !spin_trylock(&inode->i_lock)) { >> ^^^^^ <============= test >> >> It seems like a superfluous test, not a potential null dereference to >> me, right? > > I think you're right about the superfluous test, but I need more > investigation to see what's going on. Thanks for the report. > What was causing attach_group() to fail? Do you know? Dunno, I just modprobe'd the configfs example from Doc dir (configfs_example_macros). regards, -- js suse labs