[Bugme-new] [Bug 4162] New: kernel oops (crash) with reiserfs

[bugme-daemon at osdl.org]

http://bugme.osdl.org/show_bug.cgi?id=4162

           Summary: kernel oops (crash) with reiserfs
    Kernel Version: 2.6.11-rc2, also in 2.6.11-rc1
            Status: NEW
          Severity: blocking
             Owner: reiserfs-dev at namesys.com
         Submitter: abramov at fromru.com


Distribution: Gentoo development-sources
Hardware Environment: simple computer with one IDE disk. 
Problem Description: kernel oops during hard work on reiserfs partition:

(I have reiserfs partition mounted on /mnt/floppy)
 # cp -a /usr/src/linux-2.6.11-rc2/ /mnt/floppy/
Segmentation fault

# dmesg
(cut here)
ReiserFS: hdc3: found reiserfs format "3.6" with standard journal
ReiserFS: hdc3: using ordered data mode
ReiserFS: hdc3: journal params: device hdc3, size 8192, journal first block 18, 
max trans len 1024, max batch 900, max commit age 30, max trans age 30
ReiserFS: hdc3: checking transaction log (hdc3)
ReiserFS: hdc3: replayed 5 transactions in 1 seconds
ReiserFS: hdc3: Using r5 hash to sort names
ReiserFS: warning: is_tree_node: node level 3 does not match to the expected one 
1
ReiserFS: hdc3: warning: vs-5150: search_by_key: invalid format found in block 
2752512. Fsck?
ReiserFS: hdc3: warning: vs-13050: reiserfs_update_sd: i/o failure occurred 
trying to update [7287 7304 0x0 SD] stat data
ReiserFS: warning: is_tree_node: node level 3 does not match to the expected one 
1
ReiserFS: hdc3: warning: vs-5150: search_by_key: invalid format found in block 
2752512. Fsck?
Unable to handle kernel NULL pointer dereference at virtual address 0000001c
 printing eip:
c01bb53e
*pde = 00000000
Oops: 0000 [#1]
PREEMPT
Modules linked in: ipv6
CPU:    0
EIP:    0060:[<c01bb53e>]    Not tainted VLI
EFLAGS: 00010206   (2.6.11-rc2MWAS)
EIP is at prepare_for_delete_or_cut+0x2e/0x7e0
eax: 00000000   ebx: db569ea4   ecx: db569e20   edx: 00000000
esi: 00000001   edi: 00000030   ebp: 00000000   esp: db569b5c
ds: 007b   es: 007b   ss: 0068
Process cp (pid: 3272, threadinfo=db568000 task=dcee1020)
Stack: 0000ffff d549de90 00000c88 00001000 df1dfe00 00001c77 00001c88 00001000
       20000000 00000001 00000004 dc353d48 df1dfe00 00001c77 00001c88 00000001
       20000000 0c88ffff 00010534 d549dedc db569ea4 00000000 00000001 00000000
Call Trace:
 [<c01bcda5>] reiserfs_cut_from_item+0xe5/0x5f0
 [<c01bd6db>] reiserfs_do_truncate+0x37b/0x5f0
 [<c01a71e4>] reiserfs_truncate_file+0xf4/0x290
 [<c01c3b74>] journal_end+0xb4/0xf0
 [<c01a9053>] reiserfs_file_release+0x493/0x550
 [<c018e331>] dnotify_parent+0x91/0xd0
 [<c015bbbe>] __fput+0x13e/0x190
 [<c0159fc2>] filp_close+0x52/0xa0
 [<c015a084>] sys_close+0x74/0xd0
 [<c01033a7>] syscall_call+0x7/0xb
Code: 53 83 ec 54 8b 44 24 6c 8b 54 24 70 8b 5c 24 68 8b 80 94 00 00 00 89 d1 89 
44 24 30 8b 02 8b 7b 10 8b 54 c2 08 8b 44 c1 0c 85 ff <8b> 52 1c 8d 04 40 8d 74 
c2 18 0f 84 92 06 00 00 66 83 7e 16 00

After that system cannot be rebooted normally due too "sync" call hangs up.
Similar problem exists in most(all?) kernels 2.6.x (was tested on 2.6.7, 2.6.9, 
2.6.10).

Steps to reproduce: create a reiserfs partition and unpack (or just copy) kernel 
sources (for example) on this partition.

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.