Hi, I got the NULL pointer dereference exception (see below) when I restarted one of my osd during rbd testing. After digging into osd_client.c, it seems that when osd_reset() is called, the req->r_osd will be set to NULL in __unregister_linger_request(). Then, in send_queued(), req->r_osd (NULL pointer) will be dereferenced in __send_request(). Hope it helps. -- Henry libceph: osd2 192.168.101.146:6800 socket closed BUG: unable to handle kernel NULL pointer dereference at 0000000000000059 IP: [<ffffffffa027ece1>] ceph_con_send+0x16/0x197 [libceph] PGD 0 Oops: 0000 [#1] SMP last sysfs file: /sys/devices/pci0000:00/0000:00:1e.0/0000:03:03.0/local_cpus CPU 0 Modules linked in: rbd ceph libceph libcrc32c nfsd lockd nfs_acl auth_rpcgss exportfs sunrpc ipv6 fuse bnx2 iTCO_wdt iTCO_vendor_support dcdbas power_meter joydev [last unloaded: libcrc32c] Pid: 8789, comm: ceph-msgr/0 Not tainted 2.6.32.23-170.Elaster.xendom0.fc12.x86_64 #1 PowerEdge R210 RIP: 0010:[<ffffffffa027ece1>] [<ffffffffa027ece1>] ceph_con_send+0x16/0x197 [libceph] RSP: 0018:ffff88021b1b9bf0 EFLAGS: 00010286 RAX: ffff880233a65da8 RBX: ffff880235921a00 RCX: 000000000000158c RDX: ffff880233a65e50 RSI: ffff8802299b7080 RDI: 0000000000000030 RBP: ffff88021b1b9c60 R08: ffff880233a65e50 R09: ffff88021b3da070 R10: ffff88021b1b9c10 R11: 0000000000000000 R12: ffff880233a65da8 R13: ffff880233a65e00 R14: ffff880233a65e60 R15: ffffe8ffffa08b88 FS: 0000000000000000(0000) GS:ffff880008e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: 0000000000000059 CR3: 0000000001001000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process ceph-msgr/0 (pid: 8789, threadinfo ffff88021b1b8000, task ffff880222c245f0) Stack: ffff88021b1b9c10 ffff880235921a00 ffff880233a65da8 ffff880233a65da8 <0> 0000002000000000 ffff880233a65e60 ffff88021b1b9c30 ffffffff81071f7c <0> ffff88021b1b9c40 ffff880235921a00 ffff880233a65da8 ffff880233a65e00 Call Trace: [<ffffffff81071f7c>] ? queue_delayed_work+0x26/0x28 [<ffffffffa0285a9b>] __send_request+0xc1/0xf9 [libceph] [<ffffffffa0285b31>] send_queued+0x5e/0x94 [libceph] [<ffffffffa0285e6d>] osd_reset+0x6c/0x92 [libceph] [<ffffffffa0282235>] con_work+0x10e8/0x14ee [libceph] [<ffffffff81011678>] ? __switch_to+0xdb/0x22d [<ffffffff81050d63>] ? finish_task_switch+0x48/0xb8 [<ffffffff8145b6bb>] ? thread_return+0x78/0xdb [<ffffffff810c698b>] ? probe_workqueue_execution+0xb1/0xcd [<ffffffff810713f4>] worker_thread+0x1a9/0x237 [<ffffffffa028114d>] ? con_work+0x0/0x14ee [libceph] [<ffffffff81075a1f>] ? autoremove_wake_function+0x0/0x39 [<ffffffff8107124b>] ? worker_thread+0x0/0x237 [<ffffffff81075732>] kthread+0x7f/0x87 [<ffffffff81013d6a>] child_rip+0xa/0x20 [<ffffffff810756b3>] ? kthread+0x0/0x87 [<ffffffff81013d60>] ? child_rip+0x0/0x20 Code: 48 c7 c7 22 2d 29 a0 31 c0 e8 34 bf 1d e1 eb df 41 5b 5b c9 c3 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 48 0f 1f 44 00 00 <f6> 47 29 04 49 89 fc 48 89 f3 74 37 f6 05 8e ca 74 e1 04 74 16 RIP [<ffffffffa027ece1>] ceph_con_send+0x16/0x197 [libceph] RSP <ffff88021b1b9bf0> CR2: 0000000000000059 ---[ end trace 01cef995c3bab915 ]--- -- To unsubscribe from this list: send the line "unsubscribe ceph-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
