[Bug 200069] BUG() triggered in start_this_handle() (jbd2/transaction.c) when operating and umounting a crafted ext4 image

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



https://bugzilla.kernel.org/show_bug.cgi?id=200069

Theodore Tso (tytso@xxxxxxx) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tytso@xxxxxxx

--- Comment #4 from Theodore Tso (tytso@xxxxxxx) ---
OK, what's going on with this image is the following:

* The s_first_ino is 3 --- it's supposed to be 11, and should never be less
than that number.  The kernel currently doesn't check to make sure value of
s_first_ino is valid.  This is a recipe for disaster, but what's really
triggering the problem is....

* The directory entry for foo/bar/baz points at inode #8 -- the journal inode.

So when the workload unlinks foo/bar/baz, this drops the refcount to zero, and
when we unmount the file system and release the journal inode,
ext4_evict_inode() tries to delete the journal inode, after we almost
completely done with the unmount.  This triggers the BUG_ON at
fs/jbd2/transaction.c:319.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.



[Index of Archives]     [Reiser Filesystem Development]     [Ceph FS]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Linux FS]     [Yosemite National Park]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Device Mapper]     [Linux Media]

  Powered by Linux