BUG：Kernel Crashed When Removing A File Or A Directory

[DavidingPlus]

截止到 commit e60ed8a，在尝试删除文件或目录的时候内核会崩溃。

[Issues-translate-bot]

Bot detected the issue body's language is not English, translate it automatically.

---

As of commit e60ed8a, the kernel crashes when trying to delete a file or directory.

[DavidingPlus]

终端截图如下：

内核崩溃日志如下：

[  621.318593] ------------[ cut here ]------------
[  621.318600] WARNING: CPU: 0 PID: 9484 at fs/inode.c:420 ihold+0x20/0x30
[  621.318601] Modules linked in: nvmixfs(OE) vmw_vsock_vmci_transport vsock dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua binfmt_misc vmw_balloon dax_pmem_compat device_dax nd_pmem dax_pmem_core nd_btt joydev input_leds serio_raw vmw_vmci mac_hid sch_fq_codel msr ramoops reed_solomon efi_pstore ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul vmwgfx crc32_pclmul ttm ghash_clmulni_intel drm_kms_helper aesni_intel syscopyarea sysfillrect crypto_simd sysimgblt fb_sys_fops cryptd glue_helper ahci drm psmouse mptspi mptscsih e1000 mptbase i2c_piix4 pata_acpi libahci scsi_transport_spi hid_generic usbhid hid [last unloaded: nvmixfs]
[  621.318632] CPU: 0 PID: 9484 Comm: rmdir Tainted: G        W  OE     5.4.0-214-generic #234-Ubuntu
[  621.318633] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
[  621.318635] RIP: 0010:ihold+0x20/0x30
[  621.318636] Code: 0f 1f 84 00 00 00 00 00 66 90 0f 1f 44 00 00 55 b8 01 00 00 00 48 89 e5 f0 0f c1 87 58 01 00 00 83 c0 01 83 f8 01 7e 02 5d c3 <0f> 0b 5d c3 66 66 2e 0f 1f 84 00 00 00 00 00 90 0f 1f 44 00 00 31
[  621.318637] RSP: 0018:ffffb64f41897e78 EFLAGS: 00010246
[  621.318637] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000100000000
[  621.318638] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9df22ac1a400
[  621.318638] RBP: ffffb64f41897e78 R08: 0000000000000001 R09: 0000000000000064
[  621.318639] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9df2258a15c0
[  621.318639] R13: 0000000000000000 R14: ffff9df22ee71c00 R15: ffff9df22ac1a400
[  621.318642] FS:  00007f54608c8580(0000) GS:ffff9df238000000(0000) knlGS:0000000000000000
[  621.318642] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  621.318643] CR2: 00007f54607d75d0 CR3: 00000001aba5c000 CR4: 0000000000340ef0
[  621.318644] Call Trace:
[  621.318651]  ? show_regs.cold+0x1a/0x1f
[  621.318654]  ? __warn+0x98/0xe0
[  621.318655]  ? ihold+0x20/0x30
[  621.318658]  ? report_bug+0xd1/0x100
[  621.318660]  ? do_error_trap+0x9b/0xc0
[  621.318661]  ? do_invalid_op+0x3c/0x50
[  621.318662]  ? ihold+0x20/0x30
[  621.318664]  ? invalid_op+0x1e/0x30
[  621.318666]  ? ihold+0x20/0x30
[  621.318668]  vfs_rmdir+0x153/0x1b0
[  621.318669]  do_rmdir+0x18c/0x1c0
[  621.318671]  __x64_sys_rmdir+0x17/0x20
[  621.318672]  do_syscall_64+0x57/0x190
[  621.318674]  entry_SYSCALL_64_after_hwframe+0x61/0xc6
[  621.318675] RIP: 0033:0x7f54607e4f5b
[  621.318676] Code: 73 01 c3 48 8b 0d 35 bf 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 54 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 05 bf 0d 00 f7 d8 64 89 01 48
[  621.318676] RSP: 002b:00007ffe82abd808 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
[  621.318677] RAX: ffffffffffffffda RBX: 00007ffe82abd948 RCX: 00007f54607e4f5b
[  621.318677] RDX: 00007f54608c4580 RSI: 0000000000000001 RDI: 00007ffe82abe873
[  621.318678] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
[  621.318678] R10: 00007f54608be640 R11: 0000000000000246 R12: 000056247d058b00
[  621.318679] R13: 00007ffe82abe873 R14: 000056247d0550c7 R15: 0000000000000000
[  621.318680] ---[ end trace ff817ab25e678d9a ]---
[  621.318684] BUG: kernel NULL pointer dereference, address: 0000000000000030
[  621.318714] #PF: supervisor read access in kernel mode
[  621.318730] #PF: error_code(0x0000) - not-present page
[  621.318747] PGD 0 P4D 0
[  621.318758] Oops: 0000 [#1] SMP NOPTI
[  621.318771] CPU: 0 PID: 9484 Comm: rmdir Tainted: G        W  OE     5.4.0-214-generic #234-Ubuntu
[  621.318799] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
[  621.318832] RIP: 0010:iput+0xcb/0x210
[  621.318844] Code: ce 91 01 48 85 db 74 1b 48 8b 03 48 8b 7b 08 48 83 c3 18 4c 89 e6 e8 64 a5 b0 00 48 8b 03 48 85 c0 75 e8 eb 9f 49 8b 5c 24 28 <48> 8b 73 30 a8 08 0f 85 2c 01 00 00 48 8b 76 28 48 85 f6 0f 84 c1
[  621.318898] RSP: 0018:ffffb64f41897e58 EFLAGS: 00010246
[  621.318915] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[  621.318936] RDX: 0000000000000000 RSI: ffff9df22ac1a488 RDI: ffff9df22ac1a488
[  621.318956] RBP: ffffb64f41897e78 R08: ffff9df2258a15e0 R09: 0000000000000000
[  621.318978] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9df22ac1a400
[  621.318999] R13: ffff9df22ac1a488 R14: ffff9df22ac1a558 R15: ffff9df22ac1a400
[  621.319021] FS:  00007f54608c8580(0000) GS:ffff9df238000000(0000) knlGS:0000000000000000
[  621.319045] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  621.319063] CR2: 0000000000000030 CR3: 00000001aba5c000 CR4: 0000000000340ef0
[  621.319087] Call Trace:
[  621.319098]  ? show_regs.cold+0x1a/0x1f
[  621.319111]  ? __die+0x90/0xd9
[  621.319124]  ? no_context.isra.0+0x12c/0x320
[  621.319140]  ? vprintk_default+0x29/0x50
[  621.319154]  ? vprintk_func+0x4c/0xc0
[  621.319167]  ? __bad_area_nosemaphore+0x45/0x1a0
[  621.319183]  ? bad_area_nosemaphore+0x16/0x20
[  621.319198]  ? do_user_addr_fault+0x267/0x440
[  621.319213]  ? ihold+0x20/0x30
[  621.319225]  ? __do_page_fault+0x58/0x90
[  621.319239]  ? do_error_trap+0x9b/0xc0
[  621.319684]  ? do_page_fault+0x2c/0xe0
[  621.320104]  ? page_fault+0x34/0x40
[  621.320525]  ? iput+0xcb/0x210
[  621.320926]  ? iput+0x7d/0x210
[  621.321319]  vfs_rmdir+0x194/0x1b0
[  621.321768]  do_rmdir+0x18c/0x1c0
[  621.322155]  __x64_sys_rmdir+0x17/0x20
[  621.322545]  do_syscall_64+0x57/0x190
[  621.322918]  entry_SYSCALL_64_after_hwframe+0x61/0xc6
[  621.323287] RIP: 0033:0x7f54607e4f5b
[  621.323647] Code: 73 01 c3 48 8b 0d 35 bf 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 54 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 05 bf 0d 00 f7 d8 64 89 01 48
[  621.324748] RSP: 002b:00007ffe82abd808 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
[  621.325119] RAX: ffffffffffffffda RBX: 00007ffe82abd948 RCX: 00007f54607e4f5b
[  621.325492] RDX: 00007f54608c4580 RSI: 0000000000000001 RDI: 00007ffe82abe873
[  621.325857] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
[  621.326217] R10: 00007f54608be640 R11: 0000000000000246 R12: 000056247d058b00
[  621.326619] R13: 00007ffe82abe873 R14: 000056247d0550c7 R15: 0000000000000000
[  621.326999] Modules linked in: nvmixfs(OE) vmw_vsock_vmci_transport vsock dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua binfmt_misc vmw_balloon dax_pmem_compat device_dax nd_pmem dax_pmem_core nd_btt joydev input_leds serio_raw vmw_vmci mac_hid sch_fq_codel msr ramoops reed_solomon efi_pstore ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul vmwgfx crc32_pclmul ttm ghash_clmulni_intel drm_kms_helper aesni_intel syscopyarea sysfillrect crypto_simd sysimgblt fb_sys_fops cryptd glue_helper ahci drm psmouse mptspi mptscsih e1000 mptbase i2c_piix4 pata_acpi libahci scsi_transport_spi hid_generic usbhid hid [last unloaded: nvmixfs]
[  621.330223] CR2: 0000000000000030
[  621.330659] ---[ end trace ff817ab25e678d9b ]---
[  621.331097] RIP: 0010:iput+0xcb/0x210
[  621.331539] Code: ce 91 01 48 85 db 74 1b 48 8b 03 48 8b 7b 08 48 83 c3 18 4c 89 e6 e8 64 a5 b0 00 48 8b 03 48 85 c0 75 e8 eb 9f 49 8b 5c 24 28 <48> 8b 73 30 a8 08 0f 85 2c 01 00 00 48 8b 76 28 48 85 f6 0f 84 c1
[  621.332878] RSP: 0018:ffffb64f41897e58 EFLAGS: 00010246
[  621.333303] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[  621.333721] RDX: 0000000000000000 RSI: ffff9df22ac1a488 RDI: ffff9df22ac1a488
[  621.334137] RBP: ffffb64f41897e78 R08: ffff9df2258a15e0 R09: 0000000000000000
[  621.334560] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9df22ac1a400
[  621.334980] R13: ffff9df22ac1a488 R14: ffff9df22ac1a558 R15: ffff9df22ac1a400
[  621.335409] FS:  00007f54608c8580(0000) GS:ffff9df238000000(0000) knlGS:0000000000000000
[  621.335852] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  621.336292] CR2: 0000000000000030 CR3: 00000001aba5c000 CR4: 0000000000340ef0

[DavidingPlus]

经查询日志，发现是某个地方的空指针导致内存泄漏。

排查提交历史后发现是 nvmixUnlink() 中的 iput() 函数出现的问题。

[Issues-translate-bot]

Bot detected the issue body's language is not English, translate it automatically.

---

After querying the log, it was found that it was a null pointer somewhere that caused memory leakage.

After troubleshooting the submission history, I found that it was a problem with the iput() function in nvmixUnlink().

[DavidingPlus]

已解决，见 PR #25。

[Issues-translate-bot]

Bot detected the issue body's language is not English, translate it automatically.

---

Resolved, see PR #25.