tux3: crash upon writing data with bs=1M

[Dongsu Park]

Hi,

I just tried to test tux3 that has been updated recently.

Test environment:
 * on a qemu-kvm guest, kernel 3.6.0
 * Source tree: <git://github.com/OGAWAHirofumi/tux3.git>
 * Branch: temp-atomic-commit
 * Latest commit: f9f6fddd9 "Kill sb->loglock"
 * Test device: /dev/vdb mapped via raw image

Test steps:
 * compile tux3
 * Load kernel module
  # insmod ./user/kernel/tux3.ko
 * run mkfs
  # ./user/tux3 mkfs -b 4096 /dev/vdb
 * mount tux3
  # mount -t tux3 /dev/vdb /mnt/tux3
 * write a file
  # dd if=/dev/zero of=/mnt/tux3/test1 bs=1M count=256

Then I got a kernel crash with the following log message.
Can anyone please tell me what's going on?

Regards,
Dongsu

---------------------------------------------------------------------
[  259.269921] tux3_fill_super: s_blocksize 4096
[  339.038377] balloc: couldn't balloc: blocks 46390
[  339.038434] ------------[ cut here ]------------
[  339.038736] kernel BUG at /home/dpark/Dev/tux3/user/kernel/buffer_writeback.c:67!
[  339.039204] invalid opcode: 0000 [#1] SMP
[  339.039553] Modules linked in: tux3(O) autofs4 nfsd nfs_acl
auth_rpcgss nfs fscache lockd sunrpc loop kvm_amd kvm tpm_tis tpm
tpm_bios microcode psmouse parport_pc serio_raw parport evdev i2c_piix4
i2c_core processor thermal_sys button ext3 jbd mbcache dm_mod raid10
raid456 async_raid6_recov async_pq raid6_pq async_xor xor async_memcpy
async_tx raid1 raid0 multipath linear md_mod sg sr_mod cdrom ata_generic
virtio_blk virtio_net ata_piix virtio_pci virtio_ring virtio libata
scsi_mod
[  339.040036] CPU 1
[  339.040036] Pid: 1257, comm: tux3/vdb Tainted: G           O 3.6.0-guest+ #3 Bochs Bochs
[  339.040036] RIP: 0010:[<ffffffffa03ec375>]  [<ffffffffa03ec375>] flush_list+0x265/0x270 [tux3]
[  339.040036] RSP: 0018:ffff88010993bbf0  EFLAGS: 00010206
[  339.040036] RAX: 00000000ffffffe4 RBX: 000000000000c903 RCX: 000000000000169d
[  339.040036] RDX: ffff8801096c1428 RSI: ffff880109041640 RDI: ffffea0004241040
[  339.040036] RBP: ffff88010993bbf8 R08: 0000000000015920 R09: ffff88011b002700
[  339.040036] R10: ffffffffa03f4072 R11: 0000000000000001 R12: ffff88010993bbf8
[  339.040036] R13: ffff8801096c14a8 R14: 000000000000c902 R15: 0000000000000001
[  339.040036] FS:  00007f9ce7b9f700(0000) GS:ffff88011fc20000(0000) knlGS:0000000000000000
[  339.040036] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  339.040036] CR2: ffffffffff600400 CR3: 0000000109db6000 CR4: 00000000000006e0
[  339.040036] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  339.040036] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  339.040036] Process tux3/vdb (pid: 1257, threadinfo ffff88010993a000, task ffff88010920f1b0)
[  339.040036] Stack:
[  339.040036]  ffff8801096c1428 ffff8801194be1e8 ffff88011599b938 ffffffff0000b536
[  339.040036]  ffff88010993bd10 ffff8801096c15f0 0000000000000005 ffff8801096c06b0
[  339.040036]  0000000000001000 0000000000000000 ffff88010993be50 ffffffffa03f495a
[  339.040036] Call Trace:
[  339.040036]  [<ffffffffa03f495a>] ? tux3_write_begin+0x3a/0x570 [tux3]
[  339.040036]  [<ffffffffa03f2190>] ? blockget+0xd0/0xd0 [tux3]
[  339.040036]  [<ffffffffa03fca83>] ? tux3_flush_inode+0x323/0x3e0 [tux3]
[  339.040036]  [<ffffffffa03fcbd4>] ? tux3_flush_inodes+0x94/0xb0 [tux3]
[  339.040036]  [<ffffffffa03ee435>] ? flush_delta_work+0x135/0x5a0 [tux3]
[  339.040036]  [<ffffffffa03ee300>] ? setup_sb+0x30/0x30 [tux3]
[  339.040036]  [<ffffffffa03ee300>] ? setup_sb+0x30/0x30 [tux3]
[  339.040036]  [<ffffffff810609b6>] ? kthread+0xc6/0xd0
[  339.040036]  [<ffffffff814fcec4>] ? kernel_thread_helper+0x4/0x10
[  339.040036]  [<ffffffff810608f0>] ? kthread_freezable_should_stop+0x60/0x60
[  339.040036]  [<ffffffff814fcec0>] ? gs_change+0x13/0x13
[  339.040036] Code: c0 5b 5d 41 5c 41 5d 41 5e c3 48 89 ca 48 c7 c6 70
ea 3f a0 48 c7 c7 2c fe 3f a0 31 c0 e8 b0 54 10 e1 e9 ec fe ff ff 0f 0b
eb fe <0f> 0b eb fe 0f 0b eb fe 0f 1f 00 8b 4f 18 4c 8d 47 08 85 c9 74
[  339.040036] RIP  [<ffffffffa03ec375>] flush_list+0x265/0x270 [tux3]
[  339.040036]  RSP <ffff88010993bbf0>
[  339.059580] ---[ end trace 38d7e143a67bb005 ]---
---------------------------------------------------------------------