oops in proc_sys_compare

[Al Viro]

On Thu, Aug 14, 2008 at 07:31:06PM +0100, Hugh Dickins wrote:
> I got this oops below, after several hours of swap-heavy kernel builds
> in tmpfs, on 2.6.27-rc1-mm1 a couple of weeks ago.  Tried to reproduce
> it without success, then got a very similar trace (not saved) from
> 2.6.27-rc3 itself doing the same test yesterday: again oopsing in
> proc_sys_compare on address -16, looks like it's trying for
> PROC_I(dentry->d_inode)->sysctl but d_inode is NULL.
> 
> I looked to see what's been going on in fs/proc recently, and your
> [PATCH] sanitize proc_sysctl 9043476f726802f4b00c96d0c4f418dde48d1304
> does sound like it might be implicated.  I've only seen this on
> PowerPC G5, similar tests on x86_32 and _64 haven't shown it:
> maybe a memory barrier needed somewhere?
 
Bloody interesting.  We never create negative hashed dentries in there and
AFAICS we should never get d_delete() called on those...  Missing barrier
would mean serious trouble in dcache.c and not just for /proc/sys...

Are you sure about oops decoding?  At least disassembly of proc_sys_compare()
in the kernel image in question would be nice to see...