Bug 1326

Summary:	Oops when lvm scans device with unionfs
Product:	Mageia	Reporter:	Pascal Terjan <pterjan>
Component:	RPM Packages	Assignee:	Mageia Bug Squad <bugsquad>
Status:	RESOLVED FIXED	QA Contact:
Severity:	critical
Priority:	release_blocker	CC:	ennael1, mageia, tmb
Version:	Cauldron
Target Milestone:	---
Hardware:	i586
OS:	Linux
Whiteboard:
Source RPM:	kernel	CVE:
Status comment:

Description Pascal Terjan 2011-05-18 11:00:15 CEST

Always reproduced by testers when trying to install the livecd:

device-mapper: uevent: version 1.0.3
device-mapper: ioctl: 4.19.1-ioctl (2011-01-07) initialised: dm-devel@redhat.com
BUG: unable to handle kernel NULL pointer dereference at 00000014
IP: [<c0473b5d>] _raw_spin_lock+0xd/0x20
*pde = 00000000 
Oops: 0002 [#1] SMP 
last sysfs file: /sys/devices/virtual/block/ram250/removable
Modules linked in: dm_mirror dm_region_hash dm_log dm_mod joydev snd_intel8x0 snd_ac97_codec usbhid ac97_bus hid snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_pcm ppdev snd_timer snd_mixer_oss snd parport_pc i2c_piix4 button ac soundcore parport e1000 sg snd_page_alloc i2c_core evdev ata_piix ahci libahci libata unionfs squashfs loop ehci_hcd ohci_hcd uhci_hcd usb_storage usbcore sd_mod crc_t10dif vfat fat isofs nls_utf8 nls_iso8859_15 nls_iso8859_14 nls_iso8859_13 nls_iso8859_9 nls_iso8859_7 nls_iso8859_6 nls_iso8859_5 nls_iso8859_4 nls_iso8859_3 nls_iso8859_2 nls_iso8859_1 sr_mod scsi_mod ide_cd_mod ide_core [last unloaded: scsi_wait_scan]

Pid: 660, comm: lvm Not tainted 2.6.38.6-desktop586-1.mga #1 innotek GmbH VirtualBox
EIP: 0060:[<c0473b5d>] EFLAGS: 00010202 CPU: 0
EIP is at _raw_spin_lock+0xd/0x20
EAX: 00000014 EBX: 00000000 ECX: e36bf000 EDX: 00000100
ESI: e9c55180 EDI: 00000000 EBP: ea083eac ESP: ea083eac
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process lvm (pid: 660, ti=ea082000 task=ea103240 task.ti=ea082000)
Stack:
 ea083eb8 c021ec13 e36bf000 ea083edc c02143ef e3559590 e9c55180 e97fe700
 00000020 e97fe700 e9c55180 00008002 ea083ef8 c02144a3 00000000 e9a0f880
 e97fb100 e97fe700 00000000 ea083f5c ecb92582 e9a0f880 c0252052 ea103240
Call Trace:
 [<c021ec13>] get_write_access+0x13/0x40
 [<c02143ef>] __dentry_open+0x20f/0x280
 [<c02144a3>] dentry_open+0x43/0x90
 [<ecb92582>] unionfs_file_revalidate+0x6e2/0xca0 [unionfs]
 [<c0252052>] ? vfs_lock_file+0x42/0x50
 [<ecb936cf>] unionfs_flush+0x7f/0x170 [unionfs]
 [<c02140a3>] filp_close+0x33/0x70
 [<c021413d>] sys_close+0x5d/0xa0
 [<c0103b23>] sysenter_do_call+0x12/0x28
Code: e5 3e 8d 74 26 00 3e 83 28 01 79 05 e8 bd fd ff ff 5d c3 8d 74 26 00 8d bc 27 00 00 00 00 55 89 e5 3e 8d 74 26 00 ba 00 01 00 00 <3e> 66 0f c1 10 38 f2 74 06 f3 90 8a 10 eb f6 5d c3 66 90 55 89 
EIP: [<c0473b5d>] _raw_spin_lock+0xd/0x20 SS:ESP 0068:ea083eac
CR2: 0000000000000014
---[ end trace 2521d4691e95de0d ]---

I think it should be easy to reproduce by just running the livecd and running the lvm command, and it is also probably easy to reproduce without livecd by requesting lvm to scan unionfs volumes.

Anne Nicolas 2011-05-18 11:01:18 CEST

Priority: Normal => release_blocker
CC: (none) => ennael1

Anne Nicolas 2011-05-18 11:01:57 CEST

CC: (none) => tmb

Anne Nicolas 2011-05-18 11:02:22 CEST

CC: (none) => mageia

Comment 1 Thomas Backlund 2011-05-20 07:27:08 CEST

kernel-2.6.38.6-2.mga1 is now out with unionfs downgraded to a working 2.5.8

Status: NEW => RESOLVED
Resolution: (none) => FIXED