Bug 200645

BTW, this 'froze' the system when I attempted to reboot. I had to toggle the
power to recover.

This 'started' when I attempted to unmount a usb hard drive partition.

Please try and reproduce this without the vmware modules having been loaded.

OK, I'll try, but sure exactly how.....

I'll bang on the USB disk mounting, sync-ing, unmount and see what happens.

Is it adequate to 'rmmod' the vmmon and vmnet modules, or do I need to remove
the service from my init stuff?

Also, I hadn't 'used' vmware when this bug occured (i.e., although the modules
were inserted during boot, I didn't startup vmware application.)

OK.  I reproduced it after 'rmmod'-ing the vmmon and vmnet modules.

Here's how I did it:
   service vmware stop # that removes the vmware modules
   lsmod | grep vm # just to check... no output
   count=0
   while :; do echo $count; mount /dev/sdb2 /mnt; touch /mnt/grub/grub.conf;
umount /dev/sdb2; sleep 10; ((count=$count+1)); done

While the script did work 'exactly' as I thought (appears that the unmounting is
not actually synchronous), here is what I get as output:

while :; do echo $count; mount /dev/sdb2 /mnt; touch /mnt/grub/grub.conf; umount
/dev/sdb2; sleep 10; ((count=$count+1)); done
0
1
2
umount: /mnt: device is busy
umount: /mnt: device is busy
3
mount: /dev/sdb2 already mounted or /mnt busy
mount: according to mtab, /dev/sdb2 is already mounted on /mnt
4
umount: /mnt: device is busy
umount: /mnt: device is busy
5
mount: /dev/sdb2 already mounted or /mnt busy
mount: according to mtab, /dev/sdb2 is already mounted on /mnt
Segmentation fault

followed by 'messages from syslogd@localhost ...'.

Here is the complete stuff from /var/log/messages:

Jul 30 14:25:34 localhost kernel: ------------[ cut here ]------------
Jul 30 14:25:34 localhost kernel: kernel BUG at fs/dcache.c:630!
Jul 30 14:25:34 localhost kernel: invalid opcode: 0000 [#1]
Jul 30 14:25:34 localhost kernel: SMP 
Jul 30 14:25:34 localhost kernel: last sysfs file:
/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq
Jul 30 14:25:34 localhost kernel: Modules linked in: i915 drm ipv6 autofs4 hidp
l2cap bluetooth sunrpc ip_conntrack_netbios_ns ipt_REJECT xt_state ip_conntrack
nfnetlink xt_tcpudp iptable_filter ip_tables x_tables cpufreq_ondemand video sbs
ibm_acpi i2c_ec dock button battery asus_acpi ac parport_pc lp parport
snd_intel8x0m usb_storage snd_intel8x0 snd_ac97_codec snd_ac97_bus snd_seq_dummy
snd_seq_oss snd_seq_midi_event snd_seq ipw2200 snd_seq_device sg snd_pcm_oss
snd_mixer_oss snd_pcm tg3 pcspkr ehci_hcd i2c_i801 snd_timer uhci_hcd sdhci
mmc_core i2c_core snd soundcore snd_page_alloc ieee80211 serio_raw
ieee80211_crypt dm_snapshot dm_zero dm_mirror dm_mod ext3 jbd ahci ata_piix
libata sd_mod scsi_mod
Jul 30 14:25:34 localhost kernel: CPU:    0
Jul 30 14:25:34 localhost kernel: EIP:    0060:[<c04868c2>]    Tainted: P      VLI
Jul 30 14:25:34 localhost kernel: EFLAGS: 00210283   (2.6.17-1.2462.fc6 #1) 
Jul 30 14:25:34 localhost kernel: EIP is at
shrink_dcache_for_umount_subtree+0x182/0x1e8
Jul 30 14:25:34 localhost kernel: eax: f1326c54   ebx: f5a11b3c   ecx: c1c068e0
  edx: f5a11b84
Jul 30 14:25:34 localhost kernel: esi: 00000000   edi: f1326a80   ebp: cdec1ee0
  esp: cdec1ed0
Jul 30 14:25:34 localhost kernel: ds: 007b   es: 007b   ss: 0068
Jul 30 14:25:34 localhost kernel: Process umount (pid: 6261, ti=cdec1000
task=f7ebaaa0 task.ti=cdec1000)
Jul 30 14:25:34 localhost kernel: Stack: f17461cc e5efbb84 f8bee360 00000000
cdec1eec c0487345 e5efbb84 cdec1efc 
Jul 30 14:25:34 localhost kernel:        c0477996 f6cfa384 e5efbb84 cdec1f0c
c0477a7c e5efbb84 f8bee320 cdec1f1c 
Jul 30 14:25:34 localhost kernel:        c0477b3c e5efbb84 c1cde988 cdec1f2c
c048a8a5 cdec1f40 e5efbb84 cdec1f38 
Jul 30 14:25:34 localhost kernel: Call Trace:
Jul 30 14:25:34 localhost kernel:  [<c0487345>] shrink_dcache_for_umount+0x31/0x3e
Jul 30 14:25:34 localhost kernel:  [<c0477996>] generic_shutdown_super+0x19/0xdf
Jul 30 14:25:34 localhost kernel:  [<c0477a7c>] kill_block_super+0x20/0x32
Jul 30 14:25:34 localhost kernel:  [<c0477b3c>] deactivate_super+0x5d/0x6f
Jul 30 14:25:34 localhost kernel:  [<c048a8a5>] mntput_no_expire+0x42/0x72
Jul 30 14:25:34 localhost kernel:  [<c047d57b>] path_release_on_umount+0x15/0x18
Jul 30 14:25:34 localhost kernel:  [<c048b9d4>] sys_umount+0x1e7/0x21b
Jul 30 14:25:34 localhost kernel:  [<c048ba15>] sys_oldumount+0xd/0xf
Jul 30 14:25:34 localhost kernel:  [<c0403faf>] syscall_call+0x7/0xb
Jul 30 14:25:34 localhost kernel: Code: 04 31 f6 eb 03 90 ff 0e 8d 43 48 e8 09
eb 05 00 ff 0d 24 e2 67 c0 8b 7b 24 85 ff 74 4e 8d 87 d4 01 00 00 39 87 d4 01 00
00 74 08 <0f> 0b 76 02 72 0a 63 c0 8d 43 58 8b 4b 58 c7 43 24 00 00 00 00 
Jul 30 14:25:34 localhost kernel: EIP: [<c04868c2>]
shrink_dcache_for_umount_subtree+0x182/0x1e8 SS:ESP 0068:cdec1ed0

I'm having difficulty recreating this in 2.6.17-1.2505.fc6.

Did something possibly get 'fixed'?

Yes.  An incorrect assertion check got removed, corresponding to this entry in 
the changelog:

rpm -q --changelog kernel | less
...
* Mon Jul 31 2006 Dave Jones <davej>
- VFS: Destroy the dentries contributed by a superblock on unmounting [try #2]
...