Bug 217086

Summary: kernel dm: lvremove segmentation fault for a snapshot lv (in input/output error state)
Product: [Fedora] Fedora Reporter: Angelo Neacsu <angelo.neacsu>
Component: kernelAssignee: Milan Broz <mbroz>
Status: CLOSED RAWHIDE QA Contact: Corey Marthaler <cmarthal>
Severity: medium Docs Contact:
Priority: medium    
Version: 6CC: agk, dwysocha, jbrassow, mbroz, prockai, pvrabec
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-01-10 18:39:13 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Angelo Neacsu 2006-11-23 22:30:39 UTC
Description of problem:
I used to backup a snapshot (with only 20M in size), and after a while, i
received: Input/Output error:
When i tryied to remove the LV i've received syslog messages with the kernel bug
listed below:

Version-Release number of selected component (if applicable):

# rpm -qf `which lvremove`
lvm2-2.02.01-1.2.1
# uname -a
Linux straco 2.6.18-1.2239.fc5 #1 Fri Nov 10 13:04:06 EST 2006 i686 i686 i386
GNU/Linux


How reproducible:
lvcreate snapshot + lvremove

Steps to Reproduce:
1.
lvcreate -L 20M -s -n rootvg_snap /dev/VolGroup00/LogVol00 
2.
backup /rootvg_snap/

# ls -la /rootvg_snap/
ls: reading directory /rootvg_snap/: Input/output error
total 0
# mount
/dev/mapper/VolGroup00-LogVol00 on / type ext3 (rw)
[....]
/dev/mapper/VolGroup00-rootvg_snap on /rootvg_snap type ext3 (rw)

3.
  # umount /rootvg_snap
mount /dev/VolGroup00/rootvg_snap /rootvg_snap/ -t ext3
mount: wrong fs type, bad option, bad superblock on /dev/VolGroup00/rootvg_snap,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so
 # tail -1 /var/log/messages
Nov 23 23:24:28 straco kernel: Buffer I/O error on device dm-8, logical block 1
# lvremove -f /dev/VolGroup00/rootvg_snap
Segmentation fault
Message from syslogd@straco at Thu Nov 23 23:25:58 2006 ...
straco kernel: ------------[ cut here ]------------

straco kernel: kernel BUG at mm/slab.c:594!
straco kernel: invalid opcode: 0000 [#1]
straco kernel: CPU:    0
straco kernel: EIP is at kmem_cache_free+0x29/0x62
straco kernel: eax: 80000060   ebx: 36313123   ecx: df70d340   edx: c108b5a0
straco kernel: esi: d64cd618   edi: c45ada48   ebp: 00000130   esp: d75a4d88
straco kernel: ds: 007b   es: 007b   ss: 0068
straco kernel: Process lvremove (pid: 30779, ti=d75a4000 task=de1e36f0
task.ti=d75a4000)
straco kernel: Stack: 36313123 d64cd618 e03f7130 e00539a1 df70d340 00000026
00000200 d85ca260 
straco kernel:        d64cd5c0 e0377080 00000000 e0053a2a d4ed5e80 e0377080
00000000 e003e849 
straco kernel:        cc669cfc cc669cc0 d4ed5e80 00000000 e040f000 e003d9b1
cad435a0 cc669cc0 
straco kernel: Call Trace:
straco kernel:  [<e00539a1>] exit_exception_table+0x32/0x5a [dm_snapshot]
straco kernel:  [<e0053a2a>] snapshot_dtr+0x61/0x93 [dm_snapshot]
straco kernel:  [<e003e849>] dm_table_put+0x4c/0xac [dm_mod]
straco kernel:  [<e003d9b1>] dm_put+0x7a/0x114 [dm_mod]
straco kernel:  [<e0040c66>] dev_remove+0x8b/0x9b [dm_mod]
straco kernel:  [<e00411c5>] ctl_ioctl+0x21b/0x260 [dm_mod]
straco kernel:  [<c0470366>] do_ioctl+0x3e/0x4d
straco kernel:  [<c0470574>] vfs_ioctl+0x1ff/0x216
straco kernel:  [<c04705d7>] sys_ioctl+0x4c/0x65
straco kernel:  [<c0402d9b>] syscall_call+0x7/0xb
straco kernel: DWARF2 unwinder stuck at syscall_call+0x7/0xb
straco kernel: Leftover inexact backtrace:
straco kernel:  =======================
straco kernel: Code: 5f c3 57 89 d7 8d 92 00 00 00 40 89 c1 c1 ea 0c c1 e2 05 03
15 70 53 79 c0 56 53 8b 02 f6 c4 40 74 03 8b 52 0c 8b 02 84 c0 78 08 <0f> 0b 52
02 e3 f8 61 c0 39 4a 18 74 08 0f 0b 99 0d e3 f8 61 c0 

straco kernel: EIP: [<c045d3ac>] kmem_cache_free+0x29/0x62 SS:ESP 0068:d75a4d88


Actual results:


Expected results:


Additional info:
# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
                            36G   13G   22G  36% /

Comment 1 Angelo Neacsu 2006-11-23 22:35:49 UTC
after the seg fault, i can remove the snapshot withowt any errors:

# lvremove -f /dev/VolGroup00/rootvg_snap
  Logical volume "rootvg_snap" successfully removed


Comment 2 Milan Broz 2006-11-24 09:56:24 UTC
Known bug, fixed in kernel 2.6.19-rcX but probably not in 2.6.18 yet.
See http://bugzilla.kernel.org/show_bug.cgi?id=7040

Segfault is probably only consequence of kernel oops.
Rawhide kernel based on patches from 2.6.19 should work.