Bug 236880
| Summary: | [PATCH] Fix NULL bio crash in loop worker thread | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Alexey Dobriyan <adobriyan> | ||||
| Component: | kernel | Assignee: | Eric Sandeen <esandeen> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Martin Jenner <mjenner> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 5.0 | CC: | dzickus, esandeen, jordi | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | RHBA-2007-0959 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2007-11-07 19:47:07 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Created attachment 152879 [details]
[PATCH] Fix NULL bio crash in loop worker thread
Alexey, has this been sent upstream to lkml? It wasn't sent because bug was accidently fixed during kthread conversion. See commit 6c9979185c7ef4feeb7f8d29be032b8f032a1838. Probably, I should sent it to Adrian Bunk... Thanks Alexey. -Eric I see this was sent up for Adrian's tree at http://lkml.org/lkml/2007/6/1/45 This request was evaluated by Red Hat Kernel Team for inclusion in a Red Hat Enterprise Linux maintenance release, and has moved to bugzilla status POST. in 2.6.18-27.el5 You can download this test kernel from http://people.redhat.com/dzickus/el5 *** Bug 280861 has been marked as a duplicate of this bug. *** An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2007-0959.html |
Description of problem: After LOOP_SET_FD/LOOP_CLR_FD combo loop device's queue gets request handler which is persistent. After, say mount -t iso9660 /dev/loop0 /mnt # sic this request handler is called directly with a) ->lo_state being Lo_unbound b) ->lo_pending being zero Error path in loop_make_request() completes ->lo_bh_done completion which is persistent as well. Now, let's start worker thread as usual. It'll set ->lo_pending to 1, don't wait for completion because it was already completed (brokenly), and will not get out of infinite loop because of ->lo_pending. Loop device doesn't have bios at this point and triggers BUG_ON. So, don't complete ->lo_bh_done when loop device isn't setup fully. How reproducible: always Steps to Reproduce: #!/bin/sh -x ISO=1.iso mount -o loop $ISO /mnt umount /mnt mount -t iso9660 /dev/loop0 /mnt # sic mount -o loop $ISO /mnt Actual results: BUG_ON(!bio); in loop_thread triggers