Bug 360151

Summary:	kernel dm: panic on shrinking device size
Product:	Red Hat Enterprise Linux 5	Reporter:	Milan Broz <mbroz>
Component:	kernel	Assignee:	Milan Broz <mbroz>
Status:	CLOSED ERRATA	QA Contact:	Martin Jenner <mjenner>
Severity:	high	Docs Contact:
Priority:	medium
Version:	5.0	CC:	agk, dwysocha, jnomura, pvrabec
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	RHBA-2008-0314	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-05-21 14:59:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Milan Broz 2007-10-31 13:28:32 UTC

Description of problem:

Shrinking device size with outstanding io requests can cause kernel panic.

See Jun'ichi Nomura's patch proposal http://lkml.org/lkml/2007/10/30/432
(reproducer script inside)


BUG: unable to handle kernel NULL pointer dereference at virtual address 00000024
 printing eip:
d092740f
*pde = 00000000
Oops: 0000 [#1]
SMP
last sysfs file: /block/loop0/range
Modules linked in: loop autofs4 hidp rfcomm l2cap bluetooth sunrpc ipv6
dm_multipath video sbs backlight i2c_ec button battery asus_acpi ac lp ata_piix lib
CPU:    0
EIP:    0060:[<d092740f>]    Not tainted VLI
EFLAGS: 00010202   (2.6.18-52.el5 #1)
EIP is at __map_bio+0x41/0x10a [dm_mod]
eax: d0abc0c0   ebx: 00000000   ecx: c8642810   edx: c8b60bc0
esi: c8b60bc0   edi: c8642808   ebp: d0abc0c0   esp: c8b68d5c
ds: 007b   es: 007b   ss: 0068
Process dmsetup (pid: 2543, ti=c8b68000 task=c8b6caa0 task.ti=c8b68000)
Stack: 00000001 00000000 c8b60bc0 c04743d3 00000010 00000000 c8b60bc0 cfeb4e00
       00000200 c8642808 d0927fa4 cdbbae40 c8b7eac0 00000007 00000000 ffffffff
       ffffffff 00000007 00000000 00000200 d0abc0c0 cfeb4e00 00000000 00000000
Call Trace:
 [<c04743d3>] bio_alloc_bioset+0x9b/0xf3
 [<d0927fa4>] __split_bio+0x3bc/0x418 [dm_mod]
 [<d0928017>] __flush_deferred_io+0x17/0x20 [dm_mod]
 [<d0928132>] dm_resume+0x78/0xda [dm_mod]
 [<d092abb9>] dev_suspend+0x133/0x152 [dm_mod]
 [<d092b335>] ctl_ioctl+0x1f3/0x238 [dm_mod]
 [<d092aa86>] dev_suspend+0x0/0x152 [dm_mod]
 [<c047f213>] do_ioctl+0x47/0x5d
 [<c047f473>] vfs_ioctl+0x24a/0x25c
 [<c047f4cd>] sys_ioctl+0x48/0x5f
 [<c0404eff>] syscall_call+0x7/0xb
 =======================
Code: 02 64 c9 92 d0 c7 46 34 d8 74 92 d0 89 7e 3c 8b 07 90 ff 40 0c 8b 06 8d 4f
08 8b 56 04 89 04 24 89 e8 89 54 24 04 8b 5d 04 89 f2 <ff> 53 24 83 f8 01
EIP: [<d092740f>] __map_bio+0x41/0x10a [dm_mod] SS:ESP 0068:c8b68d5c
 <0>Kernel panic - not syncing: Fatal exception

Comment 1 RHEL Program Management 2007-10-31 13:35:26 UTC

This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 3 Don Zickus 2007-12-17 19:37:17 UTC

in 2.6.18-61.el5
You can download this test kernel from http://people.redhat.com/dzickus/el5

Comment 6 errata-xmlrpc 2008-05-21 14:59:56 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2008-0314.html