Bug 986416

Summary:	kernel BUG at drivers/md/dm-bufio.c:560
Product:	[Fedora] Fedora	Reporter:	Carlos Maiolino <cmaiolin>
Component:	kernel	Assignee:	LVM and device-mapper development team <lvm-team>
Status:	CLOSED INSUFFICIENT_DATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	20	CC:	cmaiolin, gansalmon, itamar, jonathan, kernel-maint, madhu.chinakonda, msnitzer
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-03-17 18:41:37 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Carlos Maiolino 2013-07-19 17:41:31 UTC

Description of problem:

Kernel bug while creating a thin pool using the dm-thin device over a striped dm device.


[  213.569181] ------------[ cut here ]------------
[  213.569455] kernel BUG at drivers/md/dm-bufio.c:560!
[  213.569750] invalid opcode: 0000 [#1] SMP
[  213.570118] Modules linked in: dm_thin_pool dm_persistent_data dm_bufio dm_bio_prison libcrc32c nf_conntrack_netbios_ns nf_conntrack_broadcast ipt_MASQUERADE ip6table_nat nf_nat_ipv6 ip6table_mangle ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 iptable_nat nf_nat_ipv4 nf_nat iptable_mangle nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_filter ebtables ip6table_filter ip6_tables mperf coretemp kvm_intel kvm tg3 iTCO_wdt crc32c_intel iTCO_vendor_support ptp pps_core dcdbas i7core_edac edac_core microcode pcspkr lpc_ich mfd_core acpi_power_meter hid_logitech_dj mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit drm_kms_helper ttm drm mptsas mptscsih mptbase scsi_transport_sas i2c_core
[  213.582640] CPU: 2 PID: 994 Comm: dmsetup Not tainted 3.10.1 #1
[  213.583847] Hardware name: Dell Inc. PowerEdge T110/07GPTK, BIOS 1.6.4 03/02/2011
[  213.585040] task: ffff88022fd99770 ti: ffff88022816e000 task.ti: ffff88022816e000
[  213.585481] RIP: 0010:[<ffffffffa029f522>]  [<ffffffffa029f522>] submit_io+0x1c2/0x1f0 [dm_bufio]
[  213.586013] RSP: 0018:ffff88022816fa30  EFLAGS: 00010246
[  213.586322] RAX: ffff8802328e1400 RBX: ffff8802293b9000 RCX: 0000000000001000
[  213.586978] RDX: ffffea0008a4ee40 RSI: 0000000000000008 RDI: ffff880230058000
[  213.588116] RBP: ffff88022816fa70 R08: 0000000000000000 R09: 0000000000000000
[  213.589258] R10: 00000000000033b9 R11: 0000000000000000 R12: ffff88022ff4fc00
[  213.590404] R13: ffff88022ff4fc60 R14: 0000000000001000 R15: 0000000000001000
[  213.591544] FS:  00007fe1089ec800(0000) GS:ffff880237240000(0000) knlGS:0000000000000000
[  213.592826] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  213.594124] CR2: 00007fbd1c547000 CR3: 0000000232f4c000 CR4: 00000000000007e0
[  213.595587] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  213.596712] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  213.597852] Stack:
[  213.598172]  000000000000779e ffffffffa029fc10 0000000000000000 ffff88022ff4fc00
[  213.599483]  ffff8802328e1400 0000000000000001 ffff88022816fb40 0000000000000001
[  213.600800]  ffff88022816faa8 ffffffffa02a0c45 00000001328e1400 ffff88022816fb40
[  213.601793] Call Trace:
[  213.601937]  [<ffffffffa029fc10>] ? dm_bufio_client_create+0x3b0/0x3b0 [dm_bufio]
[  213.602377]  [<ffffffffa02a0c45>] new_read+0xa5/0xe0 [dm_bufio]
[  213.602724]  [<ffffffffa02a0cc9>] dm_bufio_read+0x29/0x30 [dm_bufio]
[  213.603098]  [<ffffffffa02ad472>] dm_bm_read_lock+0x32/0x1a0 [dm_persistent_data]
[  213.604330]  [<ffffffffa02ad003>] ? dm_block_manager_create+0x63/0xa0 [dm_persistent_data]
[  213.605671]  [<ffffffffa02c5792>] __create_persistent_data_objects+0x62/0x7d0 [dm_thin_pool]
[  213.607023]  [<ffffffff8116999c>] ? kmem_cache_alloc_trace+0x3c/0x210
[  213.608054]  [<ffffffffa02c604f>] ? dm_pool_metadata_open+0x2f/0x120 [dm_thin_pool]
[  213.609286]  [<ffffffffa02c60b2>] dm_pool_metadata_open+0x92/0x120 [dm_thin_pool]
[  213.610489]  [<ffffffffa02c423b>] pool_ctr+0x46b/0x900 [dm_thin_pool]
[  213.611537]  [<ffffffff81168c55>] ? __kmalloc+0x55/0x240
[  213.612389]  [<ffffffff814ac648>] ? dm_split_args+0x58/0x160
[  213.613403]  [<ffffffff814ac8b7>] dm_table_add_target+0x167/0x470
[  213.614922]  [<ffffffff814af8d7>] table_load+0x117/0x330
[  213.615807]  [<ffffffff814af7c0>] ? list_devices+0x180/0x180
[  213.616719]  [<ffffffff814b0ad5>] ctl_ioctl+0x275/0x4e0
[  213.617556]  [<ffffffff814b0d53>] dm_ctl_ioctl+0x13/0x20
[  213.618333]  [<ffffffff811923c5>] do_vfs_ioctl+0x305/0x520
[  213.618655]  [<ffffffff812717ce>] ? file_has_perm+0x8e/0xa0
[  213.618980]  [<ffffffff8118239e>] ? ____fput+0xe/0x10
[  213.619274]  [<ffffffff81192661>] SyS_ioctl+0x81/0xa0
[  213.619572]  [<ffffffff816188de>] ? do_page_fault+0xe/0x10
[  213.619890]  [<ffffffff8161cf42>] system_call_fastpath+0x16/0x1b
[  213.620771] Code: ff ff 0f 1f 80 00 00 00 00 f7 c3 ff 0f 00 00 0f 84 33 ff ff ff 0f 0b 66 90 49 8b 44 24 58 81 78 60 00 10 00 00 0f 87 80 fe ff ff <0f> 0b 0f 1f 40 00 8b 7d c4 4c 89 ee e8 ad 8d 00 e1 48 83 c4 18
[  213.673371] RIP  [<ffffffffa029f522>] submit_io+0x1c2/0x1f0 [dm_bufio]
[  213.720008]  RSP <ffff88022816fa30>
[  213.768729] ---[ end trace 95a3967b25128fa4 ]---


Version-Release number of selected component (if applicable):
Kernel 3.10.1

How reproducible:
After some tests creating/deleting dm-thin devices, the bug is always reproducible

Steps to Reproduce:
1. sudo dmsetup create raid0 --table "0 2147483648 striped 2 1024 /dev/sdb1 0 /dev/sdc1 0"
2. sudo dmsetup create POOL --table "0 2147483648 thin-pool /dev/loop0 /dev/mapper/raid0 2048 98304"
3. BUG()

Additional info:
I was able to create/remove these devices some times, but right now it's triggering the BUG() always.

The dmsetup table shows an empty POOL table:

[cem@localhost ~]$ sudo dmsetup table
raid0: 0 2147483648 striped 2 1024 8:17 0 8:33 0
fedora-root: 0 61440000 linear 8:3 2048
POOL: 
fedora-home: 0 102400000 linear 8:3 61442048

Comment 1 Carlos Maiolino 2013-07-19 17:45:39 UTC

Jsut as information,  no other messages were logged to syslog before the BUG() happened.

I tried to reproduce the bug just after a system reboot, so previously to the BUG() just boot information, and nothing weird or any error regarding to the devices.

Comment 2 Mike Snitzer 2013-07-24 13:39:59 UTC

FYI, Carlos was using a loopback file for the metadata device.

Comment 3 Mike Snitzer 2013-07-24 14:49:52 UTC

Mikulas tried to reproduce but he could not.  Would be good to determine if this is somehow a bug in the loopback block driver.  Please try to reproduce using a real block device for the metadata device.

If you cannot reproduce with a real block device then we can provide a patch that provides additional debugging output before we BUG() in bufio.c and you can retest with a loopback file.

Comment 4 Fedora End Of Life 2013-09-16 14:39:04 UTC

This bug appears to have been reported against 'rawhide' during the Fedora 20 development cycle.
Changing version to '20'.

More information and reason for this action is here:
https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora20

Comment 5 Justin M. Forbes 2014-03-17 18:41:37 UTC

*********** MASS BUG UPDATE **************

This bug has been in a needinfo state for several weeks and is being closed with insufficient data due to inactivity. If this is still an issue with Fedora 20, please feel free to reopen the bug and provide the additional information requested.