Bug 1316159 - Cache target dereferenced NULL pointer in kernel when accessed data in Failed state
Summary: Cache target dereferenced NULL pointer in kernel when accessed data in Faile...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Kernel Maintainer List
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-03-09 14:38 UTC by Zdenek Kabelac
Modified: 2018-04-06 18:07 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-04-06 18:07:14 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Zdenek Kabelac 2016-03-09 14:38:03 UTC
Description of problem:

After switch cached device into Fail state - kernel cache target is triggering this BUG:

device-mapper: cache: 253:4: metadata operation 'dm_cache_commit' failed: error = -5
device-mapper: cache: 253:4: aborting current metadata transaction
device-mapper: cache: 253:4: failed to abort metadata transaction
device-mapper: cache: 253:4: switching cache to fail mode
BUG: unable to handle kernel paging request at 00007ffffffff000
IP: [<00007ffffffff000>] 0x7ffffffff000
PGD 1367ab067 PUD 0 
Oops: 0010 [#1] SMP 
Modules linked in: isofs virtio_net virtio_ring virtio raid1 raid10 dm_raid raid456 async_raid6_recov async_memcpy async_pq async_xor xor async_tx raid6_pq dm_cache_cleaner dm_cache_smq dm_cache_mq dm_cache dm_delay dm_thin_pool dm_persistent_data dm_bio_prison libcrc32c ccm xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables snd_hda_codec_analog snd_hda_codec_generic coretemp iTCO_wdt iTCO_vendor_support kvm_intel arc4 ppdev kvm iwl3945 iwlegacy irqbypass mac80211 joydev acpi_cpufreq snd_hda_intel cfg80211 snd_hda_codec i2c_i801 snd_hda_core snd_hwdep snd_seq r592 lpc_ich memstick snd_seq_device snd_pcm thinkpad_acpi
 wmi e1000e rfkill snd_timer fjes parport_pc snd parport soundcore shpchp ptp pps_core tpm_tis tpm binfmt_misc nfsd auth_rpcgss nfs_acl lockd grace sunrpc loop i915 i2c_algo_bit drm_kms_helper drm sdhci_pci sdhci serio_raw mmc_core yenta_socket ata_generic pata_acpi video
CPU: 1 PID: 14050 Comm: lvm Not tainted 4.5.0-0.rc6.git1.2.fc25.x86_64 #1
Hardware name: LENOVO 6464CTO/6464CTO, BIOS 7LETC9WW (2.29 ) 03/18/2011
task: ffff88001faed7c0 ti: ffff8800a9924000 task.ti: ffff8800a9924000
RIP: 0010:[<00007ffffffff000>]  [<00007ffffffff000>] 0x7ffffffff000
RSP: 0018:ffff8800a9927b38  EFLAGS: 00010202
RAX: 00007ffffffff000 RBX: ffff88004f6ca588 RCX: 0000000000000006
RDX: 0000000080000000 RSI: ffff8800a9927bc8 RDI: ffff8800b0b08000
RBP: ffff8800a9927b58 R08: 00000000000d151c R09: 0000000000002e30
R10: ffffea00022d5980 R11: ffffffff81f3f0c8 R12: ffff88004f6ca400
R13: ffff8800a9927bc8 R14: ffff88004fc90138 R15: ffff88004fc90160
FS:  00007f6f5c191880(0000) GS:ffff88013bb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffffffff000 CR3: 0000000118acf000 CR4: 00000000000006e0
Stack:
 ffffffffa07c81e1 ffff88004f6c9c00 0000000000003ea0 ffff88004fc90160
 ffff8800a9927c28 ffffffffa07c18da ffff8800a9927c50 ffffffff811d0780
 ffff8800a9927c48 0000000000000000 ffff88013bde86c0 0000000000000000
Call Trace:
 [<ffffffffa07c81e1>] ? dm_cache_get_free_metadata_block_count+0x31/0x50 [dm_cache]
 [<ffffffffa07c18da>] cache_status+0x1fa/0x6c0 [dm_cache]
 [<ffffffff811d0780>] ? shmem_alloc_page+0x70/0xc0
 [<ffffffff8121156c>] ? alloc_pages_current+0x8c/0x110
 [<ffffffff816502f1>] retrieve_status+0xa1/0x1c0
 [<ffffffff816514a0>] ? dm_get_live_or_inactive_table.isra.3+0x30/0x30
 [<ffffffff81651503>] table_status+0x63/0xa0
 [<ffffffff81651176>] ctl_ioctl+0x226/0x4e0
 [<ffffffff81651443>] dm_ctl_ioctl+0x13/0x20
 [<ffffffff81259593>] do_vfs_ioctl+0xa3/0x5d0
 [<ffffffff8114d50d>] ? __audit_syscall_entry+0xad/0xf0
 [<ffffffff8100315b>] ? do_audit_syscall_entry+0x4b/0x70
 [<ffffffff81259b39>] SyS_ioctl+0x79/0x90
 [<ffffffff817d38ae>] entry_SYSCALL_64_fastpath+0x12/0x6d
Code:  Bad RIP value.
RIP  [<00007ffffffff000>] 0x7ffffffff000
 RSP <ffff8800a9927b38>
CR2: 00007ffffffff000


Version-Release number of selected component (if applicable):
4.5.0-0.rc7.git0.2.fc25.x86_64

How reproducible:


Steps to Reproduce:
1. error superblock in metadata device for cache
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Mike Snitzer 2016-04-08 20:21:53 UTC
This should be fixed by the following upstream commit (in 4.6-rc1):
http://git.kernel.org/linus/d14fcf3dd79

It was marked for stable@ so 4.5-stable and earlier should get automagically...


Note You need to log in before you can comment on or make changes to this bug.