Bug 135266

The system died with "dump" command in lvm_find_exception_table with
one entry's "next" field of the hash_table being "0" during a list
entry remove.

   108 lvm_find_exception_table(kdev_t org_dev, unsigned long
org_start, lv_t *         lv)
   109 {
   110         struct list_head * hash_table =
lv->lv_snapshot_hash_table, * ne        xt;
   111         unsigned long mask = lv->lv_snapshot_hash_mask;
   112         int chunk_size = lv->lv_chunk_size;
   113         lv_block_exception_t * ret;
   114         int i = 0;
   115
   116         if (!hash_table)
   117                 BUG();
   118         hash_table = &hash_table[hashfn(org_dev, org_start,
mask, chunk_        size)];
   119         ret = NULL;
   120         for (next = hash_table->next; next != hash_table; next
= next->n        ext)
   121         {
   122                 lv_block_exception_t * exception;
   123
   124                 exception = list_entry(next,
lv_block_exception_t, hash)        ;
   125                 if (exception->rsector_org == org_start &&
   126                     exception->rdev_org == org_dev)
   127                 {
   128                         if (i)
   129                         {
   130                                 /* fun, isn't it? :) */
   131 #ifdef  list_move
   132                                 list_move(next, hash_table);
   133 #else
   134                                 list_del(next);
   135                                 list_add(next, hash_table);


static inline void __list_del(struct list_head *prev, struct list_head
*next)
{
   109e:       8b 41 04                mov    0x4(%ecx),%eax
   10a1:       8b 11                   mov    (%ecx),%edx
       next->prev = prev;
       prev->next = next;
   10a3:       89 10                   mov    %edx,(%eax)
}

/**
* list_del - deletes entry from list.
* @entry: the element to delete from the list.
* Note: list_empty on entry does not return true after this, the entry
is in an undefined state.
*/
static inline void list_del(struct list_head *entry)
{
       __list_del(entry->prev, entry->next);
       entry->next = (void *) 0;
   10a5:       c7 01 00 00 00 00       movl   $0x0,(%ecx)
   10ab:       89 42 04                mov    %eax,0x4(%edx)         
   <----- edx is 0
   10ae:       8b 03                   mov    (%ebx),%eax
   10b0:       89 48 04                mov    %ecx,0x4(%eax)
   10b3:       89 01                   mov    %eax,(%ecx)
   10b5:       89 59 04                mov    %ebx,0x4(%ecx)
   10b8:       89 0b                   mov    %ecx,(%ebx)
   10ba:       89 c8                   mov    %ecx,%eax
   10bc:       eb ce                   jmp    108c
<lvm_find_exception_table+0x5c>
   10be:       0f 0b                   ud2a
   10c0:       75 00                   jne    10c2
<lvm_find_exception_table+0x92>
   10c2:       0d 00 00 00 eb          or     $0xeb000000,%eax
   10c7:       97                      xchg   %eax,%edi

1. The vmcore is located at (looged in as anonymous ftp account):
   ftp://enterprise.redhat.com/incoming/vmcore-361320.gz
2. Found an identical issue in:
   http://www.spinics.net/lists/lvm/msg11750.html.
3. Just freshly built a test kernel with option #1 as discussed in
   previous link for customer to test (as a workaround). 

Adding alias to IT ticket of another customer having the same problem. 

A fix for this problem has just been committed to the RHEL3 U5
patch pool this afternoon (in kernel version 2.4.21-27.9.EL).

*** Bug 152959 has been marked as a duplicate of this bug. ***

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2005-294.html