Red Hat Bugzilla – Bug 183664
dm: make sure don't give out the same minor number twice
Last modified: 2013-04-02 19:51:05 EDT
Description of problem: see: http://www.kernel.org/git/?p=linux/kernel/git/chrisw/linux-2.6.15.y.git;a=commitdiff;h=e5a78bb9935a635ebcb71c10899c53bfc99f8c7f Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
Created attachment 125894 [details] Free minor number after unregistering This is a RHEL4-backported patch from upstream.
Created attachment 125903 [details] Regression test for this bug Regression test for this bug. Without the proposed patch, kernel will panic eventually.
Typical Oops with this bug and the testcase in Comment #2 -------------------------------------------------------------------------------------------------- Badness in kref_get at lib/kref.c:32 Call Trace:<ffffffff801e74c9>{kref_get+46} <ffffffff801e6f8a>{kobject_get+18} <ffffffff801e6fbc>{kobject_init+45} <ffffffff8024d170>{alloc_disk+170} <ffffffffa005fd3e>{:dm_mod:create_aux+705} <ffffffffa0062573>{:dm_mod:dev_create+75} <ffffffffa0062528>{:dm_mod:dev_create+0} <ffffffffa0063ae6>{:dm_mod:ctl_ioctl+599} <ffffffff80189319>{sys_ioctl+853} <ffffffff801101c6>{system_call+126} Unable to handle kernel NULL pointer dereference at 0000000000000000 RIP: <ffffffff801e6bb1>{kobject_get_path+41} PML4 1915da067 PGD 1a26b8067 PMD 0 Oops: 0000 [1] SMP CPU 3 Modules linked in: nfsd exportfs lockd nfs_acl md5 ipv6 parport_pc lp parport autofs4 i2c_dev i2c_core sunrpc ds yenta_socket pcmcia_core scsi_dump diskdump zlib_deflate dm_mirror dm_multipath button battery ac uhci_hcd ehci_hcd e752x_edac edac_mc e1000 floppy sg ext3 jbd dm_mod aic79xx sd_mod scsi_mod Pid: 16910, comm: dmsetup Not tainted 2.6.9-34.ELlargesmp RIP: 0010:[<ffffffff801e6bb1>] <ffffffff801e6bb1>{kobject_get_path+41} RSP: 0018:00000101a9d63c48 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000002180 RCX: ffffffffffffffff RDX: 0000000000000006 RSI: 00000000000000d0 RDI: 0000000000000000 RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000003 R10: 0000000000000000 R11: 0000000000000000 R12: 0000010195f01ec0 R13: 00000100cfd964a8 R14: 0000000000000000 R15: 0000010190539800 FS: 0000002a95585380(0000) GS:ffffffff804eac00(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000000 CR3: 0000000037e14000 CR4: 00000000000006e0 Process dmsetup (pid: 16910, threadinfo 00000101a9d62000, task 00000101a18fa030)Stack: ffffffff803fda00 ffffffff803fda00 0000000000002180 0000010190539817 0000010195f01ec0 ffffffff803fda00 00000100cfd964a8 ffffffff801e6db6 ffffffff803de100 ffffffff803fda28 Call Trace:<ffffffff801e6db6>{kobject_hotplug+384} <ffffffff801b0870>{sysfs_add_file+115} <ffffffffa0062528>{:dm_mod:dev_create+0} <ffffffff801e728c>{kobject_add+332} <ffffffff801ae26c>{register_disk+67} <ffffffff8024c81b>{add_disk+52} <ffffffffa005fde6>{:dm_mod:create_aux+873} <ffffffffa0062573>{:dm_mod:dev_create+75} <ffffffffa0062528>{:dm_mod:dev_create+0} <ffffffffa0063ae6>{:dm_mod:ctl_ioctl+599} <ffffffff80189319>{sys_ioctl+853} <ffffffff801101c6>{system_call+126} Code: f2 ae 48 f7 d1 48 ff c9 4d 85 c0 8d 2c 0a 8d 55 01 75 db 48 RIP <ffffffff801e6bb1>{kobject_get_path+41} RSP <00000101a9d63c48> CR2: 0000000000000000
This bug is a duplicate of BZ#185455. Jason, Alasdair, please close this bug if it's ok.
Sorry - I forgot to check for bugs cc'd to me like this when submitting these patches to U4! *** This bug has been marked as a duplicate of 185445 ***
This test case have been added to the RHTS system /kernel/filesystems/183664/
errata tool clean up, add to U4 CANFIX list for tracking purposes.