race in fsnotify subsystem causes kernel oops

[Chris J Arges]

This race can be triggered by plugging and unplugging a usb disk. See previous bugs for backtraces.

Related upstream bug: https://bugzilla.kernel.org/show_bug.cgi?id=22602

Previous bug(s):
Originally reported in bug 922906.
After this was properly mainlined it we re-applied in bug 1096137.
However a regression was found in bug 1101666.

This bug aims at fixing the original test case presented in the kernel bug along with the regression test case.

[Test Case]
The attachment lp1110605-testcase.tar contains the files needed to reproduce the original bug and regression. Download and extract this to a target machine.

To test original issue:
gcc inotify_test.c -o inotify_test
inotify_test &
./mount_unmount.sh

To test regression:
./regression_test.sh

[Chris J Arges (arges)]

Test build here:
http://people.canonical.com/~arges/lp1110605/

I'm testing on my end, before submitting a pull-request.

[Chris J Arges (arges)]

A new build with 6960b0d909cde5bdff49e4e5c1250edd10be7ebd applied here:
http://people.canonical.com/~arges/lp1101666.1/

[Chris J Arges (arges)]

To reproduce the issue seen in 6960b0d909cde5bdff49e4e5c1250edd10be7ebd you will need to run both reproducer scripts at the same time with a 3.5 series kernel.

[Luis Henriques (henrix)]

This bug is awaiting verification that the kernel for Precise in -proposed solves the problem (3.2.0-38.59). Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-precise' to 'verification-done-precise'.

If verification is not done by one week from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Luis Henriques (henrix)]

This bug is awaiting verification that the kernel for Quantal in -proposed solves the problem (3.5.0-24.37). Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-quantal' to 'verification-done-quantal'.

If verification is not done by one week from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Luis Henriques (henrix)]

I've tested both Precise and Quantal kernels against the original bug (bug #922906) and the regression (bug #1101666) and they seem to be OK. Tagging as verified.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.2.0-38.60

---------------
linux (3.2.0-38.60) precise-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1124013

  [ Herton Ronaldo Krzesinski ]

  * SAUCE: fix i915 regression after commit 9594e7e
    - LP: #1119809

linux (3.2.0-38.59) precise-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1116240

  [ Andy Whitcroft ]

  * [Config] enable various HVC consoles
    - LP: #1102206

  [ Herton Ronaldo Krzesinski ]

  * [Config] updateconfigs for 3.2.36 stable update

  [ Stefan Bader ]

  * (config) Move 9p modules into generic package
    - LP: #1107658

  [ Upstream Kernel Changes ]

  * Revert "device_cgroup: fix RCU usage"
    - LP: #1096966
  * Revert "sched, autogroup: Stop going ahead if autogroup is disabled"
    - LP: #1096966
  * Revert "ath9k_hw: Update AR9003 high_power tx gain table"
    - LP: #1096966
  * Revert "mm: vmscan: fix endless loop in kswapd balancing"
    - LP: #1096966
  * freezer: PF_FREEZER_NOSIG should be cleared along with PF_NOFREEZE
    - LP: #1096966
  * i915: Quirk no_lvds on Gigabyte GA-D525TUD ITX motherboard
    - LP: #1096966
  * drm/i915: Add no-lvds quirk for Supermicro X7SPA-H
    - LP: #1096966
  * ACPI: missing break
    - LP: #1096966
  * workqueue: convert BUG_ON()s in __queue_delayed_work() to
    WARN_ON_ONCE()s
    - LP: #1096966
  * hwmon: (coretemp) Improve support of recent Atom CPU models
    - LP: #1096966
  * hwmon: (coretemp) Add support for Atom D2000 and N2000 series CPU
    models
    - LP: #1096966
  * hwmon: (coretemp) Improve support for TjMax detection on Atom CPUs
    - LP: #1096966
  * hwmon: (coretemp) Add support for Atom CE4110/4150/4170
    - LP: #1096966
  * ARM: 7566/1: vfp: fix save and restore when running on pre-VFPv3 and
    CONFIG_VFPv3 set
    - LP: #1096966
  * sata_svw: check DMA start bit before reset
    - LP: #1096966
  * drivers/leds/leds-lp5521.c: fix typo
    - LP: #1096966
  * drivers/leds/leds-lp5521.c: ret may be uninitialized
    - LP: #1096966
  * drivers/leds/leds-lp5521.c: fix lp5521_read() error handling
    - LP: #1096966
  * scsi: aha152x: Fix sparse warning and make printing pointer address
    more portable.
    - LP: #1096966
  * ALSA: hda - Fix missing beep on ASUS X43U notebook
    - LP: #1096966
  * i7300_edac: Fix error flag testing
    - LP: #1096966
  * Revert misapplied "mmc: sh-mmcif: avoid oops on spurious interrupts"
    - LP: #1096966
  * tmpfs: fix shared mempolicy leak
    - LP: #1096966
  * powerpc: fix wii_memory_fixups() compile error on 3.0.y tree
    - LP: #1096966
  * s390/kvm: dont announce RRBM support
    - LP: #1096966
  * cgroup: cgroup_subsys->fork() should be called after the task is added
    to css_set
    - LP: #1096966
  * freezer: add missing mb's to freezer_count() and freezer_should_skip()
    - LP: #1096966
  * mm: add kmap_to_page()
    - LP: #1096966
  * mm: highmem: export kmap_to_page for modules
    - LP: #1096966
  * virtio: 9p: correctly pass physical address to userspace for high pages
    - LP: #1096966
  * virtio: force vring descriptors to be allocated from lowmem
    - LP: #1096966
  * ath9k_hw: Ena...

[Adam Conrad (adconrad)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.5.0-24.37

---------------
linux (3.5.0-24.37) quantal-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1117492

  [ Tim Gardner ]

  * [Config] CONFIG_ALX=m for x86 only
    - LP: #927782

linux (3.5.0-24.36) quantal-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1116501

  [ Adam Lee ]

  * [Config] Enable RTSX_PCI modules
    - LP: #1057089

  [ Andy Whitcroft ]

  * [Config] enable various HVC consoles
    - LP: #1102206

  [ Brad Figg ]

  * Revert "SAUCE: samsung-laptop: disable in UEFI mode"
    - LP: #1111689

  [ Herton Ronaldo Krzesinski ]

  * [Config] updateconfigs for 3.5.7.3 stable update
  * d-i: Add mellanox ethernet drivers to nic-modules
    - LP: #1015339

  [ Kamal Mostafa ]

  * SAUCE: alx driver import script
    - LP: #927782

  [ Qualcomm Atheros, Inc ]

  * SAUCE: alx: Update to heads/master
    - LP: #927782

  [ Seth Forshee ]

  * SAUCE: samsung-laptop: Add quirk for broken acpi_video backlight on
    N250P
    - LP: #1086921

  [ Stefan Bader ]

  * (config) Move 9p modules into generic package
    - LP: #1107658

  [ Tim Gardner ]

  * [debian] Remove dangling symlink from headers package
    - LP: #1112442
  * [config] CONFIG_ALX=m
    - LP: #927782
  * [Config] Add alx to d-i nic-modules
    - LP: #927782

  [ Upstream Kernel Changes ]

  * Revert "8139cp: revert "set ring address before enabling receiver""
    - LP: #1102417
  * Revert "ath9k_hw: Update AR9003 high_power tx gain table"
    - LP: #1102417
  * Revert "drm/i915: no lvds quirk for Zotac ZDBOX SD ID12/ID13"
    - LP: #1102417
  * Revert "ALSA: hda - Shut up pins at power-saving mode with Conexnat
    codecs"
    - LP: #1106966, #886975
  * be2net: don't call vid_config() when there's no vlan config
    - LP: #1083088
  * be2net: cleanup be_vid_config()
    - LP: #1083088
  * be2net: do not modify PCI MaxReadReq size
    - LP: #1083088
  * be2net: fix reporting number of actual rx queues
    - LP: #1083088
  * be2net: do not use SCRATCHPAD register
    - LP: #1083088
  * be2net: Fix driver load for VFs for Lancer
    - LP: #1083088
  * be2net: Explicitly clear the reserved field in the Tx Descriptor
    - LP: #1083088
  * be2net: Regression bug wherein VFs creation broken for multiple cards.
    - LP: #1083088
  * be2net: Fix to trim skb for padded vlan packets to workaround an ASIC
    Bug
    - LP: #1083088
  * be2net: Fix Endian
    - LP: #1083088
  * be2net: Fix error while toggling autoneg of pause parameters
    - LP: #1083088
  * be2net : Fix die temperature stat for Lancer
    - LP: #1083088
  * be2net: Fix initialization sequence for Lancer
    - LP: #1083088
  * be2net: Activate new FW after FW download for Lancer
    - LP: #1083088
  * be2net: Fix cleanup path when EQ creation fails
    - LP: #1083088
  * be2net: Enable RSS UDP hashing for Lancer and Skyhawk
    - LP: #1083088
  * be2net: dont pull too much data in skb linear part
    - LP: #1083088
  * be2net: Fix VF driver load for Lancer
    - LP: #1083088
  * be2net: Ignore physical link async event for Lancer
    - LP: #1083088
  * be2net: Fix to parse RSS hash from Receive compl...