NULL pointer dereference while umounting usb stick

Bug #1032428 reported by Ricardo Salveti
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Confirmed
Undecided
Unassigned
Nominated for Precise by Ricardo Salveti

Bug Description

Just added a disk, and when umounting it by hand, it gave the following trace:

[673863.654902] sdc: detected capacity change from 4075290624 to 0
[673865.700461] sd 9:0:0:0: [sdc] 7959552 512-byte logical blocks: (4.07 GB/3.79 GiB)
[673865.702694] sd 9:0:0:0: [sdc] No Caching mode page present
[673865.702697] sd 9:0:0:0: [sdc] Assuming drive cache: write through
[673865.705539] sd 9:0:0:0: [sdc] No Caching mode page present
[673865.705542] sd 9:0:0:0: [sdc] Assuming drive cache: write through
[673865.706934] sdc: sdc1 sdc2
[673866.109620] EXT4-fs (sdc2): mounted filesystem with ordered data mode. Opts: (null)
[673911.398198] VFS: Busy inodes after unmount of sdc1. Self-destruct in 5 seconds. Have a nice day...
[673911.398561] BUG: unable to handle kernel NULL pointer dereference at 00000000000000f0
[673911.398598] IP: [<ffffffff8103dc49>] __ticket_spin_lock+0x9/0x30
[673911.398631] PGD 22dcb0067 PUD 22dc96067 PMD 0
[673911.398650] Oops: 0002 [#1] SMP
[673911.398665] CPU 0
[673911.398673] Modules linked in: ftdi_sio pl2303 usbserial ufs qnx4 hfsplus hfs minix ntfs msdos jfs xfs reiserfs ext2 nls_iso8859_1 nls_cp437 vfat fat uas usb_storage snd_usb_audio snd_usbmidi_lib hidp kvm_intel kvm rfcomm bnep parport_pc ppdev binfmt_misc dm_crypt arc4 pcmcia snd_hda_codec_conexant snd_hda_intel snd_hda_codec snd_hwdep snd_pcm psmouse serio_raw snd_seq_midi joydev snd_rawmidi yenta_socket pcmcia_rsrc pcmcia_core snd_seq_midi_event uvcvideo snd_seq videodev v4l2_compat_ioctl32 btusb hid_logitech_dj bluetooth iwlwifi thinkpad_acpi nvram snd_timer snd_seq_device tpm_tis mac80211 snd cfg80211 mac_hid mei(C) soundcore snd_page_alloc lp parport btrfs zlib_deflate libcrc32c usbhid hid firewire_ohci firewire_core crc_itu_t wmi video radeon ttm drm_kms_helper drm e1000e i2c_algo_bit
[673911.399150]
[673911.399158] Pid: 2485, comm: gvfsd-trash Tainted: G WC 3.2.0-26-generic #41-Ubuntu LENOVO 2764CTO/2764CTO
[673911.399218] RIP: 0010:[<ffffffff8103dc49>] [<ffffffff8103dc49>] __ticket_spin_lock+0x9/0x30
[673911.399269] RSP: 0018:ffff88022e359e18 EFLAGS: 00010206
[673911.399289] RAX: 0000000000010000 RBX: 00000000000000f0 RCX: ffff88023bfb2000
[673911.399328] RDX: 0000000000000007 RSI: 0000000000000000 RDI: 00000000000000f0
[673911.399362] RBP: ffff88022e359e18 R08: e000000000000000 R09: 1038000000000000
[673911.399396] R10: fe748f65d4216207 R11: 0000000000000078 R12: ffff88016d70f4f0
[673911.399431] R13: ffff88016d70f5e8 R14: ffff88022a2d2a64 R15: ffff88016d70f4f0
[673911.399463] FS: 00007f345f1117c0(0000) GS:ffff88023bc00000(0000) knlGS:0000000000000000
[673911.399492] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[673911.399518] CR2: 00000000000000f0 CR3: 000000022dcaf000 CR4: 00000000000006f0
[673911.399549] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[673911.399581] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[673911.399610] Process gvfsd-trash (pid: 2485, threadinfo ffff88022e358000, task ffff88022e350000)
[673911.399654] Stack:
[673911.399663] ffff88022e359e28 ffffffff816599ce ffff88022e359e48 ffffffffa0625462
[673911.399706] ffff88016d70f4f0 ffff88016d70f4f0 ffff88022e359e68 ffffffffa0625bcb
[673911.399746] ffff88022e359e68 ffffffffa06296c0 ffff88022e359e98 ffffffff811927b8
[673911.399785] Call Trace:
[673911.399801] [<ffffffff816599ce>] _raw_spin_lock+0xe/0x20
[673911.399829] [<ffffffffa0625462>] fat_detach+0x32/0x80 [fat]
[673911.399852] [<ffffffffa0625bcb>] fat_evict_inode+0x5b/0x70 [fat]
[673911.399880] [<ffffffff811927b8>] evict+0xb8/0x1c0
[673911.399900] [<ffffffff811929a8>] iput_final+0xe8/0x210
[673911.399922] [<ffffffff81192b0e>] iput+0x3e/0x50
[673911.400007] [<ffffffff811b7d30>] fsnotify_destroy_mark+0x170/0x180
[673911.403667] [<ffffffff811b9d2a>] sys_inotify_rm_watch+0x7a/0xd0
[673911.403667] [<ffffffff81661fc2>] system_call_fastpath+0x16/0x1b
[673911.406231] Code: 00 00 48 c7 c1 51 da 03 81 48 c7 c2 4e da 03 81 e9 dd fe ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 55 b8 00 00 01 00 48 89 e5 <f0> 0f c1 07 89 c2 c1 ea 10 66 39 c2 74 13 66 0f 1f 84 00 00 00
[673911.408156] RIP [<ffffffff8103dc49>] __ticket_spin_lock+0x9/0x30
[673911.408156] RSP <ffff88022e359e18>
[673911.408156] CR2: 00000000000000f0
[673911.425840] ---[ end trace c05eef64bf42d647 ]---

Kernel:
Linux evatp 3.2.0-26-generic #41-Ubuntu SMP Thu Jun 14 17:49:24 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux

Ubuntu 12.04 LTS
---
AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.24.
AplayDevices:
 **** List of PLAYBACK Hardware Devices ****
 card 0: Intel [HDA Intel], device 0: CONEXANT Analog [CONEXANT Analog]
   Subdevices: 1/1
   Subdevice #0: subdevice #0
ApportVersion: 2.0.1-0ubuntu11
Architecture: amd64
ArecordDevices:
 **** List of CAPTURE Hardware Devices ****
 card 0: Intel [HDA Intel], device 0: CONEXANT Analog [CONEXANT Analog]
   Subdevices: 1/1
   Subdevice #0: subdevice #0
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC0: rsalveti 2483 F.... pulseaudio
Card0.Amixer.info:
 Card hw:0 'Intel'/'HDA Intel at 0xfc220000 irq 51'
   Mixer name : 'Conexant CX20561 (Hermosa)'
   Components : 'HDA:14f15051,17aa211c,00100000 HDA:14f12c06,17aa2122,00100000'
   Controls : 20
   Simple ctrls : 12
Card29.Amixer.info:
 Card hw:29 'ThinkPadEC'/'ThinkPad Console Audio Control at EC reg 0x30, fw 7VHT16WW-1.06'
   Mixer name : 'ThinkPad EC 7VHT16WW-1.06'
   Components : ''
   Controls : 1
   Simple ctrls : 1
Card29.Amixer.values:
 Simple mixer control 'Console',0
   Capabilities: pswitch pswitch-joined penum
   Playback channels: Mono
   Mono: Playback [on]
DistroRelease: Ubuntu 12.04
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Beta amd64 (20120415)
MachineType: LENOVO 2764CTO
Package: linux (not installed)
PccardctlIdent:
 Socket 0:
   no product info available
PccardctlStatus:
 Socket 0:
   no card
ProcEnviron:
 TERM=xterm
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcFB: 0 radeondrmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-3.2.0-27-generic root=/dev/mapper/vgpool-rootfs ro quiet splash vt.handoff=7
ProcVersionSignature: Ubuntu 3.2.0-27.43-generic 3.2.21
RelatedPackageVersions:
 linux-restricted-modules-3.2.0-27-generic N/A
 linux-backports-modules-3.2.0-27-generic N/A
 linux-firmware 1.79
StagingDrivers: mei
Tags: precise running-unity staging
Uname: Linux 3.2.0-27-generic x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom debian-tor dip lpadmin plugdev sambashare sudo
dmi.bios.date: 08/02/2010
dmi.bios.vendor: LENOVO
dmi.bios.version: 7UET89WW (3.19 )
dmi.board.name: 2764CTO
dmi.board.vendor: LENOVO
dmi.board.version: Not Available
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: Not Available
dmi.modalias: dmi:bvnLENOVO:bvr7UET89WW(3.19):bd08/02/2010:svnLENOVO:pn2764CTO:pvrThinkPadT400:rvnLENOVO:rn2764CTO:rvrNotAvailable:cvnLENOVO:ct10:cvrNotAvailable:
dmi.product.name: 2764CTO
dmi.product.version: ThinkPad T400
dmi.sys.vendor: LENOVO

Revision history for this message
Brad Figg (brad-figg) wrote : Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1032428

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status: New → Incomplete
tags: added: precise
Revision history for this message
Ricardo Salveti (rsalveti) wrote : AcpiTables.txt

apport information

tags: added: apport-collected running-unity staging
description: updated
Revision history for this message
Ricardo Salveti (rsalveti) wrote : AlsaDevices.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : BootDmesg.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : CRDA.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : Card0.Amixer.values.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : Card0.Codecs.codec.0.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : Card0.Codecs.codec.1.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : CurrentDmesg.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : IwConfig.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : Lspci.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : Lsusb.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : PciMultimedia.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : ProcCpuinfo.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : ProcInterrupts.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : ProcModules.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : PulseList.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : RfKill.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : UdevDb.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : UdevLog.txt

apport information

Revision history for this message
Ricardo Salveti (rsalveti) wrote : WifiSyslog.txt

apport information

Changed in linux (Ubuntu):
status: Incomplete → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.