kernel panic when umouting rootfs

[Nicolas Dichtel]

This upstream commit is missing:
da362b09e42e umount: Do not allow unmounting rootfs.
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=da362b09e42e

The commit log of this patch explains how to reproduce the kernel panic (see below).

Note that this patch depends on
5ff9d8a65ce8 vfs: Lock in place mounts from more privileged users
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5ff9d8a65ce8

root@ubuntu1404:~# uname -a
Linux ubuntu1404 3.13.0-71-generic #114-Ubuntu SMP Tue Dec 1 02:34:22 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
root@ubuntu1404:~# ./a.out
[ 199.274374] ------------[ cut here ]------------
[ 199.274865] kernel BUG at /build/linux-hEVYOL/linux-3.13.0/fs/pnode.c:372!
[ 199.275473] invalid opcode: 0000 [#1] SMP
[ 199.275850] Modules linked in: nfsv3 rpcsec_gss_krb5 nfsv4 crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ppdev aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd serio_raw nfsd auth_rpcgss parport_pc nfs_acl nfs i2c_piix4 mac_hid lockd sunrpc fscache lp parport psmouse pata_acpi floppy
[ 199.276005] CPU: 0 PID: 893 Comm: a.out Not tainted 3.13.0-71-generic #114-Ubuntu
[ 199.276005] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014
[ 199.276005] task: ffff88003ba6b000 ti: ffff88003ad8e000 task.ti: ffff88003ad8e000
[ 199.276005] RIP: 0010:[<ffffffff811eb4d3>] [<ffffffff811eb4d3>] propagate_umount+0x143/0x150
[ 199.276005] RSP: 0018:ffff88003ad8fe90 EFLAGS: 00010246
[ 199.276005] RAX: ffff88003d9b41a0 RBX: 0000000000000002 RCX: ffff88003d9b41a0
[ 199.276005] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88003ad8fec0
[ 199.276005] RBP: ffff88003ad8fea8 R08: ffff88003d9b4190 R09: ffff88003ad8fec0
[ 199.276005] R10: ffffffff811ce392 R11: ffffea0000e72e00 R12: ffff88003d9b4140
[ 199.276005] R13: ffff88003d9b4140 R14: ffff88003d9b4140 R15: 0000000000000000
[ 199.276005] FS: 00007f72c3f0c740(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000
[ 199.276005] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 199.276005] CR2: 00007f72c3a2d110 CR3: 000000003d3fd000 CR4: 00000000001407f0
[ 199.276005] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 199.276005] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 199.276005] Stack:
[ 199.276005] 0000000000000002 ffff88003d9b4160 ffff88003e035000 ffff88003ad8fed8
[ 199.276005] ffffffff811ddfcc 00000002ffffff9c ffff88003d9b4140 0000000000000002
[ 199.276005] ffff88003d9b4160 ffff88003ad8ff38 ffffffff811de9cf ffffffff811ce392
[ 199.276005] Call Trace:
[ 199.276005] [<ffffffff811ddfcc>] umount_tree+0x25c/0x270
[ 199.276005] [<ffffffff811de9cf>] do_umount+0x12f/0x320
[ 199.276005] [<ffffffff811ce392>] ? final_putname+0x22/0x50
[ 199.276005] [<ffffffff811ce599>] ? putname+0x29/0x40
[ 199.276005] [<ffffffff811df75b>] SyS_umount+0x10b/0x120
[ 199.276005] [<ffffffff8173545d>] system_call_fastpath+0x1a/0x1f
[ 199.276005] Code: 50 08 48 89 02 49 89 45 08 e9 57 ff ff ff 66 2e 0f 1f 84 00 00 00 00 00 4c 89 e6 4c 89 e7 e8 d5 f6 ff ff 48 89 c3 e9 19 ff ff ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 0f 1f 44 00 00 55 b8 01
[ 199.276005] RIP [<ffffffff811eb4d3>] propagate_umount+0x143/0x150
[ 199.276005] RSP <ffff88003ad8fe90>
[ 199.297648] ---[ end trace 6262a5eb9740f9d0 ]---

[Brad Figg (brad-figg)]

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1541313

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Nicolas Dichtel (nicolas-dichtel)]

It's a kernel panic, so yes, I'm unable to do anything after the bug.

[Joseph Salisbury (jsalisbury)]

I built a Trusty test kernel with a cherry-pick of commit da362b09e42e. The test kernel can be downloaded from:

http://kernel.ubuntu.com/~jsalisbury/lp1541313/

Can you test this kernel and see if it resolves this bug?

Thanks in advance!

[Nicolas Dichtel (nicolas-dichtel)]

It does, thank you!

[Brad Figg (brad-figg)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-trusty' to 'verification-done-trusty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Nicolas Dichtel (nicolas-dichtel)]

Tests are ok here.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.13.0-83.127

---------------
linux (3.13.0-83.127) trusty; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1555839

  [ Florian Westphal ]

  * SAUCE: [nf,v2] netfilter: x_tables: don't rely on well-behaving
    userspace
    - LP: #1555338

linux (3.13.0-82.126) trusty; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1554732

  [ Upstream Kernel Changes ]

  * Revert "drm/radeon: call hpd_irq_event on resume"
    - LP: #1554608
  * net: generic dev_disable_lro() stacked device handling
    - LP: #1547680

linux (3.13.0-81.125) trusty; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1552316

  [ Upstream Kernel Changes ]

  * Revert "firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6"
    - LP: #1551419
  * bcache: Fix a lockdep splat in an error path
    - LP: #1551327

linux (3.13.0-80.124) trusty; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1548519

  [ Andy Whitcroft ]

  * [Debian] hv: hv_set_ifconfig -- convert to python3
    - LP: #1506521
  * [Debian] hv: hv_set_ifconfig -- switch to approved indentation
    - LP: #1540586
  * [Debian] hv: hv_set_ifconfig -- fix numerous parameter handling issues
    - LP: #1540586

  [ Dan Streetman ]

  * SAUCE: nbd: ratelimit error msgs after socket close
    - LP: #1505564

  [ Upstream Kernel Changes ]

  * Revert "workqueue: make sure delayed work run in local cpu"
    - LP: #1546320
  * [media] gspca: ov534/topro: prevent a division by 0
    - LP: #1542497
  * [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode
    - LP: #1542497
  * tools lib traceevent: Fix output of %llu for 64 bit values read on 32
    bit machines
    - LP: #1542497
  * KVM: x86: correctly print #AC in traces
    - LP: #1542497
  * drm/radeon: call hpd_irq_event on resume
    - LP: #1542497
  * xhci: refuse loading if nousb is used
    - LP: #1542497
  * arm64: Clear out any singlestep state on a ptrace detach operation
    - LP: #1542497
  * time: Avoid signed overflow in timekeeping_get_ns()
    - LP: #1542497
  * rtlwifi: fix memory leak for USB device
    - LP: #1542497
  * wlcore/wl12xx: spi: fix oops on firmware load
    - LP: #1542497
  * EDAC, mc_sysfs: Fix freeing bus' name
    - LP: #1542497
  * EDAC: Don't try to cancel workqueue when it's never setup
    - LP: #1542497
  * EDAC: Robustify workqueues destruction
    - LP: #1542497
  * powerpc: Make value-returning atomics fully ordered
    - LP: #1542497
  * powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered
    - LP: #1542497
  * dm space map metadata: remove unused variable in brb_pop()
    - LP: #1542497
  * dm thin: fix race condition when destroying thin pool workqueue
    - LP: #1542497
  * futex: Drop refcount if requeue_pi() acquired the rtmutex
    - LP: #1542497
  * drm/radeon: clean up fujitsu quirks
    - LP: #1542497
  * mmc: sdio: Fix invalid vdd in voltage switch power cycle
    - LP: #1542497
  * mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off()
    - LP: #1542497
  * udf: limit the maximum number of indirect extents in a row
    - LP: #1542497
  * nfs: Fix race in __update_open_stateid...