Re: Unionfs in -mm

[Jason Lunz <lunz@falooley.org>]

On Mon, Jan 08, 2007 at 07:44:56PM -0500, Josef Sipek wrote:
> Today is a good day!
>
> Andrew Morton included a minimal version of Unionfs in his -mm tree.
>
> This minimal version of the code lacks some of the features in the full
> fledged version, however we'll be cleaning them up and adding them in one at
> a time.
>
> Thank you all who helped to make this possible!

and thanks to you all for the hard work.

But I have a bug to report. I'm trying out yesterday's 24-patch series
on 2.6.20-rc4 (http://thread.gmane.org/gmane.linux.kernel/481661).

The root filesystem is a union of a ro squashfs and a rw tmpfs.
The initramfs sets it up something like this:

mkdir /os
mount -r -t squashfs /dev/ram0 /os

mkdir /cow
mount -t tmpfs -o mode=0755 tmpfs /cow

mount -w -o dirs=/cow=rw:/os=ro -t unionfs unionfs /root

The system works normally, except that it crashes reliably whenever I
run this program:

#! /usr/bin/python

import glob
import os
import subprocess
import sys

def processes():
    'Returns a iterator over (pid, exe) tuples for each running process.'

    # the kernel appends this to the link target when the running exe has been
    # unlinked
    unlinked_suffix = ' (deleted)'

    subprocess.call('ps axf 1>&2', shell=True)
    subprocess.call('ls -l /proc/* 1>&2', shell=True)

    for ed in glob.glob('/proc/*'):
        print >>sys.stderr, 'looking at %s' % ed
        try:
            pid = int(os.path.basename(ed))
        except ValueError:
            # probably /proc/self or something
            continue

        print >>sys.stderr, '%s has pid %s' % (ed, pid)

        try:
            l = os.path.join(ed, 'exe')
            print >>sys.stderr, 'reading %s' % l
            targ = os.readlink(l)
        except OSError:
            # building a list of running processes is inherently racy, oh well
            continue
        
        if targ.endswith(unlinked_suffix):
            targ = targ[:-len(unlinked_suffix)]

        yield (pid, targ)

for p, e in processes():
    print >>sys.stderr, p, e


here's the oops from running under qemu. More or less the same thing
happens in UML kernels too:

BUG: unable to handle kernel NULL pointer dereference at virtual address 00000010
 printing eip:
c015d701
*pde = 00000000
Oops: 0000 [#1]
SMP
Modules linked in: button ac battery bridge llc unionfs squashfs zlib_inflate rd ext2 dm_mod ide_cd cdrom ide_disk mousedev parport_pc parport floppy serio_raw psmouse piix generic ide_core ata_generic libata pcspkr ne2k_pci 8390 i2c_piix4 i2c_core scsi_mod evdev fan
CPU:    0
EIP:    0060:[<c015d701>]    Not tainted VLI
EFLAGS: 00200202   (2.6.20-rc4-x86 #0)
EIP is at __d_path+0x8f/0x154
eax: c68ad42c   ebx: c364dffe   ecx: 00000000   edx: 00001000
esi: c7a81da0   edi: c6ce6a9c   ebp: c364dfff   esp: c72f5ec8
ds: 007b   es: 007b   ss: 0068
Process ls (pid: 1804, ti=c72f5000 task=c7a91ab0 task.ti=c72f5000)
Stack: c68ad42c 00000000 c6ce6a9c 00000044 00000001 00000fff c68ad42c c7a81da0
       c364d000 00000000 c015ec0e c7a81da0 c364d000 00001000 c6ce6a9c c6ce6a9c
       c364d000 fffffff4 00000000 c01774b3 00001000 00000001 08061290 00000000
Call Trace:
 [<c015ec0e>] d_path+0x91/0xbd
 [<c01774b3>] proc_pid_readlink+0x76/0xdc
 [<c015246e>] sys_readlinkat+0x83/0x9e
 [<c01524b0>] sys_readlink+0x27/0x2b
 [<c0102ccc>] syscall_call+0x7/0xb
 =======================
Code: ff 2f eb 08 8b 7c 24 10 89 7c 24 08 8b 04 24 39 44 24 08 75 0e 8b 54 24 2c 39 54 24 04 0f 84 c3 00 00 00 8b 7c 24 08 8b 4c 24 04 <3b> 79 10 74 0b 8b 47 18 89 44 24 10 39 c7 75 29 b8 80 f0 2e c0
EIP: [<c015d701>] __d_path+0x8f/0x154 SS:ESP 0068:c72f5ec8

any ideas?

Jason