[Unionfs] BUG: unable to handle kernel NULL pointer dereference with unionfs

[Abelenda]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I have the same bug as Rene Mayrhofer originally posted.

I run a vanilla kernel 2.6.22.1 with nothing really special

I applied some patches

unionfs-2.6.22.1-u1
squashfs-3.2
the mactel patches (yes I am running a macbook) found here 
https://mactel-linux.svn.sourceforge.net/svnroot/mactel-linux/trunk/kernel/mactel-patches-2.6.22/
(I know this changes often, but I don't think this is related)

(the patches were applied in this order)

My kernel config is attached.

the way to get the bug is quite the same as for Rene, I have a squashfs
image mounted ro and use unionfs to get write layer on tempfs (/dev/shm)

Here is the sequence of commands to get the bug :

- - First I mount the squashfs image 
   mount -rt squashfs -o
loop,nodev,noexec  /home/portage/tree/portage-current.sqfs /usr/portage/

- - then I create a sub-directory in /dev/shm  named  portage-rw


- - after that I mount the unionfs layers

mount -t unionfs -o
nodev,noexec,dirs=/dev/shm/portage-rw=rw:/usr/portage=ro
unionfs /usr/portage



then I do a rsync (get some info from unionfs :

unionfs: unhashed dentry being revalidated: bsdtar
unionfs: unhashed dentry being revalidated: files

)




- - and when I try to make another squashfs image using

mksquashfs /usr/portage /home/portage/tree/portage-new.sqfs
- -no-duplicates

I get the oops :


BUG: unable to handle kernel NULL pointer dereference at virtual
address 00000000 printing eip:
00000000
*pde = 00000000
Oops: 0000 [#1]
PREEMPT SMP 
Modules linked in: unionfs nfs lockd sunrpc ath_pci(F) wlan_wep i915
drm squashfs wlan_scan_sta ath_rate_sample(F) appletouch appleir wlan
ath_hal(P) intel_agp agpgart CPU:    0 EIP:    0060:[<00000000>]
Tainted: PF      VLI EFLAGS: 00010246   (2.6.22.1-mactel-by-Aelia #4)
EIP is at _stext+0x3fefed38/0x14
eax: f5610180   ebx: 00000000   ecx: c170b940   edx: c12aa760
esi: c12aa760   edi: cf262a14   ebp: 00000000   esp: ec455cc8
ds: 007b   es: 007b   fs: 00d8  gs: 0033  ss: 0068
Process mksquashfs (pid: 10871, ti=ec454000 task=f15ad540
task.ti=ec454000) Stack: c014280e 000000d0 00000000 f5610180 cf262964
f5610180 c116a4e0 c014439b f5610180 c116a4e0 f8d1cc4d f5610180 c116a4e0
f0226a80 00000000 00000000 c0142756 c116a4e0 00000000 df075768 00000002
c0147c84 000000d0 f0226a80 Call Trace:
 [<c014280e>] read_cache_page_async+0x73/0x113
 [<c014439b>] read_cache_page+0x10/0x3f
 [<f8d1cc4d>] unionfs_readpage+0x82/0x251 [unionfs]
 [<c0142756>] add_to_page_cache+0x6f/0x8c
 [<c0147c84>] __do_page_cache_readahead+0x187/0x1dc
 [<c0147d25>] blockable_page_cache_readahead+0x4c/0x9f
 [<c0147ed7>] page_cache_readahead+0xc6/0x1a4
 [<c0142cd2>] do_generic_mapping_read+0x14d/0x457
 [<c01449ff>] generic_file_aio_read+0x164/0x195
 [<c014235b>] file_read_actor+0x0/0xd7
 [<f8d13078>] unionfs_aio_read+0x51/0x9e [unionfs]
 [<c015c101>] do_sync_read+0xc7/0x10a
 [<f8d1b8c2>] unionfs_file_revalidate+0x936/0x943 [unionfs]
 [<c015ae1d>] __dentry_open+0x10f/0x1a3
 [<c0131624>] autoremove_wake_function+0x0/0x35
 [<c015af2b>] nameidata_to_filp+0x24/0x33
 [<c015af6c>] do_filp_open+0x32/0x39
 [<f8d13107>] unionfs_read+0x42/0x7d [unionfs]
 [<f8d130c5>] unionfs_read+0x0/0x7d [unionfs]
 [<c015c864>] vfs_read+0x88/0x10a
 [<c015cc60>] sys_read+0x41/0x67
 [<c0103d42>] sysenter_past_esp+0x5f/0x85
 =======================
Code:  Bad EIP value.
EIP: [<00000000>] _stext+0x3fefed38/0x14 SS:ESP 0068:ec455cc8

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGmP9+e5rxxdgHPpYRAkwvAKCJ8+cF+CGUA05xxlArEWvC3GQCnQCfdiEz
yfi8O6bhqMKEbzNgql63IX0=
=YxSd
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: config.gz
Type: application/x-gzip
Size: 9650 bytes
Desc: not available
Url : http://www.fsl.cs.sunysb.edu/pipermail/unionfs/attachments/20070714/b47393f5/config-0001.bin