[xander-lin]

Summary

Luks2.lock() unmounts what is mounted below the mapper before closing it, but it only looks one
level down:

lsblk_info = get_lsblk_info(self.luks_dev_path)

for child in lsblk_info.children:
	for mountpoint in child.mountpoints:
		debug(f'Unmounting {mountpoint}')
		umount(mountpoint, recursive=True)

	debug(f'Closing crypt device {child.name}')
	SysCommand(f'cryptsetup close {child.name}')

On LUKS-on-LVM nothing is mounted at that level. The layout looks like this:

sda1                    part    <- luks_dev_path
└─cryptlvm             crypt   <- child
  └─vg                  lvm     <- child of the child
    ├─vg-root           lvm     <- this is where / is mounted
    └─vg-home           lvm     <- this is where /home is mounted

The mountpoints are on the logical volumes, two levels below the mapper, so child.mountpoints is
empty for every child that matters. Nothing is unmounted, and cryptsetup close refuses to close a
mapper that still has a mounted filesystem below it:

cryptsetup close cryptlvm: Device or resource busy

lock() is what DeviceHandler.umount_all_existing() calls for every existing CRYPTO_LUKS
partition before a new installation starts, so this is the path taken when installing over a
previous LUKS-on-LVM system - the partition cannot be released and the installation stops.

Fix

Walk the whole subtree below the mapper and unmount children before parents, so the order holds
however deep the stack is:

--- a/archinstall/lib/disk/luks.py
+++ b/archinstall/lib/disk/luks.py
+def _lsblk_subtree(info: LsblkInfo) -> list[LsblkInfo]:
+	"""The device and everything stacked below it, parents before children."""
+	nodes = [info]
+
+	for child in info.children:
+		nodes.extend(_lsblk_subtree(child))
+
+	return nodes
+
@@ class Luks2
 	for child in lsblk_info.children:
-		for mountpoint in child.mountpoints:
-			debug(f'Unmounting {mountpoint}')
-			umount(mountpoint, recursive=True)
+		# Everything mounted below the child has to go before the child itself: on
+		# LUKS-on-LVM the mountpoints live on the logical volumes, which are
+		# grandchildren of the mapper, so looking one level down left them mounted
+		# and `cryptsetup close` then found the device busy.
+		for node in reversed(_lsblk_subtree(child)):
+			debug(f'Unmounting {node.name}')
+			umount(node.path, recursive=True)

Unmounting is done by device path rather than by mountpoint, so a mountpoint that lsblk reports as
[SWAP] - a display marker, not a path - cannot reach umount().

Reproducer

The device tree above is what lsblk reports for a LUKS container holding an LVM volume group. To
see the difference without building one, the shape can be handed to lock() directly:

from pathlib import Path
from unittest.mock import MagicMock, patch

from archinstall.lib.disk.luks import Luks2
from archinstall.lib.models.device import LsblkInfo

def node(name, children=None):
	info = MagicMock(spec=LsblkInfo)
	info.name = name
	info.path = Path(f'/dev/{name}')
	info.mountpoints = []
	info.children = children or []
	return info

root_lv = node('vg-root'); root_lv.mountpoints = [Path('/mnt/archinstall')]
home_lv = node('vg-home'); home_lv.mountpoints = [Path('/mnt/archinstall/home')]
vg = node('vg', [root_lv, home_lv])

lsblk_root = MagicMock(spec=LsblkInfo)
lsblk_root.children = [vg]

luks = object.__new__(Luks2)
luks.luks_dev_path = Path('/dev/sda1')

umounted = []

def record(path, **_kwargs):
	umounted.append(Path(path))

with (
	patch('archinstall.lib.disk.luks.get_lsblk_info', return_value=lsblk_root),
	patch('archinstall.lib.disk.luks.umount', side_effect=record),
	patch('archinstall.lib.disk.luks.SysCommand'),
):
	luks.lock()

# the first entry is the mapper itself, released at the top of lock()
print('unmounted below the mapper:', [str(p) for p in umounted if p != luks.luks_dev_path])

On master:

unmounted below the mapper: []

With the patch:

unmounted below the mapper: ['/dev/vg-home', '/dev/vg-root', '/dev/vg']

Verification boundary

This was verified with a stubbed device tree, not by building a real LUKS-on-LVM stack - the
machine this was written on has no lvm2. The lsblk shape it relies on is the one in the
diagram above, which is what lsblk reports for sda1 -> cryptlvm -> vg -> vg-root. Anyone
reviewing with lvm2 available can confirm it in a few commands; the code path is the same one.

Tests

tests/test_luks_lock_subtree.py:

• the subtree walk returns the device and its grandchildren, parents first;
• lock() unmounts the logical volumes under a mapper (this is what fails on master);
• lock() still runs cryptsetup close for each child.

[Torxed]

I sense this is LLM contributions, but the isssue is valid and the fix seems reasonable.
But I can't merge it until tested on LVM as well.