GEOM CD panic reloaded

Hi, GEOM still panics when you insert second CD with non-data tracks,
even with phk's and sos's fixes. Both kernel and world are from Nov 20
0100 UTC

uname -a
FreeBSD hood.oook.cz 5.1-CURRENT FreeBSD 5.1-CURRENT #1: Thu Nov 20
02:59:56 CET 2003     

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x1c
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc05a5e53
stack pointer           = 0x10:0xde007c68
frame pointer           = 0x10:0xde007c80
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 2 (g_event)
trap number             = 12
panic: page fault
cpuid = 0; 


(kgdb) bt
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:240
#1  0xc05886d1 in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:372
#2  0xc0588b1f in panic () at /usr/src/sys/kern/kern_shutdown.c:550
#3  0xc070b846 in trap_fatal (frame=0xde007c28, eva=0) at /usr/src/sys/i386/i386/trap.c:821
#4  0xc070b4c2 in trap_pfault (frame=0xde007c28, usermode=0, eva=28) at /usr/src/sys/i386/i386/trap.c:735
#5  0xc070b01d in trap (frame=
      {tf_fs = 24, tf_es = 16, tf_ds = 16, tf_edi = 0, tf_esi = -969426560, tf_ebp = -570393472, tf_isp = -570393516, tf_ebx = -970579488, tf_edx = 0, tf_ecx = -1065553212, tf_eax = 1, tf_trapno = 12, tf_err = 0, tf_eip = -1067819437, tf_cs = 8, tf_eflags = 66051, tf_esp = -968736384, tf_ss = -570393448}) at /usr/src/sys/i386/i386/trap.c:420
#6  0xc06f6ff8 in calltrap () at {standard input}:94
#7  0xc054ece8 in g_destroy_provider (pp=0xc62621e0) at /usr/src/sys/geom/geom_subr.c:426
#8  0xc054bc95 in g_orphan_register (pp=0xc637b980) at /usr/src/sys/geom/geom_event.c:143
#9  0xc054bdbc in one_event () at /usr/src/sys/geom/geom_event.c:169
#10 0xc054bfe5 in g_run_events () at /usr/src/sys/geom/geom_event.c:202
#11 0xc054d015 in g_event_procbody () at /usr/src/sys/geom/geom_kern.c:134
#12 0xc0570f60 in fork_exit (callout=0xc054cff0 <g_event_procbody>, arg=0x0, frame=0x0) at /usr/src/sys/kern/kern_fork.c:793


(kgdb) up 7
#7  0xc054ece8 in g_destroy_provider (pp=0xc62621e0) at /usr/src/sys/geom/geom_subr.c:426
426             devstat_remove_entry(pp->stat);
(kgdb) print *pp
$1 = {name = 0x0, provider = {le_next = 0x0, le_prev = 0x0}, geom = 0x0, consumers = {lh_first = 0x0}, acr = 0, acw = 0, ace = 0, error = 0, orphan = {tqe_next = 0x0, tqe_prev = 0x0}, index = 0, 
  mediasize = 0, sectorsize = 0, stripesize = 0, stripeoffset = 0, stat = 0x0, nstart = 0, nend = 0, flags = 0}

(kgdb) print *gp
$4 = {name = 0xc6219af0 "acd0", class = 0xc077aaa0, geom = {le_next = 0x0, le_prev = 0xc077aac4}, consumer = {lh_first = 0x0}, provider = {lh_first = 0xc6424580}, geoms = {tqe_next = 0xc637bc00, 
    tqe_prev = 0xc236bc98}, rank = 1, start = 0xc0494fb0 <acd_geom_start>, spoiled = 0, dumpconf = 0, access = 0xc0493fc0 <acd_geom_access>, orphan = 0, ioctl = 0xc0494230 <acd_geom_ioctl>, 
  softc = 0xc6253800, flags = 0}

(kgdb) up
#8  0xc054bc95 in g_orphan_register (pp=0xc637b980) at /usr/src/sys/geom/geom_event.c:143
143                     g_destroy_provider(pp);
(kgdb) print *pp
$5 = {name = 0xc6219af0 "acd0", provider = {le_next = 0xc077aaa0, le_prev = 0x0}, geom = 0xc077aac4, consumers = {lh_first = 0x0}, acr = -968735360, acw = -969425920, ace = -1036600168, error = 1, 
  orphan = {tqe_next = 0xc0494fb0, tqe_prev = 0x0}, index = 0, mediasize = 3226025920, sectorsize = 3226026544, stripesize = 3324327936, stripeoffset = 0, stat = 0x0, nstart = 0, nend = 0, flags = 0}


This looks painfully similar to panic I was reporting on Nov 10.

How to reproduce:
1. Insert non-data CD like VideoCD
2. cdcontrol -f /dev/acd0 info
3. Play it (mplayer -vcd 2)
4. Insert ordinary data CD
5. cdcontrol -f /dev/acd0 info

It prints correct information of new CD and instantly panics.

-- 
Pav Lucistnik <pav_at_FreeBSD.org>
              <pav_at_oook.cz>