deadc0de panic in geom_io: mount -uw after double read-only mount

From: Bjoern A. Zeeb <bzeeb-lists_at_lists.zabbadoz.net>
Date: Sat, 28 Jan 2006 15:42:06 +0000 (UTC)
Hi,

I had for some unknown reason a file system mounted twice
(readonly) to the same mount point. So I umounted one instance
and after that tried to mount instance left read-write with
mount -uw  *boom*

I guess that this was never supposed to work?

In case someone wants to lokk into this the bt full shows some
0xdeadc0dedeadc0de in geom_io.c.

db> where
Tracing pid 29052 tid 100116 td 0xffffff005e4e2000
g_io_request() at g_io_request+0x89
g_vfs_strategy() at g_vfs_strategy+0x58
ffs_geom_strategy() at ffs_geom_strategy+0xdb
bufwrite() at bufwrite+0x1af
ffs_bufwrite() at ffs_bufwrite+0x308
ffs_sbupdate() at ffs_sbupdate+0x1ac
ffs_mount() at ffs_mount+0xabb
vfs_domount() at vfs_domount+0x5c2
vfs_donmount() at vfs_donmount+0x471
nmount() at nmount+0xad
syscall() at syscall+0x31a
Xfast_syscall() at Xfast_syscall+0xa8
--- syscall (378, FreeBSD ELF64, nmount), rip = 0x8006847bc, rsp = 0x7fffffffd278, rbp = 0x8020001b0 ---
db> show msgbuf
msgbufp = 0xffffffff80c20fe0
magic = 63062, size = 65504, r= 40099, w = 40509, ptr = 0xffffffff80c11000, cksum= 3107452

Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer     = 0x8:0xffffffff803dbbf9
stack pointer           = 0x10:0xffffffffb4dfd560
frame pointer           = 0x10:0xffffffffb4dfd5a0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 29052 (mount)

db> show alllocks
Process 29052 (mount) thread 0xffffff005e4e2000 (100116)
exclusive sleep mutex Giant r = 1 (0xffffffff808ef660) locked _at_ /local/building/freebsd/HEAD/sys/kern/vfs_mount.c:610

0xffffffff803dbbf9 is in g_io_request (/local/building/freebsd/HEAD/sys/geom/geom_io.c:287).
282             KASSERT(bp->bio_data != NULL, ("NULL bp->data in g_io_request"));
283             pp = cp->provider;
284             KASSERT(pp != NULL, ("consumer not attached in g_io_request"));
285 
286             if (bp->bio_cmd & (BIO_READ|BIO_WRITE|BIO_DELETE)) {
287                     KASSERT(bp->bio_offset % cp->provider->sectorsize == 0,
288                         ("wrong offset %jd for sectorsize %u",
289                         bp->bio_offset, cp->provider->sectorsize));
290                     KASSERT(bp->bio_length % cp->provider->sectorsize == 0,
291                         ("wrong length %jd for sectorsize %u",



(kgdb) bt full
#0  doadump () at pcpu.h:172
No locals.
#1  0xffffffff801dcd11 in db_fncall (dummy1=0, dummy2=0, dummy3=0, dummy4=0x0)
     at /local/building/freebsd/HEAD/sys/ddb/db_command.c:489
 	fn_addr = -2143170480
 	args = {-2138227928, 120, -2138225600, 9, -1260400192, -2145523509,
   -2138947712, -2140041168, -2140041112, -2138227928}
 	nargs = 0
 	retval = -1260400240
 	t = 0
#2  0xffffffff801dca60 in db_command (last_cmdp=0xffffffff808d3b28,
     cmd_table=0x0, aux_cmd_tablep=0xffffffff80719030,
     aux_cmd_tablep_end=0xffffffff80719068)
     at /local/building/freebsd/HEAD/sys/ddb/db_command.c:404
 	cmd = (struct command *) 0xffffffff808242c0
 	t = 0
 	modif = " впДџџџџ#Ic\200џџџџј\003\000\000\000\000\000\000\r\000\000\000\000\000\000\000PвпДџџџџNKc\200џџџџ\f\000\017\003\v\000\000\000\001\000\000\000\000\000\000\000Р{\227\200џџџџ_at_D\215\200џџџџpвпДџџџџЌ\037F\200џџџџx\000\000\000\000\000\000\000x\000\000\000\000\000\000\000\200впДџџџџ"
 	addr = -1260400160
 	count = 1021
 	have_addr = 0
 	result = 0
#3  0xffffffff801dcb87 in db_command_loop ()
     at /local/building/freebsd/HEAD/sys/ddb/db_command.c:455
No locals.
#4  0xffffffff801ded9b in db_trap (type=-1260399904, code=0)
     at /local/building/freebsd/HEAD/sys/ddb/db_main.c:221
 	jb = {{_jb = {-1260399904, -1260399928, -1260399792, 0, 9, 1, 0,
       -2145522386, 9, 1, -1260399792, -2142999036}}}
 	prev_jb = (void *) 0x0
 	bkpt = 0
#5  0xffffffff8043e11c in kdb_trap (type=9, code=0, tf=0xffffffffb4dfd4b0)
     at /local/building/freebsd/HEAD/sys/kern/subr_kdb.c:485
 	did_stop_cpus = 1
 	handled = -1260399440
#6  0xffffffff80610a4b in trap_fatal (frame=0xffffffffb4dfd4b0, eva=0)
     at /local/building/freebsd/HEAD/sys/amd64/amd64/trap.c:679
 	rflags = 514
 	code = 514
 	type = 9
 	ss = 514
 	esp = 0
 	softseg = {ssd_base = 0, ssd_limit = 1048575, ssd_type = 27,
   ssd_dpl = 0, ssd_p = 1, ssd_long = 1, ssd_def32 = 0, ssd_gran = 1}
 	msg = 0x0
#7  0xffffffff80610435 in trap (frame=
       {tf_rdi = -1097751339008, tf_rsi = -2401050962867404578, tf_rdx = -1097929449472, tf_rcx = 0, tf_r8 = -2140324608, tf_r9 = 582, tf_rax = 10240, tf_rbx = -1097751339008, tf_rbp = -1260399200, tf_r10 = 68719476735, tf_r11 = -1097465537792, tf_r12 = -1098180438016, tf_r13 = -2401050962867404578, tf_r14 = -1613071048, tf_r15 = 0, tf_trapno = 9, tf_addr = 0, tf_flags = -1097365179744, tf_err = 0, tf_rip = -2143437831, tf_cs = 8, tf_rflags = 66050, tf_rsp = -1260399248, tf_ss = 16}) at /local/building/freebsd/HEAD/sys/amd64/amd64/trap.c:492
 	td = (struct thread *) 0xffffff005e4e2000
 	p = (struct proc *) 0xffffff0053194000
 	sticks = 4294967295
 	i = 0
 	ucode = 0
 	type = 9
 	code = 0
 	addr = -2138067680
 	ksi = {ksi_link = {tqe_next = 0xffffffff806e0580,
     tqe_prev = 0xffffffff808fad20}, ksi_info = {si_signo = -1260399568,
     si_errno = -1, si_code = -2143207168, si_pid = -1, si_uid = 2154694016,
     si_status = -1, si_addr = 0xffffff005e7ad0d0, si_value = {
       sival_int = -1260399456, sival_ptr = 0xffffffffb4dfd4a0}, _reason = {
       _fault = {_trapno = -2142979170}, _timer = {_timerid = -2142979170,
         _overrun = -1}, _mesgq = {_mqd = -2142979170}, _poll = {
         _band = -2142979170}, __spare__ = {__spare1__ = -2142979170,
         __spare2__ = {-2140147168, -1, 1582178304, -256, -2138067680, -1,
           915}}}}, ksi_flags = 0, ksi_sigq = 0xffffffff808fad20}
#8  0xffffffff805fc0eb in calltrap ()
     at /local/building/freebsd/HEAD/sys/amd64/amd64/exception.S:168
No locals.
#9  0xffffffff803dbbf9 in g_io_request (bp=0xffffff0068ebe000,
     cp=0xffffff004f585800)
     at /local/building/freebsd/HEAD/sys/geom/geom_io.c:287
 	pp = (struct g_provider *) 0xdeadc0dedeadc0de

                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

#10 0xffffffff803df8d8 in g_vfs_strategy (bo=0xffffff0068ebe000,
     bp=0xffffffff9fda7d38)
     at /local/building/freebsd/HEAD/sys/geom/geom_vfs.c:106
 	cp = (struct g_consumer *) 0xffffff004f585800
 	bip = (struct bio *) 0xffffff0068ebe000
#11 0xffffffff805ba4bb in ffs_geom_strategy (bo=0xffffff005e7ad138,
     bp=0xffffffff9fda7d38)
     at /local/building/freebsd/HEAD/sys/ufs/ffs/ffs_vfsops.c:1743
 	vp = (struct vnode *) 0xffffff005e7ad000
 	error = 10240
#12 0xffffffff80477a0f in bufwrite (bp=0xffffffff9fda7d38) at buf.h:419
 	oldflags = 536870912
#13 0xffffffff805ba3d8 in ffs_bufwrite (bp=0xffffffff9fda7d38)
     at /local/building/freebsd/HEAD/sys/ufs/ffs/ffs_vfsops.c:1712
 	newbp = (struct buf *) 0xffffff006140e800
#14 0xffffffff805b9cbc in ffs_sbupdate (mp=0xffffff0001186600, waitfor=1)
     at buf.h:405
 	fs = (struct fs *) 0xffffff006140e800
 	sbbp = (struct buf *) 0xffffffff9fea7570
 	bp = (struct buf *) 0xffffffff9fda7d38
 	blks = 5
 	space = (void *) 0xffffffff86fa1800
 	i = 0
 	size = 10240
 	error = 10240
 	allerror = 0
#15 0xffffffff805b741b in ffs_mount (mp=0xffffff0000fb7c00,
     td=0xffffff005e4e2000)
     at /local/building/freebsd/HEAD/sys/ufs/ffs/ffs_vfsops.c:304
 	devvp = (struct vnode *) 0xffffff005e7ad000
 	ump = (struct ufsmount *) 0xffffff0001186600
 	fs = (struct fs *) 0xffffff006140e800
 	error = 0
 	flags = -559038242
 	accessmode = 8192
 	ndp = {ni_dirp = 0xffffff007ff0ee00 "\035Гm\200џџџџ\020а№\177",
   ni_segflg = 2146488320, ni_startdir = 0xffffffffb4dfd820,
   ni_rootdir = 0xffffffff805cea98, ni_topdir = 0xffffff0007e7ee08,
   ni_vp = 0x40, ni_dvp = 0xffffffffb4dfd820,
   ni_pathlen = 18446744071566332830,
   ni_next = 0x40 <Address 0x40 out of bounds>,
   ni_loopcnt = 18446742974330563136, ni_cnd = {
     cn_nameiop = 18446744072449153104, cn_flags = 18446744071566333463,
     cn_thread = 0xffffffffb4dfd870, cn_cred = 0xffffff0007e7ea40,
     cn_lkflags = 2058786432, cn_pnbuf = 0xffffff006e675510 "_at_:кa",
     cn_nameptr = 0xffffffffb4dfd870 " ипДџџџџ", cn_namelen = -2142748113,
     cn_consume = -1099495146496}}
 	export = {ex_flags = 128, ex_root = 4294967294, ex_anon = {
     cr_version = 2151988126, cr_uid = 4294967295, cr_ngroups = -10384,
     cr_groups = {4294967295, 2151986960, 4294967295, 2156965056, 4294967295,
       1582178304, 4294967040, 3034568624, 4294967295, 582, 0, 2156962560,
       4294967295, 2146488336, 4294967040, 2273},
     _cr_unused1 = 0xffffffff806ff010}, ex_addr = 0x0, ex_addrlen = 64 '_at_',
   ex_mask = 0xffffffffb4dfd7e0, ex_masklen = 244 'є',
   ex_indexfile = 0x40 <Address 0x40 out of bounds>}
 	fspec = 0xffffff00673312e0 "/dev/ad8s4d"
#16 0xffffffff804858a2 in vfs_domount (td=0xffffff005e4e2000,
     fstype=0xffffff0000fb7c00 "", fspath=0xffffff00795ec300 "/shared",
     fsflags=65536, fsdata=0xffffff006e675510)
     at /local/building/freebsd/HEAD/sys/kern/vfs_mount.c:858
 	vp = (struct vnode *) 0xffffff0061a581d8
 	mp = (struct mount *) 0xffffff0000fb7c00
 	vfsp = (struct vfsconf *) 0xffffff0000fb7c00
 	error = 0
 	flag = 4097
 	kern_flag = 536870912
 	va = {va_type = 3034569216, va_mode = 65535, va_nlink = -1,
   va_uid = 2153569984, va_gid = 4294967295, va_fsid = 3034569216,
   va_fileid = -2143218894, va_size = 18446744072449153536,
   va_blocksize = -2142980336, va_atime = {tv_sec = -1260398064,
     tv_nsec = -2138114464}, va_mtime = {tv_sec = -1260397968,
     tv_nsec = -2142979682}, va_ctime = {tv_sec = -1260398032,
     tv_nsec = -2142980336}, va_birthtime = {tv_sec = 0,
     tv_nsec = -2138114464}, va_gen = 18446744072449153648,
   va_flags = 18446744071566573616, va_rdev = 2156965056,
   va_bytes = 18446744071571437152, va_filerev = 610, va_vaflags = 0,
   va_spare = -2140275640}
 	nd = {ni_dirp = 0xffffff00795ec300 "/shared",
   ni_segflg = UIO_SYSSPACE, ni_startdir = 0x0,
   ni_rootdir = 0xffffff00277bd3b0, ni_topdir = 0x0,
   ni_vp = 0xffffff0061a581d8, ni_dvp = 0xffffff00277bd3b0, ni_pathlen = 1,
   ni_next = 0xffffff002ec9a807 "", ni_loopcnt = 0, ni_cnd = {cn_nameiop = 0,
     cn_flags = 49220, cn_thread = 0xffffff005e4e2000,
     cn_cred = 0xffffff0034726700, cn_lkflags = 2,
     cn_pnbuf = 0xffffff002ec9a800 "/shared",
     cn_nameptr = 0xffffff002ec9a801 "shared", cn_namelen = 6, cn_consume = 0}}
 	__func__ = "vfs_domount"
#17 0xffffffff80485071 in vfs_donmount (td=0xffffff005e4e2000, fsflags=65536,
     fsoptions=0xffffff0013df2300)
     at /local/building/freebsd/HEAD/sys/kern/vfs_mount.c:611
 	optlist = (struct vfsoptlist *) 0xffffff006e675510
 	fstype = 0xffffff0067331340 "ufs"
 	fspath = 0xffffff00795ec300 "/shared"
 	errmsg = 0xffffffffb4dfdb10 "PлпДџџџџ\rHH\200џџџџPлпДџџџџ"
 	error = 0
 	fstypelen = 4
 	fspathlen = 8
 	errmsg_len = 0
 	errmsg_pos = -1
#18 0xffffffff8048480d in nmount (td=0xffffff005e4e2000,
     uap=0xffffffffb4dfdc00)
     at /local/building/freebsd/HEAD/sys/kern/vfs_mount.c:397
 	auio = (struct uio *) 0xffffff0013df2300
 	iov = (struct iovec *) 0x2800
 	i = 1582178304
 	error = 6
 	iovcnt = 10
#19 0xffffffff80610e2a in syscall (frame=
       {tf_rdi = 34393294144, tf_rsi = 10, tf_rdx = 0, tf_rcx = 34393293232, tf_r8 = 34389085472, tf_r9 = -6510615555426900571, tf_rax = 378, tf_rbx = 140737488343728, tf_rbp = 34393293232, tf_r10 = 44, tf_r11 = 34393293392, tf_r12 = 140737488343696, tf_r13 = 34410068360, tf_r14 = 140737488345936, tf_r15 = 140737488344912, tf_trapno = 12, tf_addr = 34368322704, tf_flags = 0, tf_err = 2, tf_rip = 34366572476, tf_cs = 43, tf_rflags = 518, tf_rsp = 140737488343672, tf_ss = 35}) at /local/building/freebsd/HEAD/sys/amd64/amd64/trap.c:818
 	params = 0x7fffffffd280 <Address 0x7fffffffd280 out of bounds>
 	callp = (struct sysent *) 0xffffffff8088e3f0
 	td = (struct thread *) 0xffffff005e4e2000
 	p = (struct proc *) 0xffffff0053194000
 	orig_tf_rflags = 518
 	sticks = 0
 	error = 0
 	narg = 3
 	args = {34393294144, 10, 0, 34393293232, 34389085472,
   -6510615555426900571, 0, -2137391616}
 	argp = (register_t *) 0xffffffffb4dfdc00
 	code = 378
 	reg = -1260397568
 	regcnt = 6
 	ksi = {ksi_link = {tqe_next = 0x0, tqe_prev = 0x0}, ksi_info = {
     si_signo = -1260397456, si_errno = -1, si_code = -2141125424,
     si_pid = -1, si_uid = 3034569664, si_status = -1, si_addr = 0x80082fc90,
     si_value = {sival_int = -2138111104, sival_ptr = 0x808f0380}, _reason = {
       _fault = {_trapno = 1394163712}, _timer = {_timerid = 1394163712,
         _overrun = -256}, _mesgq = {_mqd = 1394163712}, _poll = {
         _band = -1098117464064}, __spare__ = {__spare1__ = -1098117464064,
         __spare2__ = {2, 0, -2138111104, -1, -1260397568, -1, 70}}}},
   ksi_flags = 1, ksi_sigq = 0xffffffff808f0380}
#20 0xffffffff805fc288 in Xfast_syscall ()
     at /local/building/freebsd/HEAD/sys/amd64/amd64/exception.S:270
No locals.
#21 0x00000008006847bc in ?? ()
No symbol table info available.
(kgdb)

-- 
Bjoern A. Zeeb				bzeeb at Zabbadoz dot NeT
Received on Sat Jan 28 2006 - 14:45:12 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:38:51 UTC