devfs related kernel panic

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Dear all,

I have another kernel panic, this time devfs-related.

lines 145-147 of sys/fs/devfs/devfs_rule.c read like this:

145  ds = devfs_ruleset_bynum(dm->dm_ruleset);
146  KASSERT(ds != NULL, ("mount-point has NULL ruleset"));
147  devfs_ruleset_applyde(ds, de, devfs_rule_depth);

However, it would be good if devfs_ruleset_applyde did get called, even
on system without the INVARIANT option.

In my case, I'm upgrading from 6.3 to 7.0, and in the process, I'm
flushing + reinstalling all ports. At some point in time, I find myself
without CUPS installed, and with this rule:

#[system=10]
#add path 'lpt*' mode 0660 group cups

devfs prints an error saying that the cups user cannot be found, and
when I try to connect to the host via SSH, it panics:

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x8
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc06e87da
stack pointer           = 0x28:0xd6174814
frame pointer           = 0x28:0xd6174820
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 4969 (sshd)
trap number             = 12
panic: page fault
cpuid = 0
Uptime: 17m24s
Physical memory: 499 MB
Dumping 96 MB: 81 65 49 33 17 1

#0  doadump () at pcpu.h:195
195     pcpu.h: No such file or directory.
        in pcpu.h

(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0xc0754457 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc0754719 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:563
#3  0xc0a4905c in trap_fatal (frame=0xd61747d4, eva=8) at
/usr/src/sys/i386/i386/trap.c:899
#4  0xc0a492e0 in trap_pfault (frame=0xd61747d4, usermode=0, eva=8) at
/usr/src/sys/i386/i386/trap.c:812
#5  0xc0a49c8c in trap (frame=0xd61747d4) at
/usr/src/sys/i386/i386/trap.c:490
#6  0xc0a2fc0b in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0xc06e87da in devfs_ruleset_applyde (ds=0x0, de=0xc3517500, depth=1)
at /usr/src/sys/fs/devfs/devfs_rule.c:626
#8  0xc06e88bf in devfs_rules_apply (dm=0xc2eed340, de=0xc3517500) at
/usr/src/sys/fs/devfs/devfs_rule.c:147
#9  0xc06e8373 in devfs_populate_loop (dm=0xc2eed340, cleanup=Variable
"cleanup" is not available.
) at /usr/src/sys/fs/devfs/devfs_devs.c:460
#10 0xc06e840e in devfs_populate (dm=0xc2eed340) at
/usr/src/sys/fs/devfs/devfs_devs.c:485
#11 0xc06ec323 in devfs_lookup (ap=0xd61749b8) at
/usr/src/sys/fs/devfs/devfs_vnops.c:641
#12 0xc0a5f256 in VOP_LOOKUP_APV (vop=0xc0b71680, a=0xd61749b8) at
vnode_if.c:99
#13 0xc07c28f1 in lookup (ndp=0xd6174b80) at vnode_if.h:57
#14 0xc07c35ff in namei (ndp=0xd6174b80) at
/usr/src/sys/kern/vfs_lookup.c:219
#15 0xc07d9fd7 in vn_open_cred (ndp=0xd6174b80, flagp=0xd6174c78,
cmode=0, cred=0xc35af200, fp=0xc3025e58)
    at /usr/src/sys/kern/vfs_vnops.c:188
#16 0xc07da2a3 in vn_open (ndp=0xd6174b80, flagp=0xd6174c78, cmode=0,
fp=0xc3025e58) at /usr/src/sys/kern/vfs_vnops.c:94
#17 0xc07d7f27 in kern_open (td=0xc2ff0630, path=0xbfbfe541 <Address
0xbfbfe541 out of bounds>, pathseg=UIO_USERSPACE, flags=3, mode=0)
    at /usr/src/sys/kern/vfs_syscalls.c:1028
#18 0xc07d8490 in open (td=0xc2ff0630, uap=0xd6174cfc) at
/usr/src/sys/kern/vfs_syscalls.c:995
#19 0xc0a49635 in syscall (frame=0xd6174d38) at
/usr/src/sys/i386/i386/trap.c:1035
#20 0xc0a2fc70 in Xint0x80_syscall () at
/usr/src/sys/i386/i386/exception.s:196
#21 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)

(kgdb) up 8
#8  0xc06e88bf in devfs_rules_apply (dm=0xc2eed340, de=0xc3517500) at
/usr/src/sys/fs/devfs/devfs_rule.c:147
warning: Source file is more recent than executable.

147             devfs_ruleset_applyde(ds, de, devfs_rule_depth);
(kgdb) list
142             if (dm->dm_ruleset == 0)
143                     return;
144             sx_slock(&sx_rules);
145             ds = devfs_ruleset_bynum(dm->dm_ruleset);
146             KASSERT(ds != NULL, ("mount-point has NULL ruleset"));
147             devfs_ruleset_applyde(ds, de, devfs_rule_depth);
148             sx_sunlock(&sx_rules);
149     }
150
151     /*

(kgdb) print ds
$1 = (struct devfs_ruleset *) 0x0

(kgdb) down
#7  0xc06e87da in devfs_ruleset_applyde (ds=0x0, de=0xc3517500, depth=1)
at /usr/src/sys/fs/devfs/devfs_rule.c:626
626     {


- --
Pietro Cerutti
gahr_at_FreeBSD.org

PGP Public Key:
http://gahr.ch/pgp

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (FreeBSD)

iEYEAREKAAYFAkfNvrQACgkQwMJqmJVx945/GQCgnwnT04Vbh110lZXDxayHSLfq
qfgAoJ+3ThriZo3tfY5g/9Wa+IWaEzQF
=XMPr
-----END PGP SIGNATURE-----