kern/67326: crash after attempt to mount write protected MSDOS fs

Gerhard Gonter g.gonter at ieee.org
Fri May 28 22:50:31 PDT 2004 

>Number:         67326
>Category:       kern
>Synopsis:       crash after attempt to mount write protected MSDOS fs
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri May 28 22:50:24 PDT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Gerhard Gonter
>Release:        FreeBSD 5.2-CURRENT i386
>Organization:
none
>Environment:
System: FreeBSD chuck.iris-net.home 5.2-CURRENT FreeBSD 5.2-CURRENT #42: Fri May 28 22:40:03 CEST 2004 root at chuck.iris-net.home:/usr/obj/usr/src/sys/CHUCK i386


>Description:
	After attempting to mount a MSDOS file system on a write protected
	medium, the system crashes after a while.  I guess, the crash
	is triggered actually triggered by the syncer.  In this case, this
	happened when attempting to mount a USB memory stick with write
	protection enabaled.

	Below you find info and trace file from the kernel dump as well
	as the kernel config file.

Good dump found on device /dev/ad1s1b
  Architecture: i386
  Architecture version: 1
  Dump length: 268369920B (255 MB)
  Blocksize: 512
  Dumptime: Sat May 29 06:30:09 2004
  Hostname: chuck.iris-net.home
  Versionstring: FreeBSD 5.2-CURRENT #42: Fri May 28 22:40:03 CEST 2004
    root at chuck.iris-net.home:/usr/obj/usr/src/sys/CHUCK
  Panicstring: Consumer with zero access count in g_dev_strategy
  Bounds: 2

chuck# gdb -k /usr/obj/usr/src/sys/CHUCK/kernel.debug vmcore.2
GNU gdb 5.2.1 (FreeBSD)
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-undermydesk-freebsd"...
panic: Consumer with zero access count in g_dev_strategy
panic messages:
---
panic: Consumer with zero access count in g_dev_strategy
at line 377 in file /usr/src/sys/geom/geom_dev.c
Debugger("panic")
Dumping 255 MB
 16 32 48 64 80 96 112 128 144 160 176 192 208 224 240
---
Reading symbols from /usr/obj/usr/src/sys/CHUCK/modules/usr/src/sys/modules/acpi/acpi.ko.debug...done.
Loaded symbols for /usr/obj/usr/src/sys/CHUCK/modules/usr/src/sys/modules/acpi/acpi.ko.debug
Reading symbols from /usr/obj/usr/src/sys/CHUCK/modules/usr/src/sys/modules/linprocfs/linprocfs.ko.debug...done.
Loaded symbols for /usr/obj/usr/src/sys/CHUCK/modules/usr/src/sys/modules/linprocfs/linprocfs.ko.debug
Reading symbols from /usr/obj/usr/src/sys/CHUCK/modules/usr/src/sys/modules/linux/linux.ko.debug...done.
Loaded symbols for /usr/obj/usr/src/sys/CHUCK/modules/usr/src/sys/modules/linux/linux.ko.debug
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:236
236		dumping++;
(kgdb) where
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:236
#1  0xc045c4f2 in db_fncall (dummy1=0, dummy2=0, dummy3=-1064658124, 
    dummy4=0xcd353a50 "\200û\213À\204:5Í\016ÁsÀ\204:5Í{ÁsÀ\220\a")
    at /usr/src/sys/ddb/db_command.c:551
#2  0xc045c2f8 in db_command (last_cmdp=0xc0855680, cmd_table=0x0, 
    aux_cmd_tablep=0xc07d86e0, aux_cmd_tablep_end=0xc07d86f8)
    at /usr/src/sys/ddb/db_command.c:348
#3  0xc045c3d8 in db_command_loop () at /usr/src/sys/ddb/db_command.c:475
#4  0xc045eb6d in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_trap.c:73
#5  0xc0742275 in kdb_trap (type=3, code=0, regs=0xcd353b7c)
    at /usr/src/sys/i386/i386/db_interface.c:159
#6  0xc075050c in trap (frame=
      {tf_fs = -1065680872, tf_es = -1067515888, tf_ds = 16, tf_edi = 1, tf_esi = -1065684719, tf_ebp = -852149312, tf_isp = -852149336, tf_ebx = 0, tf_edx = 0, tf_ecx = -1056882688, tf_eax = 18, tf_trapno = 3, tf_err = 0, tf_eip = -1066130203, tf_cs = 8, tf_eflags = 642, tf_esp = -852149260, tf_ss = -852149280})
    at /usr/src/sys/i386/i386/trap.c:579
#7  0xc07424e5 in Debugger (msg=0xc07b52f4 "panic") at machine/cpufunc.h:56
#8  0xc05de923 in __panic (file=0xc07aef4b "/usr/src/sys/geom/geom_dev.c", 
    line=377, 
    fmt=0xc07af111 "Consumer with zero access count in g_dev_strategy")
    at /usr/src/sys/kern/kern_shutdown.c:532
#9  0xc05a8c27 in g_dev_strategy (bp=0xc7c08128)
    at /usr/src/sys/geom/geom_dev.c:397
#10 0xc061ecb8 in dev_strategy (bp=0xc7c08128)
    at /usr/src/sys/kern/vfs_bio.c:3089
#11 0xc05a728a in spec_xstrategy (vp=0xc2f0430c, bp=0xc7c08128)
    at /usr/src/sys/fs/specfs/spec_vnops.c:512
#12 0xc05a72f7 in spec_specstrategy (ap=0xcd353c58)
    at /usr/src/sys/fs/specfs/spec_vnops.c:529
#13 0xc05a666b in spec_vnoperate (ap=0x0)
    at /usr/src/sys/fs/specfs/spec_vnops.c:118
#14 0xc061b489 in ibwrite (bp=0xc7c08128) at vnode_if.h:1116
#15 0xc061b0b2 in bwrite (bp=0x0) at /usr/src/sys/kern/vfs_bio.c:771
#16 0xc061bba7 in bawrite (bp=0x0) at /usr/src/sys/kern/vfs_bio.c:1162
#17 0xc06238b1 in vop_stdfsync (ap=0xcd353ce0)
    at /usr/src/sys/kern/vfs_default.c:579
#18 0xc05a7113 in spec_fsync (ap=0xcd353ce0)
    at /usr/src/sys/fs/specfs/spec_vnops.c:437
#19 0xc05a666b in spec_vnoperate (ap=0x0)
    at /usr/src/sys/fs/specfs/spec_vnops.c:118
#20 0xc0629fff in sched_sync () at vnode_if.h:627
#21 0xc05cdd98 in fork_exit (callout=0xc0629de8 <sched_sync>, arg=0x0, 
    frame=0xcd353d48) at /usr/src/sys/kern/kern_fork.c:816
(kgdb) 

#
# GENERIC -- Generic kernel configuration file for FreeBSD/i386
#
# For more information on this file, please read the handbook section on
# Kernel Configuration Files:
#
#    http://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/kernelconfig-config.html
#
# The handbook is also available locally in /usr/share/doc/handbook
# if you've installed the doc distribution, otherwise always see the
# FreeBSD World Wide Web server (http://www.FreeBSD.org/) for the
# latest information.
#
# An exhaustive list of options and more detailed explanations of the
# device lines is also present in the ../../conf/NOTES and NOTES files. 
# If you are in doubt as to the purpose or necessity of a line, check first 
# in NOTES.
#
# $FreeBSD: src/sys/i386/conf/GENERIC,v 1.386 2003/06/08 02:03:01 jmallett Exp $

machine		i386
cpu		I486_CPU
cpu		I586_CPU
cpu		I686_CPU
ident		GENERIC

#To statically compile in device wiring instead of /boot/device.hints
#hints		"GENERIC.hints"		#Default places to look for devices.

makeoptions	DEBUG=-g		#Build kernel with gdb(1) debug symbols

options 	SCHED_4BSD		#4BSD scheduler
options 	INET			#InterNETworking
options 	INET6			#IPv6 communications protocols
options 	FFS			#Berkeley Fast Filesystem
options 	SOFTUPDATES		#Enable FFS soft updates support
options 	UFS_ACL			#Support for access control lists
options 	UFS_DIRHASH		#Improve performance on big directories
options 	MD_ROOT			#MD is a potential root device
options 	NFSCLIENT		#Network Filesystem Client
options 	NFSSERVER		#Network Filesystem Server
options 	NFS_ROOT		#NFS usable as /, requires NFSCLIENT
options 	MSDOSFS			#MSDOS Filesystem
options 	CD9660			#ISO 9660 Filesystem
options 	PROCFS			#Process filesystem (requires PSEUDOFS)
options 	PSEUDOFS		#Pseudo-filesystem framework
options 	COMPAT_43		#Compatible with BSD 4.3 [KEEP THIS!]
options 	COMPAT_FREEBSD4		#Compatible with FreeBSD4
options 	SCSI_DELAY=15000	#Delay (in ms) before probing SCSI
options 	KTRACE			#ktrace(1) support
options 	SYSVSHM			#SYSV-style shared memory
options 	SYSVMSG			#SYSV-style message queues
options 	SYSVSEM			#SYSV-style semaphores
options 	_KPOSIX_PRIORITY_SCHEDULING #Posix P1003_1B real-time extensions
options 	KBD_INSTALL_CDEV	# install a CDEV entry in /dev
options 	AHC_REG_PRETTY_PRINT	# Print register bitfields in debug
					# output.  Adds ~128k to driver.
options 	AHD_REG_PRETTY_PRINT	# Print register bitfields in debug
					# output.  Adds ~215k to driver.

# Debugging for use in -current
options 	DDB			#Enable the kernel debugger
options 	INVARIANTS		#Enable calls of extra sanity checking
options 	INVARIANT_SUPPORT	#Extra sanity checks of internal structures, required by INVARIANTS
options 	WITNESS			#Enable checks to detect deadlocks and cycles
options 	WITNESS_SKIPSPIN	#Don't run witness on spinlocks for speed

# To make an SMP kernel, the next two are needed
#options 	SMP			# Symmetric MultiProcessor Kernel
#options 	APIC_IO			# Symmetric (APIC) I/O

device		isa
device		eisa
device		pci

# Floppy drives
device		fdc

# ATA and ATAPI devices
device		ata
device		atadisk			# ATA disk drives
device		atapicd			# ATAPI CDROM drives
device		atapifd			# ATAPI floppy drives
device		atapist			# ATAPI tape drives
options 	ATA_STATIC_ID		#Static device numbering

# SCSI Controllers
device		ahb		# EISA AHA1742 family
device		ahc		# AHA2940 and onboard AIC7xxx devices
device		ahd		# AHA39320/29320 and onboard AIC79xx devices
device		amd		# AMD 53C974 (Tekram DC-390(T))
device		isp		# Qlogic family
device		mpt		# LSI-Logic MPT-Fusion
#device		ncr		# NCR/Symbios Logic
device		sym		# NCR/Symbios Logic (newer chipsets + those of `ncr')
device		trm		# Tekram DC395U/UW/F DC315U adapters

device		adv		# Advansys SCSI adapters
device		adw		# Advansys wide SCSI adapters
device		aha		# Adaptec 154x SCSI adapters
device		aic		# Adaptec 15[012]x SCSI adapters, AIC-6[23]60.
device		bt		# Buslogic/Mylex MultiMaster SCSI adapters

device		ncv		# NCR 53C500
device		nsp		# Workbit Ninja SCSI-3
device		stg		# TMC 18C30/18C50

# RAID controllers interfaced to the SCSI subsystem
device		asr		# DPT SmartRAID V, VI and Adaptec SCSI RAID
device		ciss		# Compaq Smart RAID 5*
device		dpt		# DPT Smartcache III, IV - See NOTES for options!
device		iir		# Intel Integrated RAID
device		mly		# Mylex AcceleRAID/eXtremeRAID

# SCSI peripherals
device		scbus		# SCSI bus (required for SCSI)
device		ch		# SCSI media changers
device		da		# Direct Access (disks)
device		sa		# Sequential Access (tape etc)
device		cd		# CD
device		pass		# Passthrough device (direct SCSI access)
device		ses		# SCSI Environmental Services (and SAF-TE)

# RAID controllers
device		aac		# Adaptec FSA RAID
device		aacp		# SCSI passthrough for aac (requires CAM)
device		amr		# AMI MegaRAID
device		ida		# Compaq Smart RAID
device		ips		# IBM (Adaptec) ServeRAID
device		mlx		# Mylex DAC960 family
device		pst		# Promise Supertrak SX6000
device		twe		# 3ware ATA RAID

# atkbdc0 controls both the keyboard and the PS/2 mouse
device		atkbdc		# AT keyboard controller
device		atkbd		# AT keyboard
device		psm		# PS/2 mouse

device		vga		# VGA video card driver

device		splash		# Splash screen and screen saver support

# syscons is the default console driver, resembling an SCO console
device		sc

# Enable this for the pcvt (VT220 compatible) console driver
#device		vt
#options 	XSERVER			# support for X server on a vt console
#options 	FAT_CURSOR		# start with block cursor

device		agp		# support several AGP chipsets

# Floating point support - do not disable.
device		npx

# Power management support (see NOTES for more options)
#device		apm
# Add suspend/resume support for the i8254.
device		pmtimer

# PCCARD (PCMCIA) support
# Pcmcia and cardbus bridge support
device		cbb			# cardbus (yenta) bridge
#device		pcic			# ExCA ISA and PCI bridges
device		pccard			# PC Card (16-bit) bus
device		cardbus			# CardBus (32-bit) bus

# Serial (COM) ports
device		sio		# 8250, 16[45]50 based serial ports

# Parallel port
device		ppc
device		ppbus		# Parallel port bus (required)
device		lpt		# Printer
device		plip		# TCP/IP over parallel
device		ppi		# Parallel port interface device
#device		vpo		# Requires scbus and da


# PCI Ethernet NICs.
device		de		# DEC/Intel DC21x4x (``Tulip'')
device		em		# Intel PRO/1000 adapter Gigabit Ethernet Card
device		txp		# 3Com 3cR990 (``Typhoon'')
device		vx		# 3Com 3c590, 3c595 (``Vortex'')

# PCI Ethernet NICs that use the common MII bus controller code.
# NOTE: Be sure to keep the 'device miibus' line in order to use these NICs!
device		miibus		# MII bus support
device		dc		# DEC/Intel 21143 and various workalikes
device		fxp		# Intel EtherExpress PRO/100B (82557, 82558)
device		pcn		# AMD Am79C97x PCI 10/100 (precedence over 'lnc')
device		rl		# RealTek 8129/8139
device		sf		# Adaptec AIC-6915 (``Starfire'')
device		sis		# Silicon Integrated Systems SiS 900/SiS 7016
device		sk		# SysKonnect SK-984x and SK-982x gigabit ethernet
device		ste		# Sundance ST201 (D-Link DFE-550TX)
device		ti		# Alteon Networks Tigon I/II gigabit ethernet
device		tl		# Texas Instruments ThunderLAN
device		tx		# SMC EtherPower II (83c170 ``EPIC'')
device		vr		# VIA Rhine, Rhine II
device		wb		# Winbond W89C840F
device		xl		# 3Com 3c90x (``Boomerang'', ``Cyclone'')
device		bge		# Broadcom BCM570xx Gigabit Ethernet

# ISA Ethernet NICs.  pccard nics included.
device		cs		# Crystal Semiconductor CS89x0 NIC
# 'device ed' requires 'device miibus'
device		ed		# NE[12]000, SMC Ultra, 3c503, DS8390 cards
device		ex		# Intel EtherExpress Pro/10 and Pro/10+
device		ep		# Etherlink III based cards
device		fe		# Fujitsu MB8696x based cards
device		ie		# EtherExpress 8/16, 3C507, StarLAN 10 etc.
device		lnc		# NE2100, NE32-VL Lance Ethernet cards
device		sn		# SMC's 9000 series of ethernet chips
device		xe		# Xircom pccard ethernet

# ISA devices that use the old ISA shims
#device		le

# Wireless NIC cards
device		wlan		# 802.11 support
device		an		# Aironet 4500/4800 802.11 wireless NICs. 
device		awi		# BayStack 660 and others
device		wi		# WaveLAN/Intersil/Symbol 802.11 wireless NICs.
#device		wl		# Older non 802.11 Wavelan wireless NIC.

# Pseudo devices - the number indicates how many units to allocate.
device		random		# Entropy device
device		loop		# Network loopback
device		ether		# Ethernet support
device		sl		# Kernel SLIP
device		ppp		# Kernel PPP
device		tun		# Packet tunnel.
device		pty		# Pseudo-ttys (telnet etc)
device		md		# Memory "disks"
device		gif		# IPv6 and IPv4 tunneling
device		faith		# IPv6-to-IPv4 relaying (translation)

# The `bpf' device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
device		bpf		# Berkeley packet filter

# USB support
device		uhci		# UHCI PCI->USB interface
device		ohci		# OHCI PCI->USB interface
device		usb		# USB Bus (required)
#device		udbp		# USB Double Bulk Pipe devices
device		ugen		# Generic
device		uhid		# "Human Interface Devices"
device		ukbd		# Keyboard
device		ulpt		# Printer
device		umass		# Disks/Mass storage - Requires scbus and da
device		ums		# Mouse
device		urio		# Diamond Rio 500 MP3 player
device		uscanner	# Scanners
# USB Ethernet, requires mii
device		aue		# ADMtek USB ethernet
device		axe		# ASIX Electronics USB ethernet
device		cue		# CATC USB ethernet
device		kue		# Kawasaki LSI USB ethernet

# FireWire support
device		firewire	# FireWire bus code
device		sbp		# SCSI over FireWire (Requires scbus and da)
device		fwe		# Ethernet over FireWire (non-standard!)

#
options         EXT2FS
#
device atapicam

>How-To-Repeat:
	See description.

chuck# dmesg | tail
umass1: PNY USB Disk, rev 1.10/1.00, addr 3
da4 at umass-sim1 bus 1 target 0 lun 0
da4: < USB DISK 2.0D> Removable Direct Access SCSI-0 device 
da4: 1.000MB/s transfers
da4: 124MB (253952 512 byte sectors: 64H 32S/T 124C)

chuck# mount -t msdos /dev/da4s1 /mnt
msdosfs: /dev/da4s1: Permission denied
chuck# ... wait for a while ...

>Fix:

	None.  Mounting the FS mit -o ro does not cause the crash.

>Release-Note:
>Audit-Trail:
>Unformatted:

More information about the freebsd-bugs mailing list