kern/133170: panic when detaching swap-backed md(4) disk which has gone into swap

[Bruce Cran]

>Number:         133170
>Category:       kern
>Synopsis:       panic when detaching swap-backed md(4) disk which has gone into swap
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Mar 29 00:00:09 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Bruce Cran
>Release:        7-STABLE
>Organization:
>Environment:
FreeBSD gluon.draftnet 7.2-PRERELEASE FreeBSD 7.2-PRERELEASE #0: Tue Mar 24 10:45:31 GMT 2009     brucec at gluon.draftnet:/usr/obj/usr/src/sys/GENERIC  i386
>Description:
When detaching a swap-backed md(4) disk which is larger than physical
memory and which has forced the system into swap I get a panic
(on 7-STABLE). The following commands trigger it:

mdconfig -a -t swap -s 5T
newfs /dev/md0
[cancel newfs when the system goes into swap by ~200MB]
mdconfig -d -u 0

After a few seconds the system panics with:

panic: swp_pager_meta_free_all: failed to locate all swap meta blocks

#0  doadump () at pcpu.h:196
#1  0xc07e2aa7 in boot (howto=260)
at /usr/src/sys/kern/kern_shutdown.c:418 #2  0xc07e2d79 in panic
(fmt=Variable "fmt" is not available. )
at /usr/src/sys/kern/kern_shutdown.c:574 #3  0xc0a0c575 in
swp_pager_meta_free_all (object=0x0)
at /usr/src/sys/vm/swap_pager.c:1845 #4  0xc0a0e637 in
swap_pager_dealloc (object=0xc5bb0380)
at /usr/src/sys/vm/swap_pager.c:517 #5  0xc0a2a84a in
vm_pager_deallocate (object=0xc5bb0380)
at /usr/src/sys/vm/vm_pager.c:252 #6  0xc0a246a4 in vm_object_terminate
(object=0xc5bb0380) at /usr/src/sys/vm/vm_object.c:708
#7  0xc0a24dd3 in vm_object_deallocate (object=0xc5bb0380)
    at /usr/src/sys/vm/vm_object.c:602
#8  0xc06461c9 in mddestroy (sc=0xc8576800, td=0xc481b460)
    at /usr/src/sys/dev/md/md.c:986
#9  0xc0647159 in mdctlioctl (dev=0xc4226100, cmd=3249827073, 
    addr=0xc62f9a00 "", flags=3, td=0xc481b460)
    at /usr/src/sys/dev/md/md.c:1128
#10 0xc076fff7 in devfs_ioctl_f (fp=0xc477d260, com=3249827073, 
    data=0xc62f9a00, cred=0xc8689400, td=0xc481b460)
    at /usr/src/sys/fs/devfs/devfs_vnops.c:602
#11 0xc0819ff5 in kern_ioctl (td=0xc481b460, fd=3, com=3249827073, 
    data=0xc62f9a00 "") at file.h:269
---Type <return> to continue, or q <return> to quit---
#12 0xc081a154 in ioctl (td=0xc481b460, uap=0xe6795cfc)
    at /usr/src/sys/kern/sys_generic.c:570
#13 0xc0ae0b15 in syscall (frame=0xe6795d38)
    at /usr/src/sys/i386/i386/trap.c:1090
#14 0xc0ac58b0 in Xint0x80_syscall ()
at /usr/src/sys/i386/i386/exception.s:255 #15 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: