[Bug 294130] Kernel panic when running Kyua test aio/aio_test:vectored_zvol_poll, in zvol_geom_access

From: <bugzilla-noreply_at_freebsd.org>
Date: Mon, 30 Mar 2026 03:29:37 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294130

            Bug ID: 294130
           Summary: Kernel panic when running Kyua test
                    aio/aio_test:vectored_zvol_poll, in zvol_geom_access
           Product: Base System
           Version: 16.0-CURRENT
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: cracauer@cons.org

When you run all the kernel tests on 16-current, it panics with a page fault
when running test aio/aio_test:vectored_zvol_poll

The central function involved seems to be zvol_geom_access().

I have INVARIANTS on, but that doesn't seem to be matter.

Note that to reproduce this you have to have the zfs kernel module loaded
before starting the tests.

Backtrace:
Fatal trap 12: page fault while in kernel mode                                  
cpuid = 4; apic id = 04                                                         
fault virtual address   = 0x50                                                  
fault code              = supervisor read data, page not present                
instruction pointer     = 0x20:0xffffffff85677518                               
stack pointer           = 0x28:0xfffffe00d5d67d90                               
frame pointer           = 0x28:0xfffffe00d5d67dd0                               
code segment            = base 0x0, limit 0xfffff, type 0x1b                    
                        = DPL 0, pres 1, long 1, def32 0, gran 1                
processor eflags        = interrupt enabled, resume, IOPL = 0                   
current process         = 13 (g_event)                                          
rdi: fffff80276d28e90 rsi: 0000000000000008 rdx: ffffffff859339a2               
rcx: 00000000000000e9  r8: 0000000000000000  r9: 0000000000000000               
rax: 0000000000000000 rbx: 0000000000000001 rbp: fffffe00d5d67dd0               
r10: 0000000000000000 r11: 0000000000000001 r12: fffff800012a7400               
r13: fffff80276d28e90 r14: fffff80276d28c00 r15: 0000000000000000               
trap number             = 12                                                    
panic: page fault                                               23:18
[263/1849]
cpuid = 4                                                                       
time = 1774840249                                                               
KDB: stack backtrace:                                                           
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00d5d67ac0  
vpanic() at vpanic+0x136/frame 0xfffffe00d5d67bf0                               
panic() at panic+0x43/frame 0xfffffe00d5d67c50                                  
trap_pfault() at trap_pfault+0x422/frame 0xfffffe00d5d67cc0                     
calltrap() at calltrap+0x8/frame 0xfffffe00d5d67cc0                             
--- trap 0xc, rip = 0xffffffff85677518, rsp = 0xfffffe00d5d67d90, rbp =
0xfffffe
00d5d67dd0 ---
zvol_geom_access() at zvol_geom_access+0x128/frame 0xfffffe00d5d67dd0           
g_access() at g_access+0x26e/frame 0xfffffe00d5d67e30                           
g_uzip_taste() at g_uzip_taste+0xef/frame 0xfffffe00d5d67ea0                    
g_new_provider_event() at g_new_provider_event+0xaa/frame 0xfffffe00d5d67ec0    
g_run_events() at g_run_events+0x104/frame 0xfffffe00d5d67ef0                   
fork_exit() at fork_exit+0x82/frame 0xfffffe00d5d67f30                          
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00d5d67f30               
--- trap 0, rip = 0xbfb0ddf1, rsp = 0xb, rbp = 0x14 ---                         
KDB: enter: panic                                                               
[ thread pid 13 tid 100069 ]                                                    
Stopped at      kdb_enter+0x33: movq    $0,0x15e64c2(%rip)

-- 
You are receiving this mail because:
You are the assignee for the bug.