kern/98093: [REGRESSION] Detaching gmirror/geli leads to panic

[Ulrich Spoerlein]

>Number:         98093
>Category:       kern
>Synopsis:       [REGRESSION] Detaching gmirror/geli leads to panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon May 29 15:10:14 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     Ulrich Spoerlein
>Release:        FreeBSD 6.1-STABLE i386
>Organization:
>Environment:
>Description:
I have an USB attached disk, mirrored and encrypted. With 6.1-RC unplugging the USB
drive would simply remove the gmirror and geli providers. With 6.1-STABLE after the
gmirror MFC, this leads to a panic. Reverting gmirror to RELENG_6_1_RELEASE makes
the problem go away.
>How-To-Repeat:

#!/bin/sh
mdconfig -a -t malloc -s 10m -u 5
gmirror label foo /dev/md5
gmirror stop foo
gnop create /dev/md5
geli onetime /dev/mirror/foo
gnop destroy -f md5.nop

Trying to mount root from ufs:/dev/ad0s4a
GEOM_MIRROR: Device foo created (id=1040196325).
GEOM_MIRROR: Device foo: provider md5 detected.
GEOM_MIRROR: Device foo: provider md5 activated.
GEOM_MIRROR: Device foo: provider mirror/foo launched.
GEOM_MIRROR: Device foo: provider mirror/foo destroyed.
GEOM_MIRROR: Device foo destroyed.
GEOM_NOP: Device md5.nop created.
GEOM_MIRROR: Device foo created (id=1040196325).
GEOM_MIRROR: Device foo: provider md5.nop detected.
GEOM_MIRROR: Device foo: provider md5.nop activated.
GEOM_MIRROR: Device foo: provider mirror/foo launched.
GEOM_ELI: Device mirror/foo.eli created.
GEOM_ELI:     Cipher: AES
GEOM_ELI: Key length: 128
GEOM_ELI:     Crypto: software
GEOM_NOP: Device md5.nop is still open, so it can't be definitely removed.
GEOM_MIRROR: Device foo: provider md5.nop disconnected.
GEOM_MIRROR: Device foo: provider mirror/foo destroyed.
GEOM_MIRROR: Device foo destroyed.
GEOM_ELI: Device mirror/foo.eli destroyed.
panic: NULL softc (provider=mirror/foo).
KDB: enter: panic
[thread pid 2 tid 100001 ]
Stopped at      kdb_enter+0x2b: nop     
db> bt
Tracing pid 2 tid 100001 td 0xc4b03d80
kdb_enter(c06b315a) at kdb_enter+0x2b
panic(c08e6009,c4f612d8,e359ac70,c04d746e,0) at panic+0xbb
g_mirror_access(c4f61280,ffffffff,ffffffff,ffffffff,0) at g_mirror_access+0x223
g_access(c4f33080,ffffffff,ffffffff,ffffffff) at g_access+0x192
g_wither_geom_close(c4f60980,6,c4f60c80,c4f60980,c4ddc480) at g_wither_geom_close+0x68
g_eli_destroy(c4d9bc00,1,e359acdc,c04d3d6e,c4f33080) at g_eli_destroy+0x14e
g_eli_orphan(c4f33080,c4f61280,3e8,0,e359acec) at g_eli_orphan+0x30
g_orphan_register(c4f61280) at g_orphan_register+0x6e
one_event(e359ad0c,c04d561d,258,190,c04d55b0) at one_event+0x9b
g_run_events(258,190,c04d55b0,c4b0220c,e359ad24) at g_run_events+0x9
g_event_procbody(0,e359ad38,0,c04d55b0,0) at g_event_procbody+0x6d
fork_exit(c04d55b0,0,e359ad38) at fork_exit+0xa0
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xe359ad6c, ebp = 0 ---
db> reset
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted: