kern/129084: udf panic: getblk: size(67584) > MAXBSIZE(65536)

[Paul]

>Number:         129084
>Category:       kern
>Synopsis:       udf panic: getblk: size(67584) > MAXBSIZE(65536)
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Nov 23 13:40:05 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Paul
>Release:        FreeBSD 8-0 CURRENT
>Organization:
>Environment:
FreeBSD dhcppc1 8.0-CURRENT FreeBSD 8.0-CURRENT #5: Sat Nov 22 15:17:29 CET 2008     root@:/usr/src/obj/usr/src/sys/KERNEL  i386
>Description:
Head of textdump:

db:0:kdb.enter.panic>  run lockinfo
db:1:lockinfo> show locks
db:1:locks>  show alllocks
Process 864 (python) thread 0xc4866240 (100085)
db:1:alllocks>  show lockedvnods
Locked vnodes
db:0:kdb.enter.panic>  show pcpu
cpuid        = 1
curthread    = 0xc4866240: pid 864 "initial thread"
curpcb       = 0xc3b61d90
fpcurthread  = none
idlethread   = 0xc3d2ad80: pid 10 "idle: cpu1"
APIC ID      = 1
currentldt   = 0x50
spin locks held:
db:0:kdb.enter.panic>  bt
Tracing pid 864 tid 100085 td 0xc4866240
kdb_enter(c069b2ff,c069b2ff,c06a5f73,c3b61968,1,...) at kdb_enter+0x3a
panic(c06a5f73,10800,10000,c06869a6,c3b619d0,...) at panic+0x131
getblk(c4f08648,424,0,10800,0,...) at getblk+0x2d
breadn(c4f08648,424,0,10800,0,...) at breadn+0x44
bread(c4f08648,424,0,10800,0,...) at bread+0x4c
udf_readatoffset(1a18,0,c5183038,c518303c,0,...) at udf_readatoffset+0xbb
udf_getfid(c4f02200,c06a034f,527,c06a87d5,c3b61c24,...) at udf_getfid+0x1ca
udf_readdir(c3b61c24,0,c4f05a78,0,c3b61c5c,...) at udf_readdir+0xdc
VOP_READDIR_APV(c517f280,c3b61c24,c06a87d5,ff3,1a18,...) at VOP_READDIR_APV+0xa0
kern_getdirentries(c4866240,46,2844c000,1000,c3b61c78,...) at kern_getdirentries+0x1bd
getdirentries(c4866240,c3b61cf8,10,c06a1dd7,c06cfe00,...) at getdirentries+0x31
syscall(c3b61d38) at syscall+0x261
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (196, FreeBSD ELF32, getdirentries), eip = 0x28251e4b, esp = 0xbfbfdcbc, ebp = 0xbfbfdce8 ---

End of dmesg:
lock order reversal:
 1st 0xc4f06488 udf (udf) @ /usr/src/sys/kern/vfs_subr.c:2053
 2nd 0xd7d9d490 bufwait (bufwait) @ /usr/src/sys/kern/vfs_bio.c:2443
 3rd 0xc4f057ac udf (udf) @ /usr/src/sys/modules/udf/../../fs/udf/udf_vfsops.c:616
KDB: stack backtrace:
db_trace_self_wrapper(c069e457,c3b61824,c04e7a2f,4,c0699b7b,...) at db_trace_self_wrapper+0x26
kdb_backtrace(4,c0699b7b,c3cb7538,c3cb9d08,c3b61880,...) at kdb_backtrace+0x29
_witness_debugger(c06a1124,c4f057ac,c517e9dc,c3cb9d08,c517e956,...) at _witness_debugger+0x1e
witness_checkorder(c4f057ac,9,c517e956,268,0,...) at witness_checkorder+0x811
__lockmgr_args(c4f057ac,80000,0,0,0,...) at __lockmgr_args+0x762
udf_vget(c4990280,c1,80000,c3b619bc,0,...) at udf_vget+0x137
udf_lookup(c3b619fc,c4f06430,c3b61bb4,c4f06430,c3b61a1c,...) at udf_lookup+0x26c
VOP_CACHEDLOOKUP_APV(c517f280,c3b619fc,c3b61bb4,c3b61ba0,c06fa3e0,...) at VOP_CACHEDLOOKUP_APV+0xa0
vfs_cache_lookup(c3b61a7c,c3b61a7c,0,200000,c4f06430,...) at vfs_cache_lookup+0xc3
VOP_LOOKUP_APV(c517f280,c3b61a7c,c06a6e55,2cc,c3b61ba0,...) at VOP_LOOKUP_APV+0xaa
lookup(c3b61b88,0,c06a6e55,ec,c41fe42c,...) at lookup+0x507
namei(c3b61b88,c04e780b,c06b6dc4,c06a0b67,3,...) at namei+0x45b
kern_statat(c4866240,0,ffffff9c,28307450,0,...) at kern_statat+0x66
kern_stat(c4866240,28307450,0,c3b61c1c,44f,...) at kern_stat+0x36
stat(c4866240,c3b61cf8,8,c06a259b,c06cfd40,...) at stat+0x2b
syscall(c3b61d38) at syscall+0x261
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (188, FreeBSD ELF32, stat), eip = 0x2825c34b, esp = 0xbfbfe0bc, ebp = 0xbfbfe158 ---
uiomove returned -1
uiomove returned -1
uiomove returned -1
uiomove returned -1
uiomove returned -1
panic: getblk: size(67584) > MAXBSIZE(65536)

cpuid = 1
KDB: enter: panic
exclusive lockmgr udf (udf) r = 0 (0xc4f05ad0) locked @ /usr/src/sys/kern/vfs_syscalls.c:4083
exclusive sleep mutex Giant (Giant) r = 0 (0xc0710cf0) locked @ /usr/src/sys/kern/vfs_syscalls.c:4068
exclusive lockmgr udf (udf) r = 0 (0xc4f05ad0) locked @ /usr/src/sys/kern/vfs_syscalls.c:4083
exclusive sleep mutex Giant (Giant) r = 0 (0xc0710cf0) locked @ /usr/src/sys/kern/vfs_syscalls.c:4068

0xc4f05a78: tag udf, type VDIR
    usecount 1, writecount 0, refcount 1 mountedhere 0
    flags ()
    v_object 0xc50b907c ref 0 pages 0
     lock type udf: EXCL by thread 0xc4866240 (pid 864)

>How-To-Repeat:
# create 3GB udf file system with multiple files and directories with mkisofs.
# mdconfig -f /path/to/udf.iso
# mount_udf /dev/md0 /mnt

Try to read files and dirs on udf fs with threaded application like cplay(python script) : /usr/ports/audio/cplay

# cplay /mnt/*
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: