kern/145452: [geom] panic in geom_part_mbr when undoing destroy command

[Andrey V. Elsukov]

>Number:         145452
>Category:       kern
>Synopsis:       [geom] panic in geom_part_mbr when undoing destroy command
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Apr 07 08:40:06 UTC 2010
>Closed-Date:
>Last-Modified:
>Originator:     Andrey V. Elsukov
>Release:        FreeBSD 9.0-CURRENT amd64
>Organization:
>Environment:
System: FreeBSD 9.0-CURRENT i386/amd64

>Description:
	System panic when trying undo destroy MBR scheme:
	Fatal trap 18: integer divide fault while in kernel mode.
	Backtrace attached.
>How-To-Repeat:
	# mdconfig -s 50m
	# gpart create -s mbr md0
	# gpart destroy -f x md0
	# gpart undo md0
>Fix:
	Don't know how to fix it in a right way.
	It seems it can be fixed by adding at the end of g_part_mbr_read method
	after loop on partitions entries some code, which will be check and
	properly initialize basetable->gpt_sectors. 
	Also it can be fixed somewhere in g_part.c, but currently it is not so 
	easy for me to found right place where :)

	

--- bt.txt begins here ---
(kgdb) bt
#0  doadump () at pcpu.h:246
#1  0xc05bf707 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:416
#2  0xc05bf9f9 in panic (fmt=) at /usr/src/sys/kern/kern_shutdown.c:579
#3  0xc084632c in trap_fatal (frame=0xc3af2a10, eva=0)
    at /usr/src/sys/i386/i386/trap.c:940
#4  0xc084707d in trap (frame=0xc3af2a10) at /usr/src/sys/i386/i386/trap.c:729
#5  0xc082905b in calltrap () at /usr/src/sys/i386/i386/exception.s:165
#6  0xc084e6ab in __qdivrem (uq=) at /usr/src/sys/libkern/qdivrem.c:97
#7  0xc084e5d1 in __moddi3 (a=102400, b=) at /usr/src/sys/libkern/moddi3.c:60
#8  0xc056af6f in g_part_mbr_read (basetable=0xc3ea9c00, cp=0xcc7a1d40)
    at /usr/src/sys/geom/part/g_part_mbr.c:433
#9  0xc0566521 in g_part_ctlreq (req=0xcc7a1300, mp=0xc08e9c60, 
    verb=0xd023e760 "undo") at g_part_if.h:190
#10 0xc055933e in g_ctl_req (arg=0xcc7a1300, flag=0)
    at /usr/src/sys/geom/geom_ctl.c:454
#11 0xc055c454 in g_run_events () at /usr/src/sys/geom/geom_event.c:211
#12 0xc055d945 in g_event_procbody () at /usr/src/sys/geom/geom_kern.c:141
#13 0xc0594e31 in fork_exit (callout=0xc055d8e0 <g_event_procbody>, arg=0x0, 
    frame=0xc3af2d38) at /usr/src/sys/kern/kern_fork.c:843
#14 0xc08290d0 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:270
(kgdb) f 8
#8  0xc056af6f in g_part_mbr_read (basetable=0xc3ea9c00, cp=0xcc7a1d40)
    at /usr/src/sys/geom/part/g_part_mbr.c:433
433		basetable->gpt_last = msize - (msize % basetable->gpt_sectors) - 1;
(kgdb) p *basetable
$1 = {ops = 0xc566d800, gpt_scheme = 0xc08ea420, gpt_gp = 0xc946c280, 
  gpt_entry = {lh_first = 0x0}, gpt_first = 0, gpt_last = 0, gpt_entries = 4, 
  gpt_smhead = 0, gpt_smtail = 0, gpt_sectors = 0, gpt_heads = 0, 
  gpt_depth = 0, gpt_isleaf = 0, gpt_created = 0, gpt_modified = 0, 
  gpt_opened = 0, gpt_fixgeom = 0}
(kgdb) p *basetable->gpt_scheme
$2 = {name = 0xc08a33fe "MBR", methods = 0xc08ea480, size = 572, 
  baseclasses = 0x0, refs = 1, ops = 0xc566d800, gps_entrysz = 60, 
  gps_minent = 4, gps_maxent = 4, gps_bootcodesz = 512, scheme_list = {
    tqe_next = 0x0, tqe_prev = 0xc08ea388}}
(kgdb) 
--- bt.txt ends here ---


>Release-Note:
>Audit-Trail:
>Unformatted: