kern/162997: [GEOM]multiple gmirror cause kernel panic during shutdown

[KAHO at FreeBSD.org]

>Number:         162997
>Category:       kern
>Synopsis:       [GEOM]multiple gmirror cause kernel panic during shutdown
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Dec 01 15:20:14 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     KAHO, Toshikazu
>Release:        10.0-CURRENT
>Organization:
>Environment:
FreeBSD pf2.ed.niigata-u.ac.jp 10.0-CURRENT FreeBSD 10.0-CURRENT #3 r227014:228180: Thu Dec  1 23:01:58 JST 2011     kaho at pf2.ed.niigata-u.ac.jp:/usr/obj/usr/src/sys/NUPA  amd64
>Description:
r227015(sys/geom/geom_vfs.c) causes kernel panic at destroying geom providers.
A system with only one gmirror provider dose not affect this problem.
The machines with mirroring slice level and having multiple gmirror names
panic during shutdown. It occurs both i386 and amd64 system.
i386 system shows:

Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x10
fault code              = supervisor write, page not present
instruction pointer     = 0x20:0xc052e601
stack pointer           = 0x28:0xc1b0ec80
frame pointer           = 0x28:0xc1b0eca0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 13 (g_event)

(kgdb) bt
#0  doadump (textdump=0) at pcpu.h:244
#1  0xc04a2bb3 in db_dump (dummy=-1068308991, dummy2=0, dummy3=-1, 
    dummy4=0xc1b0ea0c "") at /usr/src/sys/ddb/db_command.c:537
#2  0xc04a25f1 in db_command (last_cmdp=0xc08b003c, cmd_table=0x0, dopager=1)
    at /usr/src/sys/ddb/db_command.c:448
#3  0xc04a2755 in db_command_loop () at /usr/src/sys/ddb/db_command.c:501
#4  0xc04a47dc in db_trap (type=12, code=0) at /usr/src/sys/ddb/db_main.c:229
#5  0xc05c1bfd in kdb_trap (type=12, code=0, tf=0xc1b0ec40)
    at /usr/src/sys/kern/subr_kdb.c:625
#6  0xc07e6f9f in trap_fatal (frame=0xc1b0ec40, eva=16)
    at /usr/src/sys/i386/i386/trap.c:966
#7  0xc07e7099 in trap_pfault (frame=0xc1b0ec40, usermode=0, eva=16)
    at /usr/src/sys/i386/i386/trap.c:839
#8  0xc07e7ec7 in trap (frame=0xc1b0ec40) at /usr/src/sys/i386/i386/trap.c:558
#9  0xc07d3a6c in calltrap () at /usr/src/sys/i386/i386/exception.s:168
#10 0xc052e601 in g_vfs_orphan (cp=0xc1e79440) at atomic.h:246
#11 0xc052905d in g_run_events () at /usr/src/sys/geom/geom_event.c:211
#12 0xc052a648 in g_event_procbody (arg=0x0)
    at /usr/src/sys/geom/geom_kern.c:122
#13 0xc05631a2 in fork_exit (callout=0xc052a5e0 <g_event_procbody>, arg=0x0, 
    frame=0xc1b0ed28) at /usr/src/sys/kern/kern_fork.c:995
#14 0xc07d3ae4 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:275

>How-To-Repeat:
setup more than 2 gmirror names and shutdown
>Fix:
I don't have a solution but 
kernel with `svn sys/geom/geom_vfs.c -r 227014` dose not panic.

>Release-Note:
>Audit-Trail:
>Unformatted: