[Bug 237269] panic in glabel stop after resizing GPT partition

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=237269

            Bug ID: 237269
           Summary: panic in glabel stop after resizing GPT partition
           Product: Base System
           Version: 11.2-STABLE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs at FreeBSD.org
          Reporter: andrew at tao11.riddles.org.uk

Tested on stable/11 at r346167, but the backtrace below comes from an older
stable/11 build (maybe 2 months back).

To reproduce:

md_unit=$(mdconfig -t swap -s 30MB)
geom part create -s GPT "$md_unit"
geom part add -s 10M -t linux-swap -l tst0 "$md_unit"
geom part resize -i 1 -s 20M "$md_unit"

# at this point "glabel status" shows two gpt/tst0 entries,
# one of which has no consumer; trying to correct this causes
# a panic:

glabel stop gpt/tst0
glabel stop gpt/tst0  # BOOM

Trace:

#1  doadump (textdump=<optimized out>)
    at /usr/src/sys/kern/kern_shutdown.c:315
#2  0xffffffff80468255 in kern_reboot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:383
#3  0xffffffff80468621 in vpanic (fmt=<optimized out>, ap=0xfffffe022c5c25f0)
    at /usr/src/sys/kern/kern_shutdown.c:776
#4  0xffffffff80468463 in panic (fmt=<unavailable>)
    at /usr/src/sys/kern/kern_shutdown.c:707
#5  0xffffffff80722faf in trap_fatal (frame=0xfffffe022c5c27e0, eva=0)
    at /usr/src/sys/amd64/amd64/trap.c:904
#6  0xffffffff80723009 in trap_pfault (frame=0xfffffe022c5c27e0, usermode=0)
    at /usr/src/sys/amd64/amd64/trap.c:744
#7  0xffffffff80722732 in trap (frame=0xfffffe022c5c27e0)
    at /usr/src/sys/amd64/amd64/trap.c:438
#8  <signal handler called>
#9  g_slice_spoiled (cp=0x0) at /usr/src/sys/geom/geom_slice.c:511
#10 0xffffffff80f826d0 in g_label_destroy (force=<optimized out>, 
    gp=<optimized out>) at /usr/src/sys/geom/label/g_label.c:267
#11 g_label_ctl_destroy (req=<optimized out>, mp=<optimized out>)
    at /usr/src/sys/geom/label/g_label.c:514
#12 g_label_config (req=0xfffffe0236bb67c0, 
    mp=0xffffffff80f84fd8 <g_label_class>, verb=<optimized out>)
    at /usr/src/sys/geom/label/g_label.c:545
#13 0xffffffff803f9700 in one_event () at /usr/src/sys/geom/geom_event.c:264
#14 g_run_events () at /usr/src/sys/geom/geom_event.c:286
#15 0xffffffff804374d5 in fork_exit (
    callout=0xffffffff803fb820 <g_event_procbody>, arg=0x0, 
    frame=0xfffffe022c5c29c0) at /usr/src/sys/kern/kern_fork.c:1072
#16 <signal handler called>

g_label_destroy clearly isn't expecting the case where the label has no
consumer at all.

-- 
You are receiving this mail because:
You are the assignee for the bug.