panic: Wrong vnode in bufstrategy(bp=0xc5e058c0, vp=0xc1615238)

[Aurelien Nephtali]

Hello,

Since the recent commits by phk@, I can't mount any NTFS file system without
getting a :

panic: Wrong vnode in bufstrategy(bp=0xc5e058c0, vp=0xc1615238)


Trace output as well as dmesg output are attached.

Thanks!
-- 
NEPHTALI 'dak' Aurelien

-------------- next part --------------
Copyright (c) 1992-2004 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
	The Regents of the University of California. All rights reserved.
FreeBSD 6.0-CURRENT #297: Sun Oct 31 14:24:31 CET 2004
    dak at nebula.wanadoo.fr:/usr/src/sys/i386/compile/NEBULA
WARNING: WITNESS option enabled, expect reduced performance.
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: Mobile Intel(R) Celeron(R) CPU 2.00GHz (1993.72-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0xf27  Stepping = 7
  Features=0xbfebf9ff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
real memory  = 251068416 (239 MB)
avail memory = 240230400 (229 MB)
acpi0: <PTLTD   RSDT> on motherboard
acpi0: Power Button (fixed)
unknown: I/O range not supported
acpi_ec0: <Embedded Controller: GPE 0x18> port 0x66,0x62 on acpi0
acpi_ec0: info: new max delay is 390 us
Timecounter "ACPI-safe" frequency 3579545 Hz quality 1000
acpi_timer0: <32-bit timer at 3.579545MHz> port 0x8008-0x800b on acpi0
cpu0: <ACPI CPU (2 Cx states)> on acpi0
acpi_tz0: <Thermal Zone> on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
pcib1: <ACPI PCI-PCI bridge> at device 1.0 on pci0
pci1: <ACPI PCI bus> on pcib1
acpi_video0: <ACPI video extension> port 0x9000-0x90ff mem 0xd4300000-0xd430ffff,0xdc000000-0xdfffffff at device 5.0 on pci1
ohci0: <AcerLabs M5237 (Aladdin-V) USB controller> mem 0xd4000000-0xd4000fff irq 10 at device 2.0 on pci0
ohci0: [GIANT-LOCKED]
usb0: OHCI version 1.0, legacy support
usb0: SMM does not respond, resetting
usb0: <AcerLabs M5237 (Aladdin-V) USB controller> on ohci0
usb0: USB revision 1.0
uhub0: AcerLabs OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 4 ports with 4 removable, self powered
pcm0: <Acer Labs M5451> port 0x1000-0x10ff mem 0xd4001000-0xd4001fff irq 5 at device 6.0 on pci0
pcm0: <Conexant CX20468 AC97 Codec>
pcm0: [GIANT-LOCKED]
isab0: <PCI-ISA bridge> at device 7.0 on pci0
isa0: <ISA bus> on isab0
pci0: <simple comms> at device 8.0 (no driver attached)
cbb0: <O2Micro OZ6912/6972 PCI-CardBus Bridge> mem 0xd4003000-0xd4003fff at device 10.0 on pci0
cardbus0: <CardBus bus> on cbb0
pccard0: <16-bit PCCard bus> on cbb0
atapci0: <AcerLabs Aladdin UDMA100 controller> port 0x2000-0x200f,0x376,0x170-0x177,0x3f6,0x1f0-0x1f7 at device 16.0 on pci0
ata0: channel #0 on atapci0
ata1: channel #1 on atapci0
pci0: <bridge, PCI-unknown> at device 17.0 (no driver attached)
sis0: <NatSemi DP8381[56] 10/100BaseTX> port 0x2400-0x24ff mem 0xd4004000-0xd4004fff irq 10 at device 18.0 on pci0
sis0: Silicon Revision: DP83816A
miibus0: <MII bus> on sis0
ukphy0: <Generic IEEE 802.3u media interface> on miibus0
ukphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
sis0: Ethernet address: 00:0b:cd:a7:1b:f2
acpi_button0: <Power Button> on acpi0
acpi_lid0: <Control Method Lid Switch> on acpi0
acpi_acad0: <AC Adapter> on acpi0
acpi_cmbat0: <Control Method Battery> on acpi0
atkbdc0: <Keyboard controller (i8042)> port 0x64,0x60 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
psm0: <PS/2 Mouse> irq 12 on atkbdc0
psm0: [GIANT-LOCKED]
psm0: model IntelliMouse, device ID 3
uart0: <16550 or compatible> port 0x3f8-0x3ff irq 4 on acpi0
npx0: [FAST]
npx0: <math processor> on motherboard
npx0: INT 16 interface
orm0: <ISA Option ROMs> at iomem 0xe0000-0xe3fff,0xdf000-0xdffff,0xcf000-0xcf7ff,0xc0000-0xcefff on isa0
pmtimer0 on isa0
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
Timecounter "TSC" frequency 1993722780 Hz quality 800
Timecounters tick every 10.000 msec
Sleeping on "acsem" with the following non-sleepable locks held:
exclusive sleep mutex acpica subsystem lock r = 0 (0xc11109c0) locked @ dev/acpica/Osd/OsdSynch.c:360
KDB: stack backtrace:
witness_warn(5,c1110b40,c064b29f,c0635139,cb283be8) at witness_warn+0x1a8
msleep(c1110b40,c1110b40,100,c0635139,0) at msleep+0x37
AcpiOsWaitSemaphore(c1110b40,1,ffff) at AcpiOsWaitSemaphore+0x140
AcpiUtAcquireMutex(7,c116be40,18,cb283c9c,c046351e) at AcpiUtAcquireMutex+0x55
AcpiDisableGpe(0,18,1,c1167920,cb283cb0) at AcpiDisableGpe+0x17
EcGpeHandler(c116be40,0,c11620c0,cb283ce4,c0445849) at EcGpeHandler+0x1a
AcpiEvGpeDispatch(c1167920) at AcpiEvGpeDispatch+0x81
AcpiEvGpeDetect(c111f980,c1168100,cb283d1c,c0504afa,c111f980) at AcpiEvGpeDetect+0xd1
AcpiEvSciXruptHandler(c111f980,0,1387,c10d9000,0) at AcpiEvSciXruptHandler+0x13
ithread_loop(c10ac900,cb283d48,c10ac900,c050496c,0) at ithread_loop+0x18e
fork_exit(c050496c,c10ac900,cb283d48) at fork_exit+0x7e
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xcb283d7c, ebp = 0 ---
cpu0: set speed to 100.0%
acpi_cpu: throttling enabled, 8 steps (100% to 12.5%), currently 100.0%
acpi_acad0: acline initialization start
acpi_acad0: On Line
acpi_acad0: acline initialization done, tried 1 times
acpi_cmbat0: battery initialization start
acpi_ec0: info: new max delay is 760 us
ad0: 28615MB <HITACHI DK23EA-30/00K4A0A2> [58140/16/63] at ata0-master UDMA100
Mounting root from ufs:/dev/ad0s2a
WARNING: / was not properly dismounted
WARNING: /tmp was not properly dismounted
WARNING: /usr was not properly dismounted
/usr: mount pending error: blocks 518568 files 4
WARNING: /var was not properly dismounted
acpi_ec0: info: new max delay is 21000 us
acpi_cmbat0: battery initialization done, tried 3 times
-------------- next part --------------
Script started on Sun Oct 31 15:52:04 2004

nebula# /home/dakkkgdb /sys/i386/compile/NEBULA/kernel.debug /home/crash/vmcore.2

[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".
doadump () at pcpu.h:159
(kgdb) bt
#0  doadump () at pcpu.h:159
#1  0xc04591b2 in db_fncall (dummy1=-1067484123, dummy2=0, dummy3=-875677880, 
    dummy4=0xcbce36e0 "\0247??") at ../../../ddb/db_command.c:531
#2  0xc0459548 in db_command_loop () at ../../../ddb/db_command.c:349
#3  0xc045af50 in db_trap (type=3, code=0) at ../../../ddb/db_main.c:221
#4  0xc052c970 in kdb_trap (type=3, code=0, tf=0xc06a52a0)
    at ../../../kern/subr_kdb.c:421
#5  0xc06058cc in trap (frame=
      {tf_fs = -875692008, tf_es = -1068367856, tf_ds = -1067188208, tf_edi = -1054459264, tf_esi = 1, tf_ebp = -875677628, tf_isp = -875677648, tf_ebx = -875677588, tf_edx = -1067144283, tf_ecx = -1066777600, tf_eax = -1067136153, tf_trapno = 3, tf_err = 0, tf_eip = -1068317256, tf_cs = 8, tf_eflags = 646, tf_esp = -875677600, tf_ss = -1068407498}) at ../../../i386/i386/trap.c:576
#6  0xc05f969a in calltrap () at ../../../i386/i386/exception.s:140
#7  0xcbce0018 in ?? ()
#8  0xc0520010 in thread_unlink (td=0xcbce386c)
    at ../../../kern/kern_thread.c:748
#9  0xc0516536 in panic (fmt=0x8 <Address 0x8 out of bounds>)
    at ../../../kern/kern_shutdown.c:525
#10 0xc055c699 in bufstrategy (bo=0x0, bp=0xc5e058c0)
    at ../../../kern/vfs_bio.c:3815
#11 0xc055bc02 in breadn (vp=0xc1615238, blkno=0, size=1024, rablkno=0x0, 
    rabsize=0x0, cnt=0, cred=0x0, bpp=0x0) at buf.h:418
#12 0xc055c024 in bread (vp=0xc1615238, blkno=0, size=1024, cred=0x0, 
---Type <return> to continue, or q <return> to quit---
    bpp=0xcbce3958) at ../../../kern/vfs_bio.c:709
#13 0xc04e1adf in ntfs_mountfs (devvp=0xc1615238, mp=0xc1172000, 
    argsp=0xcbce3af0, td=0xc1263a80) at ../../../fs/ntfs/ntfs_vfsops.c:290
#14 0xc04e2125 in ntfs_omount (mp=0xc1172000, path=0xc1363500 "/mnt/win", 
    data=0xbfbfec2c <Address 0xbfbfec2c out of bounds>, td=0xc1263a80)
    at ../../../fs/ntfs/ntfs_vfsops.c:235
#15 0xc0562ad4 in vfs_domount (td=0xc1263a80, fstype=0xc12781a0 "ntfs", 
    fspath=0xc1363500 "/mnt/win", fsflags=0, fsdata=0xbfbfec2c, compat=1)
    at ../../../kern/vfs_mount.c:863
#16 0xc056320f in mount (td=0xc1263a80, uap=0xcbce3d14)
    at ../../../kern/vfs_mount.c:622
#17 0xc0605cc4 in syscall (frame=
      {tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 0, tf_esi = -1077942324, tf_ebp = -1077941036, tf_isp = -875676300, tf_ebx = -1077940737, tf_edx = 0, tf_ecx = 0, tf_eax = 21, tf_trapno = 12, tf_err = 2, tf_eip = 671926679, tf_cs = 31, tf_eflags = 518, tf_esp = -1077942404, tf_ss = 47})
    at ../../../i386/i386/trap.c:1001
#18 0xc05f96ef in Xint0x80_syscall () at ../../../i386/i386/exception.s:201
#19 0x0000002f in ?? ()
#20 0x0000002f in ?? ()
#21 0x0000002f in ?? ()
#22 0x00000000 in ?? ()
#23 0xbfbfe7cc in ?? ()
#24 0xbfbfecd4 in ?? ()
---Type <return> to continue, or q <return> to quit---
#25 0xcbce3d74 in ?? ()
#26 0xbfbfedff in ?? ()
#27 0x00000000 in ?? ()
#28 0x00000000 in ?? ()
#29 0x00000015 in ?? ()
#30 0x0000000c in ?? ()
#31 0x00000002 in ?? ()
#32 0x280cc997 in ?? ()
#33 0x0000001f in ?? ()
#34 0x00000206 in ?? ()
#35 0xbfbfe77c in ?? ()
#36 0x0000002f in ?? ()
#37 0x00000000 in ?? ()
#38 0x00000000 in ?? ()
#39 0x00000000 in ?? ()
#40 0x00000000 in ?? ()
#41 0x0d02b000 in ?? ()
#42 0xc12f1200 in ?? ()
#43 0xc1263a80 in ?? ()
#44 0xcbce386c in ?? ()
#45 0xcbce3854 in ?? ()
#46 0xc10da480 in ?? ()
#47 0xc0525c9b in sched_switch (td=0xbfbfe7cc, newtd=0xbfbfedff, flags=Cannot access memory at address 0xbfbfece4
)
    at ../../../kern/sched_4bsd.c:865
Previous frame inner to this frame (corrupt stack?)
(kgdb) f 10
#10 0xc055c699 in bufstrategy (bo=0x0, bp=0xc5e058c0)
    at ../../../kern/vfs_bio.c:3815
3815		KASSERT(i == 0, ("VOP_STRATEGY failed bp=%p vp=%p", bp, bp->b_vp));
(kgdb) list
3810		vp = bp->b_vp;
3811		KASSERT(vp == bo->bo_private, ("Inconsistent vnode bufstrategy"));
3812		KASSERT(vp->v_type != VCHR && vp->v_type != VBLK,
3813		    ("Wrong vnode in bufstrategy(bp=%p, vp=%p)", bp, vp));
3814		i = VOP_STRATEGY(vp, bp);
3815		KASSERT(i == 0, ("VOP_STRATEGY failed bp=%p vp=%p", bp, bp->b_vp));
3816	}
3817	
3818	void
3819	bufobj_wref(struct bufobj *bo)
(kgdb) p bp
$1 = (struct buf *) 0xc5e058c0
(kgdb) p bp->b_vp
$2 = (struct vnode *) 0xc1615238
(kgdb) p i
No symbol "i" in current context.
(kgdb) 
nebula# /home/dak


Script done on Sun Oct 31 15:53:08 2004