kern/162997: [geom] multiple gmirror cause kernel panic during shutdown

[Kaho Toshikazu]

The following reply was made to PR kern/162997; it has been noted by GNATS.

From: Kaho Toshikazu <kaho at elam.kais.kyoto-u.ac.jp>
To: Florian Smeets <flo at freebsd.org>
Cc: bug-followup at freebsd.org, Alexander Motin <mav at freebsd.org>
Subject: Re: kern/162997: [geom] multiple gmirror cause kernel panic during shutdown
Date: Mon, 05 Dec 2011 10:06:11 +0900

 Hello,
 
 I don't like to crash real machine many times and build test
 environment on qemu. md0p2a is labeled gm0 and md0p2h is gm1,
 and mount as UFS2. After sysctl kern.geom.debugflags=7,
 machine was rebooted. The copy from console before panic is here.
 
 open delta:[r-1w-1e-3] old:[r2w2e6] provider:[r2w2e6] 0xc14eac00(md0)
 g_post_event_x(0xc052c830, 0xc166c300, 2, 0)
   ref 0xc166c300
 g_post_event_x(0xc0a03e40, 0xc1446b00, 2, 0)
 g_wither_geom(0xc17ffa80(gm1.sync))
 GEOM_MIRROR: Device gm1 destroyed.
 g_wither_geom(0xc17ffb00(gm1))
 g_orphan_register(mirror/gm1)
 g_vfs_orphan(0xc1800400(ffs.mirror/gm1))
 kernel trap 12 with interrupts disabled
 
 The situation looks like this:
 gm1 was destroyed in g_vfs_close() and then g_vfs_orphan() was called to
 manipulate gm1. The function g_vfs_close() was freed softc and 
 g_vfs_orphan() would like to use softc already freed and it causes
 panic. 
 
 I think that malloc() in g_vfs_open() and free() in g_vfs_close()
 for mtx_lock is not valid method. malloc() should not be used,
 or fee() should be used in other function. Or correct other code
 which never call destroyed provider.
 
 --
 kaho Toshikazu