7.0 panic in geom / ufs

[Steven Hartland]

We have had the following panic now twice on one of our hosting
boxes running 7.0-RELEASE (amd64)

>From a basic look around it seems that when running the following
that provider (pp) is invalid.
364             g_trace(G_T_BIO, "bio_request(%p) from %p(%s) to %p(%s) cmd %d",
365                 bp, cp, cp->geom->name, pp, pp->name, bp->bio_cmd);

Does anyone know their been any fixes in this area in stable that
we should be applying?

The contributing factor here could be we have a single slice
mounted several times read only in a number of jails?


Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x50006
fault code              = supervisor read data, page not present
instruction pointer     = 0x8:0xffffffff8023e3c6
stack pointer           = 0x10:0xffffffffae39f7e0
frame pointer           = 0x10:0xffffff00a18a5400
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 55130 (vim)
trap number             = 12
panic: page fault
cpuid = 1
Uptime: 40d17h22m13s
Physical memory: 4088 MB
Dumping 520 MB: 505 489 473 457 441 425 409 393 377 361 345 329 313 297 281 265 249 233 217 201 185 169 153 137 121 105 89 73 57 
41 25 9

#0  doadump () at pcpu.h:194
194             __asm __volatile("movq %%gs:0,%0" : "=r" (td));
(kgdb) list *0x8:0xffffffff8023e3c6
A syntax error in expression, near `:0xffffffff8023e3c6'.
(kgdb) list *0xffffffff8023e3c6
0xffffffff8023e3c6 is in g_io_request (/usr/src/sys/geom/geom_io.c:364).
359                     KASSERT(bp->bio_length % cp->provider->sectorsize == 0,
360                         ("wrong length %jd for sectorsize %u",
361                         bp->bio_length, cp->provider->sectorsize));
362             }
363
364             g_trace(G_T_BIO, "bio_request(%p) from %p(%s) to %p(%s) cmd %d",
365                 bp, cp, cp->geom->name, pp, pp->name, bp->bio_cmd);
366
367             bp->bio_from = cp;
368             bp->bio_to = pp;
(kgdb) bt
#0  doadump () at pcpu.h:194
#1  0x0000000000000004 in ?? ()
#2  0xffffffff80288869 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#3  0xffffffff80288c6d in panic (fmt=0x104 <Address 0x104 out of bounds>) at /usr/src/sys/kern/kern_shutdown.c:563
#4  0xffffffff803d6624 in trap_fatal (frame=0xffffff00713c79f0, eva=18446742976103034880) at /usr/src/sys/amd64/amd64/trap.c:724
#5  0xffffffff803d69f5 in trap_pfault (frame=0xffffffffae39f730, usermode=0) at /usr/src/sys/amd64/amd64/trap.c:641
#6  0xffffffff803d7338 in trap (frame=0xffffffffae39f730) at /usr/src/sys/amd64/amd64/trap.c:410
#7  0xffffffff803bcfae in calltrap () at /usr/src/sys/amd64/amd64/exception.S:169
#8  0xffffffff8023e3c6 in g_io_request (bp=0xffffff011c81d000, cp=0xffffff00a18a5400) at /usr/src/sys/geom/geom_io.c:364
#9  0xffffffff8038643f in ufs_strategy (ap=Variable "ap" is not available.
) at /usr/src/sys/ufs/ufs/ufs_vnops.c:1997
#10 0xffffffff802e9ce9 in bufstrategy (bo=Variable "bo" is not available.
) at vnode_if.h:935
#11 0xffffffff802f05b0 in breadn (vp=0xffffff001b1135d0, blkno=Variable "blkno" is not available.
) at buf.h:429
#12 0xffffffff802f064a in bread (vp=Variable "vp" is not available.
) at /usr/src/sys/kern/vfs_bio.c:734
#13 0xffffffff8037c72a in ffs_read (ap=Variable "ap" is not available.
) at /usr/src/sys/ufs/ffs/ffs_vnops.c:531
#14 0xffffffff80387913 in ufs_readdir (ap=0xffffffffae39fa70) at vnode_if.h:344
#15 0xffffffff8030d91f in getdirentries (td=0xffffff00713c79f0, uap=0xffffffffae39fbe0) at vnode_if.h:747
#16 0xffffffff803d6c77 in syscall (frame=0xffffffffae39fc70) at /usr/src/sys/amd64/amd64/trap.c:852
#17 0xffffffff803bd1bb in Xfast_syscall () at /usr/src/sys/amd64/amd64/exception.S:290
#18 0x00000008009a4c7c in ?? ()
Previous frame inner to this frame (corrupt stack?)

(kgdb) up 8
#8  0xffffffff8023e3c6 in g_io_request (bp=0xffffff006ae6f870, cp=0xffffff0001b5ee00) at /usr/src/sys/geom/geom_io.c:364
364             g_trace(G_T_BIO, "bio_request(%p) from %p(%s) to %p(%s) cmd %d",
(kgdb) print bp
$1 = (struct bio *) 0xffffff006ae6f870
(kgdb) print *bp
$2 = {bio_cmd = 1 '\001', bio_flags = 0 '\0', bio_cflags = 0 '\0', bio_pflags = 0 '\0', bio_dev = 0x0, bio_disk = 0x0,
  bio_offset = 8861696000, bio_bcount = 0, bio_data = 0xffffffffa52bb000 "«\236Ñ­­", bio_error = 0, bio_resid = 0,
  bio_done = 0xffffffff80242560 <g_vfs_done>, bio_driver1 = 0x0, bio_driver2 = 0x0, bio_caller1 = 0x0,
  bio_caller2 = 0xffffffff9a0ac820, bio_queue = {tqe_next = 0x0, tqe_prev = 0x0}, bio_attribute = 0x0, bio_from = 0x0,
  bio_to = 0x0, bio_length = 16384, bio_completed = 0, bio_children = 0, bio_inbed = 0, bio_parent = 0x0, bio_t0 = {sec = 0,
    frac = 0}, bio_task = 0, bio_task_arg = 0x0, bio_pblkno = 0}
(kgdb) print cp
$3 = (struct g_consumer *) 0xffffff0001b5ee00
(kgdb) print *cp
$4 = {geom = 0xffffff0001519ca0, consumer = {le_next = 0x0, le_prev = 0xffffffff99c83cf8}, provider = 0x50006, consumers = {
    le_next = 0xffffff0001b5e680, le_prev = 0xffffff00699900f8}, acr = 92, acw = 0, ace = 175272032, spoiled = 0, stat = 0x0,
  nstart = 0, nend = 0, private = 0xffffff00699900c0, index = 28698240}
(kgdb) print cp->geom
$5 = (struct g_geom *) 0xffffff0001519ca0
(kgdb) print *cp->geom
$6 = {name = 0xffffffff80453365 "vfslock", class = 0xffffffff80453365, geom = {le_next = 0x4390000, le_prev = 0x0}, consumer = {
    lh_first = 0xffffffff805f7760}, provider = {lh_first = 0x0}, geoms = {tqe_next = 0x50000000000000, tqe_prev = 0x0}, rank = -1,
  start = 0, spoiled = 0xffffffff80453354 <sun_noname+4740>, dumpconf = 0xffffffff80453354 <sun_noname+4740>, access = 0x1030000,
  orphan = 0, ioctl = 0x4, softc = 0x0, flags = 1}
(kgdb) print *pp
Cannot access memory at address 0x50006
(kgdb) print pp
$7 = (struct g_provider *) 0x50006 


================================================
This e.mail is private and confidential between Multiplay (UK) Ltd. and the person or entity to whom it is addressed. In the event of misdirection, the recipient is prohibited from using, copying, printing or otherwise disseminating it or any information contained in it. 

In the event of misdirection, illegible or incomplete transmission please telephone +44 845 868 1337
or return the E.mail to postmaster at multiplay.co.uk.