[geom] page fault in g_mbr_config()

[pluknet]

2009/7/24 pluknet <pluknet at gmail.com>:
> Hi.
>
> I got a panic while performing a repetitive  'fdisk -BI aacd0',
> where aacd0 is a disk on aac0: <IBM ServeRAID-8k>.
> This means that the command was issued after filesystems
> were already created on aacd (after the first fdisk -BI aacd0
> iteration), and are in umount'ed state.
>
> This is on 7.2-R, amd64. Config is a GENERIC plus ddb, carp, ipfw, quota.
>
> Fatal trap 12: page fault while in kernel mode
> cpuid = 5; apic id = 05
> fault virtual address   = 0x20
> fault code              = supervisor read data, page not present
> instruction pointer     = 0x8:0xffffffff804cc554
> stack pointer           = 0x10:0xfffffffe80079b80
> frame pointer           = 0x10:0xfffffffe80079bd0
> code segment            = base 0x0, limit 0xfffff, type 0x1b
>                        = DPL 0, pres 1, long 1, def32 0, gran 1
> processor eflags        = interrupt enabled, resume, IOPL = 0
> current process         = 2 (g_event)
> [thread pid 2 tid 100013 ]
> Stopped at      g_mbr_config+0x64:      movq    0x20(%rax),%r15
> db> bt
> Tracing pid 2 tid 100013 td 0xffffff000144da50
> g_mbr_config() at g_mbr_config+0x64
> g_run_events() at g_run_events+0x1b8
> g_event_procbody() at g_event_procbody+0x57
> fork_exit() at fork_exit+0x11f
> fork_trampoline() at fork_trampoline+0xe
> --- trap 0, rip = 0, rsp = 0xfffffffe80079d30, rbp = 0 ---

And, of course...

db> show proc 818
Process 818 (fdisk) at 0xffffff0004ed1000:
 state: NORMAL
 uid: 0  gids: 0, 0, 5
 parent: pid 814 at 0xffffff00045c0478
 ABI: FreeBSD ELF64
 arguments: fdisk
 threads: 1
100169                   D       g_waitfo 0xffffff0004ec9100 fdisk
db> bt 818
Tracing pid 818 tid 100169 td 0xffffff0004fbf6e0
sched_switch() at sched_switch+0x1fe
mi_switch() at mi_switch+0x18e
sleepq_timedwait() at sleepq_timedwait+0x31
_sleep() at _sleep+0x354
g_waitfor_event() at g_waitfor_event+0x9a
g_ctl_ioctl() at g_ctl_ioctl+0x2df
giant_ioctl() at giant_ioctl+0x7d
devfs_ioctl_f() at devfs_ioctl_f+0x77
kern_ioctl() at kern_ioctl+0xa2
ioctl() at ioctl+0xf9
syscall() at syscall+0x256
Xfast_syscall() at Xfast_syscall+0xab
--- syscall (54, FreeBSD ELF64, ioctl), rip = 0x8008200ec, rsp =
0x7fffffffe1d8, rbp = 0x4 ---

-- 
wbr,
pluknet