NetBSD Problem Report #44652

From hf@bounce.nt.e-technik.tu-darmstadt.de  Mon Feb 28 17:11:51 2011
Return-Path: <hf@bounce.nt.e-technik.tu-darmstadt.de>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
	by www.NetBSD.org (Postfix) with ESMTP id DED1D63B8E0
	for <gnats-bugs@gnats.NetBSD.org>; Mon, 28 Feb 2011 17:11:50 +0000 (UTC)
Message-Id: <201102281711.p1SHBkwr013390@bounce.nt.e-technik.tu-darmstadt.de>
Date: Mon, 28 Feb 2011 18:11:46 +0100 (CET)
From: Hauke Fath <hf@spg.tu-darmstadt.de>
Reply-To: Hauke Fath <hf@spg.tu-darmstadt.de>
To: gnats-bugs@gnats.NetBSD.org
Cc: Hauke Fath <hf@spg.tu-darmstadt.de>
Subject: 'gpt destroy' panics
X-Send-Pr-Version: 3.95

>Number:         44652
>Category:       kern
>Synopsis:       'gpt destroy' panics
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Feb 28 17:15:00 +0000 2011
>Closed-Date:    
>Last-Modified:  Wed Mar 16 06:14:23 +0000 2011
>Originator:     Hauke Fath
>Release:        NetBSD 5.1_STABLE
>Organization:
-- 
/~\  The ASCII Ribbon Campaign                      Hauke Fath
\ /    No HTML/RTF in email	          Institut für Nachrichtentechnik
 X     No Word docs in email	                    TU Darmstadt
/ \  Respect for open standards                Ruf +49-6151-16-3281
>Environment:


System: NetBSD amd64 5.99.47 install CD
Architecture: amd64
Machine: amd64
>Description:

	'gpt destroy raid0' when raid0 is on dk1 which has just been
	'dkctl delwedge'd panics the machine.

	For details, see the lovely picture (900 KByte) at
	<http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_panic.jpg>

>How-To-Repeat:

	Use gpt(8) to create a raid partition. Inside that raid
	partition, create another gpt with the usual few ffs & swap
	partitions. Find that the resulting assortment is not
	bootable (food for another PR).

	Boot from a -current amd64 install cd, descend to the command line.
	From here, 'dkctl raid0 delwedge dk?', then 'gpt remove dk?' 
	all the gpt partition table entries including the enclosing
	dk0.

	Proceed to 'gpt destroy raid' the inner gpt, and - bang!

>Fix:
	Yes, it's braindead, but these things happen. A serious OS
	should be able to sanity check parameters.

>Release-Note:

>Audit-Trail:
From: "Christos Zoulas" <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/44652 CVS commit: src/sys/dev/dkwedge
Date: Mon, 28 Feb 2011 13:28:20 -0500

 Module Name:	src
 Committed By:	christos
 Date:		Mon Feb 28 18:28:20 UTC 2011

 Modified Files:
 	src/sys/dev/dkwedge: dk.c

 Log Message:
 Make error checking consistent, possibly fixes PR/44652.


 To generate a diff of this commit:
 cvs rdiff -u -r1.58 -r1.59 src/sys/dev/dkwedge/dk.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->feedback
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Mon, 28 Feb 2011 22:48:47 +0000
State-Changed-Why:
did that help?


From: Hauke Fath <hf@spg.tu-darmstadt.de>
To: gnats-bugs@NetBSD.org
Cc: kern-bug-people@NetBSD.org, gnats-admin@NetBSD.org
Subject: Re: kern/44652: 'gpt destroy' panics
Date: Tue, 1 Mar 2011 10:58:40 +0100

 At 17:15 Uhr +0000 28.02.2011, Hauke Fath wrote:
 >	'gpt destroy raid0' when raid0 is on dk1 which has just been
 >	'dkctl delwedge'd panics the machine.
 >
 >	For details, see the lovely picture (900 KByte) at
 >	<http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_panic.jpg>

 And another one...

 I deconstructed wedges and gpts of the above installation in the right
 sequence, dd(1)ed the beginning of the disk, and ten seconds or so later
 was hit with
 <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_raid_panic.jpg>.

 	hauke

 -- 
      The ASCII Ribbon Campaign                    Hauke Fath
 ()     No HTML/RTF in email            Institut für Nachrichtentechnik
 /\     No Word docs in email                     TU Darmstadt
      Respect for open standards              Ruf +49-6151-16-3281

From: Christoph Egger <Christoph_Egger@gmx.de>
To: gnats-bugs@NetBSD.org
Cc: Hauke Fath <hf@spg.tu-darmstadt.de>, kern-bug-people@netbsd.org, 
 gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/44652: 'gpt destroy' panics
Date: Tue, 01 Mar 2011 11:08:59 +0100

 On 03/01/11 11:00, Hauke Fath wrote:
 > The following reply was made to PR kern/44652; it has been noted by GNATS.
 >
 > From: Hauke Fath<hf@spg.tu-darmstadt.de>
 > To: gnats-bugs@NetBSD.org
 > Cc: kern-bug-people@NetBSD.org, gnats-admin@NetBSD.org
 > Subject: Re: kern/44652: 'gpt destroy' panics
 > Date: Tue, 1 Mar 2011 10:58:40 +0100
 >
 >   At 17:15 Uhr +0000 28.02.2011, Hauke Fath wrote:
 >   >	'gpt destroy raid0' when raid0 is on dk1 which has just been
 >   >	'dkctl delwedge'd panics the machine.
 >   >
 >   >	For details, see the lovely picture (900 KByte) at
 >   >	<http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_panic.jpg>
 >
 >   And another one...
 >
 >   I deconstructed wedges and gpts of the above installation in the right
 >   sequence, dd(1)ed the beginning of the disk, and ten seconds or so later
 >   was hit with
 >   <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_raid_panic.jpg>.
 >
 >   	hauke

 The same assembler instruction in both cases. When you do
 'show register' in ddb (after the crash) and you see a line

    rax         0

 then the crash is caused by a NULL pointer dereference.

 When you built your kernel with makeoptions DEBUG="-g"
 then you have a netbsd.gdb file and you can do:

 gdb netbsd.gdb
 (gdb) list *(dkstrategy+0x1a)

 Christoph

From: Hauke Fath <hf@spg.tu-darmstadt.de>
To: gnats-bugs@NetBSD.org
Cc: kern-bug-people@NetBSD.org
Subject: Re: kern/44652: 'gpt destroy' panics
Date: Wed, 2 Mar 2011 11:41:57 +0100

 At 10:00 Uhr +0000 01.03.2011, Hauke Fath wrote:
 > I deconstructed wedges and gpts of the above installation in the right
 > sequence, dd(1)ed the beginning of the disk, and ten seconds or so later
 > was hit with
 > <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_raid_panic.jpg>.

 And another one

 <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_raidframe_panic.jpg>

 which I got while deconstructing wedges and partitions out of order. As
 Christoph pointed out, another null pointer issue; not sc though, which is
 checked in the caller dkstrategy().

 {Con, DE}structing the gpt setup was done with the scripts at

 <http://la.causeuse.org/hauke/NetBSD/gpt-issues/mk_gpt.sh>
 <http://la.causeuse.org/hauke/NetBSD/gpt-issues/rm_gpt.sh>

 with 'env testing=1 sh rm_gpt.sh' making a mess.

 	hauke

 -- 
      The ASCII Ribbon Campaign                    Hauke Fath
 ()     No HTML/RTF in email            Institut für Nachrichtentechnik
 /\     No Word docs in email                     TU Darmstadt
      Respect for open standards              Ruf +49-6151-16-3281

From: Hauke Fath <hf@spg.tu-darmstadt.de>
To: gnats-bugs@NetBSD.org
Cc: kern-bug-people@NetBSD.org, dholland@NetBSD.org
Subject: Re: kern/44652 ('gpt destroy' panics)
Date: Wed, 2 Mar 2011 11:44:53 +0100

 At 22:48 Uhr +0000 28.02.2011, dholland@NetBSD.org wrote:

 [Christos' commit]

 >did that help?

 Yes. I see a bunch of error messages, but no panic.

 Repeatedly {con,de}structing the setup still brings up a panic (see my
 other mail).

 	hauke

 -- 
      The ASCII Ribbon Campaign                    Hauke Fath
 ()     No HTML/RTF in email            Institut fŸr Nachrichtentechnik
 /\     No Word docs in email                     TU Darmstadt
      Respect for open standards              Ruf +49-6151-16-3281

From: Christoph Egger <Christoph_Egger@gmx.de>
To: gnats-bugs@NetBSD.org
Cc: Hauke Fath <hf@spg.tu-darmstadt.de>, kern-bug-people@netbsd.org, 
 gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/44652: 'gpt destroy' panics
Date: Wed, 02 Mar 2011 12:07:32 +0100

 On 03/02/11 11:45, Hauke Fath wrote:
 > The following reply was made to PR kern/44652; it has been noted by GNATS.
 >
 > From: Hauke Fath<hf@spg.tu-darmstadt.de>
 > To: gnats-bugs@NetBSD.org
 > Cc: kern-bug-people@NetBSD.org
 > Subject: Re: kern/44652: 'gpt destroy' panics
 > Date: Wed, 2 Mar 2011 11:41:57 +0100
 >
 >   At 10:00 Uhr +0000 01.03.2011, Hauke Fath wrote:
 >   >  I deconstructed wedges and gpts of the above installation in the right
 >   >  sequence, dd(1)ed the beginning of the disk, and ten seconds or so later
 >   >  was hit with
 >   >  <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_raid_panic.jpg>.
 >
 >   And another one
 >
 >   <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_raidframe_panic.jpg>
 >
 >   which I got while deconstructing wedges and partitions out of order. As
 >   Christoph pointed out, another null pointer issue; not sc though, which is
 >   checked in the caller dkstrategy().

 This time the crash happens in sys/dev/dkwedge/dk.c, line 1200:

        nbp->b_dev = sc->sc_parent->dk_rawvp->v_rdev;

 dk_rawvp is NULL.

 Christoph

 >
 >   {Con, DE}structing the gpt setup was done with the scripts at
 >
 >   <http://la.causeuse.org/hauke/NetBSD/gpt-issues/mk_gpt.sh>
 >   <http://la.causeuse.org/hauke/NetBSD/gpt-issues/rm_gpt.sh>
 >
 >   with 'env testing=1 sh rm_gpt.sh' making a mess.


From: Christoph Egger <Christoph_Egger@gmx.de>
To: gnats-bugs@NetBSD.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org, 
 netbsd-bugs@netbsd.org, Hauke Fath <hf@spg.tu-darmstadt.de>
Subject: Re: kern/44652: 'gpt destroy' panics
Date: Thu, 03 Mar 2011 07:56:20 +0100

 On 02.03.11 12:15, Christoph Egger wrote:
 > The following reply was made to PR kern/44652; it has been noted by GNATS.
 > 
 > From: Christoph Egger <Christoph_Egger@gmx.de>
 > To: gnats-bugs@NetBSD.org
 > Cc: Hauke Fath <hf@spg.tu-darmstadt.de>, kern-bug-people@netbsd.org, 
 >  gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
 > Subject: Re: kern/44652: 'gpt destroy' panics
 > Date: Wed, 02 Mar 2011 12:07:32 +0100
 > 
 >  On 03/02/11 11:45, Hauke Fath wrote:
 >  > The following reply was made to PR kern/44652; it has been noted by GNATS.
 >  >
 >  > From: Hauke Fath<hf@spg.tu-darmstadt.de>
 >  > To: gnats-bugs@NetBSD.org
 >  > Cc: kern-bug-people@NetBSD.org
 >  > Subject: Re: kern/44652: 'gpt destroy' panics
 >  > Date: Wed, 2 Mar 2011 11:41:57 +0100
 >  >
 >  >   At 10:00 Uhr +0000 01.03.2011, Hauke Fath wrote:
 >  >   >  I deconstructed wedges and gpts of the above installation in the right
 >  >   >  sequence, dd(1)ed the beginning of the disk, and ten seconds or so later
 >  >   >  was hit with
 >  >   >  <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_raid_panic.jpg>.
 >  >
 >  >   And another one
 >  >
 >  >   <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_raidframe_panic.jpg>
 >  >
 >  >   which I got while deconstructing wedges and partitions out of order. As
 >  >   Christoph pointed out, another null pointer issue; not sc though, which is
 >  >   checked in the caller dkstrategy().
 >  
 >  This time the crash happens in sys/dev/dkwedge/dk.c, line 1200:
 >  
 >         nbp->b_dev = sc->sc_parent->dk_rawvp->v_rdev;
 >  
 >  dk_rawvp is NULL.

 Please update said file from cvs and retry.

 --------------------------------------------------
 Module Name:	src
 Committed By:	christos
 Date:		Thu Mar  3 03:39:08 UTC 2011

 Modified Files:
 	src/sys/dev/dkwedge: dk.c

 Log Message:
 check rawvp before doing ioctl or strategy.


 To generate a diff of this commit:
 cvs rdiff -u -r1.59 -r1.60 src/sys/dev/dkwedge/dk.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.
 --------------------------------------------------

 Christoph

From: Hauke Fath <hf@spg.tu-darmstadt.de>
To: Christoph Egger <Christoph_Egger@gmx.de>
Cc: gnats-bugs@NetBSD.org, kern-bug-people@NetBSD.org, gnats-admin@NetBSD.org
Subject: Re: kern/44652: 'gpt destroy' panics
Date: Thu, 3 Mar 2011 13:24:06 +0100

 At 7:56 Uhr +0100 03.03.2011, Christoph Egger wrote:
 >>  This time the crash happens in sys/dev/dkwedge/dk.c, line 1200:
 >>
 >>         nbp->b_dev = sc->sc_parent->dk_rawvp->v_rdev;
 >>
 >>  dk_rawvp is NULL.
 >
 >Please update said file from cvs and retry.

 Looks good - the panic is gone.

 Instead, the kernel is left in a state where the raid0 can neither be
 created ("device busy") nor destroyed ("device not configured"), and you
 have to reboot to clean up. Which, I guess, is not nice, but acceptable.

 	hauke

 -- 
      The ASCII Ribbon Campaign                    Hauke Fath
 ()     No HTML/RTF in email            Institut für Nachrichtentechnik
 /\     No Word docs in email                     TU Darmstadt
      Respect for open standards              Ruf +49-6151-16-3281

State-Changed-From-To: feedback->open
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Wed, 16 Mar 2011 06:14:23 +0000
State-Changed-Why:
no, that's not acceptable :-)


>Unformatted:

NetBSD Home
NetBSD PR Database Search

(Contact us) $NetBSD: query-full-pr,v 1.39 2013/11/01 18:47:49 spz Exp $
$NetBSD: gnats_config.sh,v 1.8 2006/05/07 09:23:38 tsutsui Exp $
Copyright © 1994-2007 The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.