NetBSD Problem Report #44652
From hf@bounce.nt.e-technik.tu-darmstadt.de Mon Feb 28 17:11:51 2011
Return-Path: <hf@bounce.nt.e-technik.tu-darmstadt.de>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
by www.NetBSD.org (Postfix) with ESMTP id DED1D63B8E0
for <gnats-bugs@gnats.NetBSD.org>; Mon, 28 Feb 2011 17:11:50 +0000 (UTC)
Message-Id: <201102281711.p1SHBkwr013390@bounce.nt.e-technik.tu-darmstadt.de>
Date: Mon, 28 Feb 2011 18:11:46 +0100 (CET)
From: Hauke Fath <hf@spg.tu-darmstadt.de>
Reply-To: Hauke Fath <hf@spg.tu-darmstadt.de>
To: gnats-bugs@gnats.NetBSD.org
Cc: Hauke Fath <hf@spg.tu-darmstadt.de>
Subject: 'gpt destroy' panics
X-Send-Pr-Version: 3.95
>Number: 44652
>Category: kern
>Synopsis: 'gpt destroy' panics
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: kern-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Mon Feb 28 17:15:00 +0000 2011
>Closed-Date:
>Last-Modified: Wed Mar 16 06:14:23 +0000 2011
>Originator: Hauke Fath
>Release: NetBSD 5.1_STABLE
>Organization:
--
/~\ The ASCII Ribbon Campaign Hauke Fath
\ / No HTML/RTF in email Institut für Nachrichtentechnik
X No Word docs in email TU Darmstadt
/ \ Respect for open standards Ruf +49-6151-16-3281
>Environment:
System: NetBSD amd64 5.99.47 install CD
Architecture: amd64
Machine: amd64
>Description:
'gpt destroy raid0' when raid0 is on dk1 which has just been
'dkctl delwedge'd panics the machine.
For details, see the lovely picture (900 KByte) at
<http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_panic.jpg>
>How-To-Repeat:
Use gpt(8) to create a raid partition. Inside that raid
partition, create another gpt with the usual few ffs & swap
partitions. Find that the resulting assortment is not
bootable (food for another PR).
Boot from a -current amd64 install cd, descend to the command line.
From here, 'dkctl raid0 delwedge dk?', then 'gpt remove dk?'
all the gpt partition table entries including the enclosing
dk0.
Proceed to 'gpt destroy raid' the inner gpt, and - bang!
>Fix:
Yes, it's braindead, but these things happen. A serious OS
should be able to sanity check parameters.
>Release-Note:
>Audit-Trail:
From: "Christos Zoulas" <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/44652 CVS commit: src/sys/dev/dkwedge
Date: Mon, 28 Feb 2011 13:28:20 -0500
Module Name: src
Committed By: christos
Date: Mon Feb 28 18:28:20 UTC 2011
Modified Files:
src/sys/dev/dkwedge: dk.c
Log Message:
Make error checking consistent, possibly fixes PR/44652.
To generate a diff of this commit:
cvs rdiff -u -r1.58 -r1.59 src/sys/dev/dkwedge/dk.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
State-Changed-From-To: open->feedback
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Mon, 28 Feb 2011 22:48:47 +0000
State-Changed-Why:
did that help?
From: Hauke Fath <hf@spg.tu-darmstadt.de>
To: gnats-bugs@NetBSD.org
Cc: kern-bug-people@NetBSD.org, gnats-admin@NetBSD.org
Subject: Re: kern/44652: 'gpt destroy' panics
Date: Tue, 1 Mar 2011 10:58:40 +0100
At 17:15 Uhr +0000 28.02.2011, Hauke Fath wrote:
> 'gpt destroy raid0' when raid0 is on dk1 which has just been
> 'dkctl delwedge'd panics the machine.
>
> For details, see the lovely picture (900 KByte) at
> <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_panic.jpg>
And another one...
I deconstructed wedges and gpts of the above installation in the right
sequence, dd(1)ed the beginning of the disk, and ten seconds or so later
was hit with
<http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_raid_panic.jpg>.
hauke
--
The ASCII Ribbon Campaign Hauke Fath
() No HTML/RTF in email Institut für Nachrichtentechnik
/\ No Word docs in email TU Darmstadt
Respect for open standards Ruf +49-6151-16-3281
From: Christoph Egger <Christoph_Egger@gmx.de>
To: gnats-bugs@NetBSD.org
Cc: Hauke Fath <hf@spg.tu-darmstadt.de>, kern-bug-people@netbsd.org,
gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/44652: 'gpt destroy' panics
Date: Tue, 01 Mar 2011 11:08:59 +0100
On 03/01/11 11:00, Hauke Fath wrote:
> The following reply was made to PR kern/44652; it has been noted by GNATS.
>
> From: Hauke Fath<hf@spg.tu-darmstadt.de>
> To: gnats-bugs@NetBSD.org
> Cc: kern-bug-people@NetBSD.org, gnats-admin@NetBSD.org
> Subject: Re: kern/44652: 'gpt destroy' panics
> Date: Tue, 1 Mar 2011 10:58:40 +0100
>
> At 17:15 Uhr +0000 28.02.2011, Hauke Fath wrote:
> > 'gpt destroy raid0' when raid0 is on dk1 which has just been
> > 'dkctl delwedge'd panics the machine.
> >
> > For details, see the lovely picture (900 KByte) at
> > <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_panic.jpg>
>
> And another one...
>
> I deconstructed wedges and gpts of the above installation in the right
> sequence, dd(1)ed the beginning of the disk, and ten seconds or so later
> was hit with
> <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_raid_panic.jpg>.
>
> hauke
The same assembler instruction in both cases. When you do
'show register' in ddb (after the crash) and you see a line
rax 0
then the crash is caused by a NULL pointer dereference.
When you built your kernel with makeoptions DEBUG="-g"
then you have a netbsd.gdb file and you can do:
gdb netbsd.gdb
(gdb) list *(dkstrategy+0x1a)
Christoph
From: Hauke Fath <hf@spg.tu-darmstadt.de>
To: gnats-bugs@NetBSD.org
Cc: kern-bug-people@NetBSD.org
Subject: Re: kern/44652: 'gpt destroy' panics
Date: Wed, 2 Mar 2011 11:41:57 +0100
At 10:00 Uhr +0000 01.03.2011, Hauke Fath wrote:
> I deconstructed wedges and gpts of the above installation in the right
> sequence, dd(1)ed the beginning of the disk, and ten seconds or so later
> was hit with
> <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_raid_panic.jpg>.
And another one
<http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_raidframe_panic.jpg>
which I got while deconstructing wedges and partitions out of order. As
Christoph pointed out, another null pointer issue; not sc though, which is
checked in the caller dkstrategy().
{Con, DE}structing the gpt setup was done with the scripts at
<http://la.causeuse.org/hauke/NetBSD/gpt-issues/mk_gpt.sh>
<http://la.causeuse.org/hauke/NetBSD/gpt-issues/rm_gpt.sh>
with 'env testing=1 sh rm_gpt.sh' making a mess.
hauke
--
The ASCII Ribbon Campaign Hauke Fath
() No HTML/RTF in email Institut für Nachrichtentechnik
/\ No Word docs in email TU Darmstadt
Respect for open standards Ruf +49-6151-16-3281
From: Hauke Fath <hf@spg.tu-darmstadt.de>
To: gnats-bugs@NetBSD.org
Cc: kern-bug-people@NetBSD.org, dholland@NetBSD.org
Subject: Re: kern/44652 ('gpt destroy' panics)
Date: Wed, 2 Mar 2011 11:44:53 +0100
At 22:48 Uhr +0000 28.02.2011, dholland@NetBSD.org wrote:
[Christos' commit]
>did that help?
Yes. I see a bunch of error messages, but no panic.
Repeatedly {con,de}structing the setup still brings up a panic (see my
other mail).
hauke
--
The ASCII Ribbon Campaign Hauke Fath
() No HTML/RTF in email Institut fŸr Nachrichtentechnik
/\ No Word docs in email TU Darmstadt
Respect for open standards Ruf +49-6151-16-3281
From: Christoph Egger <Christoph_Egger@gmx.de>
To: gnats-bugs@NetBSD.org
Cc: Hauke Fath <hf@spg.tu-darmstadt.de>, kern-bug-people@netbsd.org,
gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Subject: Re: kern/44652: 'gpt destroy' panics
Date: Wed, 02 Mar 2011 12:07:32 +0100
On 03/02/11 11:45, Hauke Fath wrote:
> The following reply was made to PR kern/44652; it has been noted by GNATS.
>
> From: Hauke Fath<hf@spg.tu-darmstadt.de>
> To: gnats-bugs@NetBSD.org
> Cc: kern-bug-people@NetBSD.org
> Subject: Re: kern/44652: 'gpt destroy' panics
> Date: Wed, 2 Mar 2011 11:41:57 +0100
>
> At 10:00 Uhr +0000 01.03.2011, Hauke Fath wrote:
> > I deconstructed wedges and gpts of the above installation in the right
> > sequence, dd(1)ed the beginning of the disk, and ten seconds or so later
> > was hit with
> > <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_raid_panic.jpg>.
>
> And another one
>
> <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_raidframe_panic.jpg>
>
> which I got while deconstructing wedges and partitions out of order. As
> Christoph pointed out, another null pointer issue; not sc though, which is
> checked in the caller dkstrategy().
This time the crash happens in sys/dev/dkwedge/dk.c, line 1200:
nbp->b_dev = sc->sc_parent->dk_rawvp->v_rdev;
dk_rawvp is NULL.
Christoph
>
> {Con, DE}structing the gpt setup was done with the scripts at
>
> <http://la.causeuse.org/hauke/NetBSD/gpt-issues/mk_gpt.sh>
> <http://la.causeuse.org/hauke/NetBSD/gpt-issues/rm_gpt.sh>
>
> with 'env testing=1 sh rm_gpt.sh' making a mess.
From: Christoph Egger <Christoph_Egger@gmx.de>
To: gnats-bugs@NetBSD.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org,
netbsd-bugs@netbsd.org, Hauke Fath <hf@spg.tu-darmstadt.de>
Subject: Re: kern/44652: 'gpt destroy' panics
Date: Thu, 03 Mar 2011 07:56:20 +0100
On 02.03.11 12:15, Christoph Egger wrote:
> The following reply was made to PR kern/44652; it has been noted by GNATS.
>
> From: Christoph Egger <Christoph_Egger@gmx.de>
> To: gnats-bugs@NetBSD.org
> Cc: Hauke Fath <hf@spg.tu-darmstadt.de>, kern-bug-people@netbsd.org,
> gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
> Subject: Re: kern/44652: 'gpt destroy' panics
> Date: Wed, 02 Mar 2011 12:07:32 +0100
>
> On 03/02/11 11:45, Hauke Fath wrote:
> > The following reply was made to PR kern/44652; it has been noted by GNATS.
> >
> > From: Hauke Fath<hf@spg.tu-darmstadt.de>
> > To: gnats-bugs@NetBSD.org
> > Cc: kern-bug-people@NetBSD.org
> > Subject: Re: kern/44652: 'gpt destroy' panics
> > Date: Wed, 2 Mar 2011 11:41:57 +0100
> >
> > At 10:00 Uhr +0000 01.03.2011, Hauke Fath wrote:
> > > I deconstructed wedges and gpts of the above installation in the right
> > > sequence, dd(1)ed the beginning of the disk, and ten seconds or so later
> > > was hit with
> > > <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_destroy_raid_panic.jpg>.
> >
> > And another one
> >
> > <http://la.causeuse.org/hauke/NetBSD/gpt-issues/gpt_raidframe_panic.jpg>
> >
> > which I got while deconstructing wedges and partitions out of order. As
> > Christoph pointed out, another null pointer issue; not sc though, which is
> > checked in the caller dkstrategy().
>
> This time the crash happens in sys/dev/dkwedge/dk.c, line 1200:
>
> nbp->b_dev = sc->sc_parent->dk_rawvp->v_rdev;
>
> dk_rawvp is NULL.
Please update said file from cvs and retry.
--------------------------------------------------
Module Name: src
Committed By: christos
Date: Thu Mar 3 03:39:08 UTC 2011
Modified Files:
src/sys/dev/dkwedge: dk.c
Log Message:
check rawvp before doing ioctl or strategy.
To generate a diff of this commit:
cvs rdiff -u -r1.59 -r1.60 src/sys/dev/dkwedge/dk.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
--------------------------------------------------
Christoph
From: Hauke Fath <hf@spg.tu-darmstadt.de>
To: Christoph Egger <Christoph_Egger@gmx.de>
Cc: gnats-bugs@NetBSD.org, kern-bug-people@NetBSD.org, gnats-admin@NetBSD.org
Subject: Re: kern/44652: 'gpt destroy' panics
Date: Thu, 3 Mar 2011 13:24:06 +0100
At 7:56 Uhr +0100 03.03.2011, Christoph Egger wrote:
>> This time the crash happens in sys/dev/dkwedge/dk.c, line 1200:
>>
>> nbp->b_dev = sc->sc_parent->dk_rawvp->v_rdev;
>>
>> dk_rawvp is NULL.
>
>Please update said file from cvs and retry.
Looks good - the panic is gone.
Instead, the kernel is left in a state where the raid0 can neither be
created ("device busy") nor destroyed ("device not configured"), and you
have to reboot to clean up. Which, I guess, is not nice, but acceptable.
hauke
--
The ASCII Ribbon Campaign Hauke Fath
() No HTML/RTF in email Institut für Nachrichtentechnik
/\ No Word docs in email TU Darmstadt
Respect for open standards Ruf +49-6151-16-3281
State-Changed-From-To: feedback->open
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Wed, 16 Mar 2011 06:14:23 +0000
State-Changed-Why:
no, that's not acceptable :-)
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.39 2013/11/01 18:47:49 spz Exp $
$NetBSD: gnats_config.sh,v 1.8 2006/05/07 09:23:38 tsutsui Exp $
Copyright © 1994-2007
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.